www.redpacketsecurity.com Open in urlscan Pro
2606:4700:3036::ac43:c62e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
Submission: On September 07 via api (September 7th 2021, 5:16:02 am UTC) from GB

Summary HTTP 247 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 28 IPs in 4 countries across 21 domains to perform 247 HTTP transactions. The main IP is 2606:4700:3036::ac43:c62e, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.redpacketsecurity.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2021. Valid for: a year.

This is the only time www.redpacketsecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
54	2606:4700:303... 2606:4700:3036::ac43:c62e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:5f41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	104.222.176.201 104.222.176.201	6762 (SEABONE-N...) (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A.)
19	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
4	2606:4700:e0:... 2606:4700:e0::ac40:6725	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
2	2606:4700:e0:... 2606:4700:e0::ac40:6625	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
1	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
31	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
10	104.222.176.10 104.222.176.10	6762 (SEABONE-N...) (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A.)
1	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
2	2a04:4e42:3::272 2a04:4e42:3::272	54113 (FASTLY) (FASTLY)
65	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
7 12	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
1 1	52.18.11.109 52.18.11.109	16509 (AMAZON-02) (AMAZON-02)
5	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1 1	18.194.175.178 18.194.175.178	16509 (AMAZON-02) (AMAZON-02)
1	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
2 2	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84	16509 (AMAZON-02) (AMAZON-02)
247	28

54 2606:4700:3036::ac43:c62e (United States)

ASN13335 (CLOUDFLARENET, US)

www.redpacketsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.222.176.201 (United States)

ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT)

comments.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:e0::ac40:6725 (United States)

ASN13335 (CLOUDFLARENET, US)

smartarget.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:e0::ac40:6625 (United States)

ASN13335 (CLOUDFLARENET, US)

api.smartarget.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.2 (United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.222.176.10 (United States)

ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT)

tg.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
oauth.tg.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:3::272 (United States)

ASN54113 (FASTLY, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

65 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany) 7 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.11.109 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-11-109.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.194.175.178 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-175-178.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.115 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
85	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	961 KB
54	redpacketsecurity.com www.redpacketsecurity.com	371 KB
35	doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	259 KB
16	google.com 7 redirects adservice.google.com www.google.com	1 KB
16	gstatic.com fonts.gstatic.com	261 KB
10	tg.dev tg.dev oauth.tg.dev	163 KB
8	googletagservices.com www.googletagservices.com	286 KB
7	googleapis.com fonts.googleapis.com	4 KB
6	smartarget.online smartarget.online api.smartarget.online	37 KB
5	comments.app comments.app	48 KB
3	google.de adservice.google.de	409 B
2	pubmatic.com 2 redirects image6.pubmatic.com	1 KB
2	media-amazon.com m.media-amazon.com	9 KB
2	cloudflareinsights.com static.cloudflareinsights.com	10 KB
1	innovid.com ag.innovid.com	296 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com	460 B
1	mookie1.com odr.mookie1.com	324 B
1	agkn.com 1 redirects d.agkn.com	760 B
1	everesttech.net 1 redirects pixel.everesttech.net	375 B
1	googleadservices.com partner.googleadservices.com	664 B
1	wp.com i1.wp.com	80 KB
247	21

	Domain	Requested by
66	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.redpacketsecurity.com
54	www.redpacketsecurity.com	www.redpacketsecurity.com static.cloudflareinsights.com
30	googleads.g.doubleclick.net	pagead2.googlesyndication.com www.redpacketsecurity.com googleads.g.doubleclick.net
19	pagead2.googlesyndication.com	www.redpacketsecurity.com pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net
16	fonts.gstatic.com	fonts.googleapis.com
13	www.google.com	7 redirects tpc.googlesyndication.com googleads.g.doubleclick.net
9	tg.dev	comments.app
8	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
7	fonts.googleapis.com	www.redpacketsecurity.com comments.app tpc.googlesyndication.com
5	cm.g.doubleclick.net	googleads.g.doubleclick.net
5	comments.app	www.redpacketsecurity.com comments.app tg.dev
4	smartarget.online	www.redpacketsecurity.com smartarget.online
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.de	pagead2.googlesyndication.com
2	image6.pubmatic.com	2 redirects
2	m.media-amazon.com
2	api.smartarget.online	smartarget.online
2	static.cloudflareinsights.com	www.redpacketsecurity.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	pixel.rubiconproject.com	1 redirects
1	odr.mookie1.com	googleads.g.doubleclick.net
1	d.agkn.com	1 redirects
1	pixel.everesttech.net	1 redirects
1	oauth.tg.dev	comments.app
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	i1.wp.com
247	26

This site contains links to these domains. Also see Links.

Domain
smartarget.online
app.smartarget.online
twitter.com
t.me
www.reddit.com
discord.gg
www.patreon.com
securityaffairs.co
www.amazon.com
themegrill.com
wordpress.org

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-18` - `2022-07-17`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.comments.app Go Daddy Secure Certificate Authority - G2	`2021-03-28` - `2022-04-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.tg.dev Go Daddy Secure Certificate Authority - G2	`2021-04-06` - `2022-05-08`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-08-09` - `2022-07-24`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh

This page contains 33 frames:

Primary Page: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
Frame ID: D770887F44E82250C62C1841DFE95F97
Requests: 84 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20190131/zrt_lookup.html
Frame ID: 46952C30CE88F3AA5BA4FB74D4164DFC
Requests: 1 HTTP requests in this frame

Frame: https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Pacific%20City%20Bank%20hit%20by%20AVOS%20Locker%20Ransomware%20-%20RedPacket%20Security&limit=5&color=E22F38
Frame ID: 99DF0E9414A93EC1AA663D61FA31C2E0
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&adk=1812271804&adf=3025194257&lmt=1630944204&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744187&bpp=3&bdt=473&idt=66&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8553269379453&frm=20&pv=2&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=86
Frame ID: 58CC77160908F1527D469CCC577ED538
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 8F7B8059697EFAEAE22958642F58CE19
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 11CB4253B2555A28F6D49CE45DCB5B7B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=299020469&adf=1105561471&pi=t.aa~a.539797476~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=2&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0&nras=2&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1480&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=68ep1SfYkS&p=https%3A//www.redpacketsecurity.com&dtd=15
Frame ID: 736E423D12A75CD04BD6B5173F6400B3
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4150600299&adf=3123284526&pi=t.aa~a.1372487962~rp.4&w=800&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=800x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250&nras=3&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1859&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=3GDqLyftHS&p=https%3A//www.redpacketsecurity.com&dtd=36
Frame ID: 16A53A7B517A3F32E3ACF05CF0471CC3
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=1607111869&adf=1867724945&pi=t.aa~a.1057262345~rp.1&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280&nras=4&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1882&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=Klb3kcPq8y&p=https%3A//www.redpacketsecurity.com&dtd=40
Frame ID: F0FBF78B6660DE486304EF0DE3D19F13
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47
Frame ID: C40122C6E64F0E6E017327F7DA70AB32
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3130937508&adf=1730821504&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600&nras=6&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=4231&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=zomBIt2Ok5&p=https%3A//www.redpacketsecurity.com&dtd=50
Frame ID: DAC3F9DB42CBB2BEE0BF66F4A7B301AF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3147369498&adf=1037197063&pi=t.aa~a.2404515935~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1140x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=1&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600%2C1200x90&nras=7&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=4331&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=cSYQn82Yjl&p=https%3A//www.redpacketsecurity.com&dtd=53
Frame ID: 36756E206E58CC360444BC527F9E007C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1
Frame ID: EBD9E2F59C7CE421871926415B57F15B
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 0E7F2E37F9DD81C0EE19FC7DC8EDD8BE
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js
Frame ID: AE2EE6E855559A915F467EC26F724F2D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: F8EE5A0233FE239E63E285694885A8FC
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 3D67C4C21BE5C2549AFDDDE83846396A
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html
Frame ID: B639FA78C3BF6BD3112AD0548D2D0821
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CsgBdgPU2Yd7tL4fm7gPtipioA6SJzp9kuary_skNnNO2_9ocEAEgta-gJ2CVAqABzLya2QPIAQmpAo8KDDEY67M-qAMByANIqgSNAk_QexkswR_xWtZK9qv-zWMmOZEB1Gz4EFCzGmSIxiNSMd6x5pAyTSZSIYmiJnDzzP5JexwLpidMuoLMRy1BN7LuSCkld8FeonnGflT91UGTXUc5lGkXCtXgZu4umGhvFxEljyBV-NDSdXOisE30X-Lj72KqAOVg5fdxmh3qC24peB9HdurqYFGuNTEMuClG-B5ssjvF9Bne2HFIrwEcx_aQCW_kEsF2N50kT4YVD4mLlTSZ1dkRhzFVQhaIYanl0R6hynq3spT_H_ZnPLvVm6EZ0uEFFxB4otR9CvSoy1MoxP89Fg7STWn2_yTteY1A2js0zCzJnxf1-eI2yvlewtDEgIYauq7gj0BJZe7awASEuvTBxAOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHnMPlJqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQi8QI0ggJCIDhgBAQARgfgAoByAsB2BMMiBQB0BUBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=tWVw4rR7sC8&template_id=419
Frame ID: 2B31C79D95EF572E2836937E12AF3921
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: A91C5D488E70E455AD94BCB7B5AE5261
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html
Frame ID: DF181ABDD90D56C486882FD3747FF650
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=COIelgPU2YbXKLYyngAflg5KQBPGm6-Zk7JbtjIQO6Kq2lYsDEAEgta-gJ2CVAqABvfz8nAPIAQmpApaBU1EI77M-qAMByANIqgT-AU_QCuDrUErXJN8U6pUuunE2NXlZclJn2Tem-hnC6WTkSW-hkNRBeWl9DaJ8XcWIbPlRVBhABas5TJ_nf-uCFUvJh19C83rMrixWFqSIKngCJ97gybBMwcyolbqffucorYR-M_gbIA0QNOBz3LZtkeJvcPi_VcBkcBJbSbvGnfEiGtCXjtIBmegAmOQBlF9HkEgQ25FCKQQT3YU08fN2gwaiRjDn516DhBto4mCo6AJ-UP6nsAv1L5H9Y9GGtGIlJXSl845_30llGIjLxJt-EIuJNHed4vFGt4PVcGl2szvx9TQCJ0sY9qIfcRPUqKgFI3Pl1ueMZyEHnctT5B9KwATd9rfbyAOSBQQIBBgBkgUECAUYBKAGLoAHq4ODY6gH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQptUH0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=zSqfEG9JAlw&template_id=419
Frame ID: 62CF0C0E46E740500D923B1D8103BF0C
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 119C1E8C6A5671DEF7AFFD057070C56C
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js
Frame ID: 672AD5E49EBEAF0ED4AC9A34A094315E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html
Frame ID: CD1E5A05B285356D5EA6D978863A22CA
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=C6nl9gPU2YcXhLo2dgQfD1adQ8abr5mTv7bug0g7oqraViwMQASC1r6AnYJUCoAG9_PycA8gBCakCloFTUQjvsz6oAwHIA0iqBP4BT9DqTA7pVp5jtlTpRVqiLOuv1jm2OwaQgQg2OhLxvRXzhmj4k7zFoQ-RvT3D-ex_4-3eKniuY660yt-kJvBvx-fcbh5MKL00JHkIPVMMd2K5l3bwAv-KgCogyBLFJz-Yx5BjTrK58RcUKwXG-POjm_ORjHNAALNaij-iURMxgvhGXxoJ-KQ6GbmBM1-umf33jiasbpuNLtGEEffsI1NImRojfSS_g_IetgfYDCJ4oq32Rg9rzLmYKqYp8SrIkebfNKfVKTafutJcMWHBLo8szZkAhivDdT2YakhDX2lcruajksBVkQGwguTIYDbl5T-5GyRqtj2n9eJppKHzvY3ABN32t9vIA5IFBAgEGAGSBQQIBRgEoAYugAerg4NjqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G9gHAPIHBBCmiyzSCAkIgOGAEBABGB-ACgHICwHYEw2IFAHQFQGAFwGyFxwKGggAEhRwdWItMTUzNjMzNDIxOTU2Mjc3MRgA&sigh=iMP_3FutVZw&template_id=419
Frame ID: C0C846AD2EBE2DEF1B427E09A94BBD50
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html
Frame ID: DC95999B102205688F23D0FD73A587F1
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CF3ojgPU2YZOUMJKVgQeavrLQAaroxK9k7P7R0bIO__WQ49cCEAEgta-gJ2CVAqABvouR0APIAQmpApaBU1EI77M-qAMByANIqgSEAk_Q9mb0j6IoAy9RJmYbLTPJBHPqgpvY8DsyTysv97J8cakvkyPGMg9em2DfNYc9GVFBdPOPCBX8uyhCdIdM36QVLOoE9uLnpo4Mjhsf-36cLi886Sgz_wmcpfxhEN443B8fGnUnN0XXxPK47J9GJhq_RphpxJPvjT_TY2nvC7RrLVFMMJbPQatzQeQcNl3cigoIoC_9-FWifp2aZmveGgKJem2av8DA0aTPPcXCL3biDwmkibUSvn4e2lp1g1ns9ti_3zTtZmuWE_z91B3qoD9OLJtunwbCqaJ3JlBoBKR-kF6XIInkL-8qYNyESQs8FLPfZCfxwzDUV10AFNtPyWMCmAr8wATcs7Gz9AOSBQQIBBgBkgUECAUYBKAGLoAH6tKVMKgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQta8W0ggJCIDhgBAQARgfgAoByAsB2BMNiBQB0BUBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=8u9OOCxNv2E&template_id=419
Frame ID: 248F061AEDF88367546DA810142FE3D4
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html
Frame ID: 7C2BE8FACAD124E4DA139527ED76C680
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CDqiEgPU2YZaKL8CBx_APxZyC6AKq6MSvZPz80dGyDv_1kOPXAhABILWvoCdglQKgAb6LkdADyAEJqQKWgVNRCO-zPqgDAcgDSKoE_wFP0NwNSuQB1phJ82-VtObHfq3Ove5mLIqQg875D0dEznyleN6_uF1YIvWpi1RUsNJpg-fTFhhWCrw6mEZH2oegXGzBt5NSdZILvKPu2kvjUzRuZXTMJ8y0CIHgTWHz-AuHCUuBi-zjpyRePv3wYNH_F6_2sdjz_kH9unJjs8zMnyr2GFsIvmQoq_B_SZbEaGJJYtPyPWU-2qo3jt3RB5htQf6D-VWqNNzU5FN1nsGFgggXCsQOH1Q9SVJpHw04DHyg9wJ7wplKoymOD9upuLcOHA_3LCPZ1KE8F0zcLfoSApzkfeR8LGPi_ILyrz9fxytMc_eTJ8rR3XD8OGh2dafABNyzsbP0A5IFBAgEGAGSBQQIBRgEoAYugAfq0pUwqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G9gHAPIHBBDp2g_SCAkIgOGAEBABGB-ACgHICwHYEw2IFAHQFQGAFwGyFxwKGggAEhRwdWItMTUzNjMzNDIxOTU2Mjc3MRgA&sigh=UtboLSyKYaQ&template_id=419
Frame ID: A7305378A67D8DACC465D267E2591E45
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: AE4DD0D7F95595522E15211792A9BD7C
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 198925DE2F63A1ECD075BD4BE2D34886
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: D7815949A3F4B534884FF4B8C9B2003A
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Pacific City Bank hit by AVOS Locker Ransomware - RedPacket Security4.7 out of 5 starsAvailable for Amazon Prime4.7 out of 5 starsAvailable for Amazon Prime4.5 out of 5 starsAvailable for Amazon Prime4.6 out of 5 starsAvailable for Amazon Prime4.3 out of 5 starsAvailable for Amazon PrimeAvailable for Amazon Prime

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /react.*\.js/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

247
Requests

100 %
HTTPS

68 %
IPv6

21
Domains

26
Subdomains

28
IPs

4
Countries

2494 kB
Transfer

5931 kB
Size

4
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://smartarget.online/?ref=endtrial

Search URL Search Domain Scan URL

URL: https://app.smartarget.online/#/subscription/buy/?ref=endtrial
Title: Buy Smartarget Pro - $4.16/month

Search URL Search Domain Scan URL

URL: https://twitter.com/RedPacketSec?ref_src=twsrc%5Etfw
Title: <img src="https://www.redpacketsecurity.com/wp-content/uploads/2020/12/iconfinder_twitter_circle_294709.png" title="Twitter" alt="twitter" width="50" height="50" />

Search URL Search Domain Scan URL

URL: https://t.me/RedPacketSecurity
Title: <img class="wp-image-5609" style="width: 50px;" src="https://www.redpacketsecurity.com/wp-content/uploads/2020/06/telegram_PNG34-e1591362686455.png" title="Telegram" alt="Telegram" width="50" height="50" />

Search URL Search Domain Scan URL

URL: https://www.reddit.com/r/RedPacketSecurity/
Title: <img src="https://www.redpacketsecurity.com/wp-content/uploads/2020/12/reddit-1.png" title="Reddit" alt="Reddit" width="50" height="50" />

Search URL Search Domain Scan URL

URL: https://discord.gg/xZY94PXXs4
Title: <img src="https://www.redpacketsecurity.com/wp-content/uploads/2020/12/discord-logo-png-7617-e1609320732895.png" title="Discord" alt="Discord" width="51" height="51" />

Search URL Search Domain Scan URL

URL: https://www.patreon.com/bePatron?u=37301876
Title: <img src="https://www.redpacketsecurity.com/wp-content/uploads/2021/01/Digital-Patreon-Wordmark_FieryCoralv2-e1609686169209.png" alt="Discord" height="50" title="Pacific City Bank hit by AVOS Locker Ransomware 2">

Search URL Search Domain Scan URL

URL: https://securityaffairs.co/wordpress/121872/cyber-crime/pacific-city-bank-avos-locker-ransomware.html?utm_source=rss&utm_medium=rss&utm_campaign=pacific-city-bank-avos-locker-ransomware
Title: Original Source

Search URL Search Domain Scan URL

URL: https://www.patreon.com/RedPacketSecurity?fan_landing=true
Title: <img width="300" height="300" src="https://www.redpacketsecurity.com/wp-content/uploads/2021/05/PATREON-SQUARE-300x300.jpg" class="image wp-image-15749 attachment-medium size-medium" alt="" style="max-width: 100%; height: auto;" srcset="https://www.redpacketsecurity.com/wp-content/uploads/2021/05/PATREON-SQUARE-300x300.jpg 300w, https://www.redpacketsecurity.com/wp-content/uploads/2021/05/PATREON-SQUARE-150x150.jpg 150w, https://www.redpacketsecurity.com/wp-content/uploads/2021/05/PATREON-SQUARE.jpg 500w" sizes="(max-width: 300px) 100vw, 300px" />

Search URL Search Domain Scan URL

URL: https://www.amazon.com/dp/1593271441?tag=redpacketsecu-20&linkCode=osi&th=1&psc=1&language=en_US&currency=USD
Title: <img src="https://m.media-amazon.com/images/I/61WRz4V+ADL._SL125_.jpg" alt="No Starch Press" style="max-height:125px" />

Search URL Search Domain Scan URL

URL: https://www.amazon.com/product-reviews/1593271441?language=en_US&tag=redpacketsecu-20
Title: 4.7 out of 5 stars

Search URL Search Domain Scan URL

URL: https://www.amazon.com/dp/1119561450?tag=redpacketsecu-20&linkCode=osi&th=1&psc=1&language=en_US&currency=USD
Title: <img src="https://m.media-amazon.com/images/I/41SgYV7BhqL._SL125_.jpg" alt="" style="max-height:125px" />

Search URL Search Domain Scan URL

URL: https://www.amazon.com/product-reviews/1119561450?language=en_US&tag=redpacketsecu-20
Title: 4.7 out of 5 stars

Search URL Search Domain Scan URL

URL: https://www.amazon.com/dp/1119485479?tag=redpacketsecu-20&linkCode=osi&th=1&psc=1&language=en_US&currency=USD
Title: <img src="https://m.media-amazon.com/images/I/51pJEUhsNTL._SL125_.jpg" alt="" style="max-height:125px" />

Search URL Search Domain Scan URL

URL: https://www.amazon.com/product-reviews/1119485479?language=en_US&tag=redpacketsecu-20
Title: 4.5 out of 5 stars

Search URL Search Domain Scan URL

URL: https://www.amazon.com/dp/1260108414?tag=redpacketsecu-20&linkCode=osi&th=1&psc=1&language=en_US&currency=USD
Title: <img src="https://m.media-amazon.com/images/I/51mOKM4XZxL._SL125_.jpg" alt="" style="max-height:125px" />

Search URL Search Domain Scan URL

URL: https://www.amazon.com/product-reviews/1260108414?language=en_US&tag=redpacketsecu-20
Title: 4.6 out of 5 stars

Search URL Search Domain Scan URL

URL: https://www.amazon.com/dp/1709182660?tag=redpacketsecu-20&linkCode=osi&th=1&psc=1&language=en_US&currency=USD
Title: <img src="https://m.media-amazon.com/images/I/51px3FVUpNL._SL125_.jpg" alt="" style="max-height:125px" />

Search URL Search Domain Scan URL

URL: https://www.amazon.com/product-reviews/1709182660?language=en_US&tag=redpacketsecu-20
Title: 4.3 out of 5 stars

Search URL Search Domain Scan URL

URL: https://twitter.com/messages/compose?recipient_id=3361362767&text=I%27d%20like%20to%20become%20a%20sponsor%20for%20the%20website
Title: <img src="https://www.redpacketsecurity.com/wp-content/uploads/2021/05/banner.jpg" width="728" height="90" alt="">

Search URL Search Domain Scan URL

URL: https://themegrill.com/themes/colormag
Title: ColorMag

Search URL Search Domain Scan URL

URL: https://wordpress.org/
Title: WordPress

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 120

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 132

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPLPXVGLnu5OcbiO27_YNs807h0qKp7UekUll36fuXfWQ3h3qjpE5iSxOiR_dX1O3xx7ht_DWY7Ma8en6Bmh8Kri5yRfnnQ&google_gid=CAESEGd42nZRoNeUt611J721gE8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVRiMWdRQUFBTUprNXk1RA&google_push=AYg5qPLPXVGLnu5OcbiO27_YNs807h0qKp7UekUll36fuXfWQ3h3qjpE5iSxOiR_dX1O3xx7ht_DWY7Ma8en6Bmh8Kri5yRfnnQ

Request Chain 133

https://d.agkn.com/pixel/2175/?google_gid=CAESEFaHSR8Ua-Qv5ZNMIvKZENQ&google_cver=1&google_push=AYg5qPIntx0dpECHXEkFgNQ-f4T3OVOywQidSJIjXpeSR1vwvYKHsSpoQTZzN4vHSVmN2VQQCa8tZNRVX0qMoKA0G_JGFZLSIXg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIntx0dpECHXEkFgNQ-f4T3OVOywQidSJIjXpeSR1vwvYKHsSpoQTZzN4vHSVmN2VQQCa8tZNRVX0qMoKA0G_JGFZLSIXg&google_hm=Q0FFU0VGYUhTUjhVYS1RdjVaTk1JdktaRU5R

Request Chain 135

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESECuvqZmEXx1GHc7wX16NtXs&google_cver=1&google_push=AYg5qPKbxwcuy38DE1uZUq_3wm-EhSSE1q-z_4mOIN2mCiZdgG7t-rINGY9VmzEHM2uqJAx647HJR4IJsvKdJYEP2We03MjE1zs HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESECuvqZmEXx1GHc7wX16NtXs&google_cver=1&google_push=AYg5qPKbxwcuy38DE1uZUq_3wm-EhSSE1q-z_4mOIN2mCiZdgG7t-rINGY9VmzEHM2uqJAx647HJR4IJsvKdJYEP2We03MjE1zs&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RY7yJ-2CSPaqRb5DLhVxQQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKbxwcuy38DE1uZUq_3wm-EhSSE1q-z_4mOIN2mCiZdgG7t-rINGY9VmzEHM2uqJAx647HJR4IJsvKdJYEP2We03MjE1zs

Request Chain 136

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFj-zOPFZO696MGvdtv9-1Q&google_cver=1&google_push=AYg5qPJDBp_phjXHZkkRLuXBrsHPBL2FraxcqTfNLjVtkT5WzbE3U_90dbVW1cqWQphVnDRCGFsvBl9cOv3Ig-MCg8Kv_pXDYtA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Q5TURHV0ItMVItNFBQSg==&google_push=AYg5qPJDBp_phjXHZkkRLuXBrsHPBL2FraxcqTfNLjVtkT5WzbE3U_90dbVW1cqWQphVnDRCGFsvBl9cOv3Ig-MCg8Kv_pXDYtA

Request Chain 137

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1

Request Chain 140

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 155

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 198

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 229

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 244

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 245

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

247 HTTP transactions
15 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/ 94 KB
19 KB 192ms
160ms Document
text/html 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.4.23 PleskLin

Resource Hash

83510accc35e1d155a95730d4a7704dd555d74293cfcf681c9ef6a7feefc157b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:method: GET
:authority: www.redpacketsecurity.com
:scheme: https
:path: /pacific-city-bank-hit-by-avos-locker-ransomware/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.23 PleskLin
cache-control: no-cache
wpo-cache-status: cached
last-modified: Mon, 06 Sep 2021 16:03:24 GMT
strict-transport-security: max-age=15768000; includeSubDomains
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qWSsEXb%2Bu%2BqC3OCwgGtwCgi6%2FB4sFxNwPiil1Ns4%2F7Ble7oxPdKl%2FHuzxvMRJfVLL%2FQeuKOhs0r6GQ9kfRNNj8bZUomqNv7A1Lv9gvSNZxeFGQIgHaq%2BHFV0ytQbBDpQOP8S1Qq2DcEwqQgVuOX%2BwqF0RWw1w14Z"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 68ad75fd2c7a1762-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3-29 200 dzVfmdsktJhqzBiYTf0j-rfYP9E.js Show response
www.redpacketsecurity.com/cdn-cgi/apps/head/ 5 KB
2 KB 30ms
17ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/apps/head/dzVfmdsktJhqzBiYTf0j-rfYP9E.js
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2ec7cee57ce5e6ce8f7e87ca4c7b4182859964aca436f1ff87884c7ef3bcc26

Request headers

:path: /cdn-cgi/apps/head/dzVfmdsktJhqzBiYTf0j-rfYP9E.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3952676
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: FEZ7Z3RC4R124XSY
x-amz-id-2: /drShYQF7sfO/RPsdnumRQ6AhPPcK/Wq5rFQ9++LStauy0SiKJxdURHuEaWhmtyXTzEjKbQvRSw=
last-modified: Fri, 23 Jul 2021 11:10:20 GMT
server: cloudflare
etag: W/"933ea25769b6fb462b3c5ac531e3a898"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g28Nl%2FJyksuoMNZlOwC4uAGiXIzE6xaV6Xm5U9d7oSvJAc5vELbFLdshf7gyMbxG4otgDhFkIoy6REX%2BmEgfFFO5oqKWN%2BvZav4mpcT%2B1UswDrI0%2B8OIvG8g%2F%2BDljrOuVaXKvwMHzj3Hlf02w7%2Fmd557gkS4pd1W"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 5yFJJAsmwVvHOKAeDBWN02FtyeNkx2ie
cf-ray: 68ad75fe4f3bc2ae-FRA

GET
H3-29 200 style.min.css
www.redpacketsecurity.com/wp-includes/css/dist/block-library/ 79 KB
11 KB 45ms
32ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/css/dist/block-library/style.min.css?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/css/dist/block-library/style.min.css?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 28 Jul 2021 06:20:01 GMT
server: cloudflare
etag: W/"6100f711-13abe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ojlm8x4G%2BptfGyhfv94Kr3ZFG03d274dGKbiXd68KC92gYbLcGG56bTMk0iKCjs%2BsSzpPcgOW%2BbEfWzf%2Bpf8yqQYI8XT8LWfExfVL18pHqHq2Prhv1CW5VjuAHsoTQ0Jfdg4Sko03gED5p%2Bt1gdJ8r6prjB5lmsv"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=432000
cf-ray: 68ad75fe4f39c2ae-FRA

GET
H3-29 200 app.css
www.redpacketsecurity.com/wp-content/plugins/patreon-connect/assets/css/ 2 KB
1 KB 41ms
28ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/patreon-connect/assets/css/app.css?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

af12f7592b4d8f6b8483bd9bab081ecf35abe485d5315fb0ecf30559ac2bd9cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/patreon-connect/assets/css/app.css?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 14 Aug 2021 19:00:46 GMT
server: cloudflare
etag: W/"611812de-bd4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gx3PGCuV0R5ynv%2FesysKJZwXANmGEhuftzmqNt9jWiwLss8CHhc37lx%2FmzdmvoiUxWs7F0Ot7p9yLrWv9ORjkNTgL10BHQYllh5wvscT53%2BfhymuxrGIkBKx2mFziD7UmDAttTWAJSUU2C12UvuHprYaRr%2Fc9tIF"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=432000
cf-polished: origSize=3028
cf-ray: 68ad75fe4f34c2ae-FRA
cf-bgj: minify

GET
H3-29 200 style.min.css
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/ 1019 B
1 KB 31ms
19ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/style.min.css?ver=4.7.3

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

f513ed107290a63ee74d2440a0c4b6f66289beba7ee693f498b6d765625bc1f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/amazon-auto-links/template/_common/style.min.css?ver=4.7.3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 01 Sep 2021 05:32:39 GMT
server: cloudflare
etag: W/"3fb-5cae86506a28b-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UStxuBb5lM8MGgawzR9gk0HFhEun7322kRG11DxOYfZWg021D15%2FWBJ13gdrI%2BU%2BFFt4HMqRuIOZw7Z4vLDq5j1EMkSuQfZSKLnfI%2BtsbX1Cf0QsFqW526Wh7m5e%2BvyXEeiEJLuHnnDqBrz%2FobcmZgRsVyw8vZaq"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-accel-version: 0.01
cache-control: max-age=432000
cf-ray: 68ad75fe4f30c2ae-FRA

GET
H3-29 200 style.min.css
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/list/ 9 KB
2 KB 40ms
29ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/list/style.min.css?ver=1.2.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

8261160588bad883690da277a0e9455441f5b7d11abccbfae7e42b3018ba8c08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/amazon-auto-links/template/list/style.min.css?ver=1.2.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 01 Sep 2021 05:32:39 GMT
server: cloudflare
etag: W/"612f1077-23d5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JAWa%2B2aG38EtyUfjopdbnrYB3nNceozcTHOA6wyH6KxNDoBAwqCXuaN6TR7h16zPsHjz4PD6NsBeuWPYCKBfcdC8hmQ7ziFQ%2BIWWurwfWTl09x8jwZFzaSGqTe9Vs6c%2FkE4y3syVTVUodvcEv%2FKh6fcADbISf2Ja"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=432000
cf-ray: 68ad75fe4f36c2ae-FRA

GET
H3-29 200 style.min.css
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/text/ 16 B
710 B 28ms
17ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/text/style.min.css?ver=1.0.1

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

9ddc0f6530a2a949a60ecc192689aba25551e0f9f6270b44803134b27708d883

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/amazon-auto-links/template/text/style.min.css?ver=1.0.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 16
last-modified: Wed, 01 Sep 2021 05:32:39 GMT
server: cloudflare
etag: "10-5cae86506c1cb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9EtbBmgUSj5Hy6lwPP4zBjiG8Y0UFCkamOmatsUaCqR7Jy1%2BvTjiI1c66PnFiAp7ZnfyaP3bXtrIxbnCO8%2B0SZC2W74JULhXR49k4bJPRwGaBe8aqYCttTog%2BrS1QWzzxysmfSrStOr6L6rCPrfziL1GW7BZQPUr"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-accel-version: 0.01
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad75fe4f33c2ae-FRA

GET
H3-29 200 style.css
www.redpacketsecurity.com/wp-content/themes/colormag/ 62 KB
11 KB 45ms
34ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag/style.css?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

842258538e379b1dabe5daddd81e90eeb7c69834580f33842bfdbde38d8f8400

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag/style.css?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 05 Aug 2021 15:13:05 GMT
server: cloudflare
etag: W/"610c0001-1397e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CM%2BMdEuSWFWy1cDQzjOfx8Slp45T4wmvyXVKM7NuR0ZE2EraP3emv4ZINCxsIbWzvXc4spMOwS%2Fzb1XlEkw2tbyJg9WCVr614g6UNpSNOFMbLnIQDm%2FzbZtmPJsBjCrw2xpe4zK7VgbfTkekL47Z96kwStV9hHnN"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=432000
cf-polished: origSize=80254
cf-ray: 68ad75fe4f3ac2ae-FRA
cf-bgj: minify

GET
H3-29 200 style.css
www.redpacketsecurity.com/wp-content/themes/colormag-child/ 0
696 B 43ms
32ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag-child/style.css?ver=2.0.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag-child/style.css?ver=2.0.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 0
last-modified: Tue, 05 Jan 2021 11:07:55 GMT
server: cloudflare
etag: "b2-5b82537f39153-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uaX%2F%2B0Q03pfl4t%2BweDAAM6Yxe%2B5beWydIT1h%2BZT8cf6nEb%2BQl5M5wuDo8zfHcuCKjKFF0i8%2FXn3V5q0RPOTgCnAAEz%2ByXLPAIShWyCqyc3dzOBibrItI6Pxbc%2BFPsdxmkHKspv9orA3cIOyGV3HUg8NzZo8CqVBC"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-accel-version: 0.01
cache-control: max-age=432000
cf-polished: origSize=178
accept-ranges: bytes
cf-ray: 68ad75fe4f38c2ae-FRA
cf-bgj: minify

GET
H3-29 200 font-awesome.min.css
www.redpacketsecurity.com/wp-content/themes/colormag/fontawesome/css/ 30 KB
7 KB 39ms
29ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag/fontawesome/css/font-awesome.min.css?ver=2.0.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag/fontawesome/css/font-awesome.min.css?ver=2.0.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 05 Aug 2021 15:13:05 GMT
server: cloudflare
etag: W/"610c0001-791c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qrcfthb27%2BMyxGO%2B8BmtWz4%2B1quvG48aDvoyEwRPVsqjjoYKSocvmX%2FpspZMRyhcj4T9cNS8kW3GPY2%2BA6bj%2FSGP%2BhiS2oWWZXc5dnEzJE44Z2Pp%2BM%2BY4gM%2FbfvSX9YqKz5T5JSh%2B0XOMBlt93pxG9abRkJjjSmj"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=432000
cf-ray: 68ad75fe4f37c2ae-FRA

GET
H2 200 css
fonts.googleapis.com/ 4 KB
739 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600&1&display=swap&ver=2.0.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6287db4afba7afb075b81209ee68696f14cb268cdc8209a29c1e38f0dcf435d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 04:17:51 GMT
server: ESF
date: Tue, 07 Sep 2021 05:15:43 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Sep 2021 05:15:43 GMT

GET
H3-29 200 front.min.css
www.redpacketsecurity.com/wp-content/plugins/cookie-notice/css/ 5 KB
2 KB 127ms
118ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

8c21cdf7be2219908a953d92fba153dcc7175f7ee238856bd9954da18b0e05dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/cookie-notice/css/front.min.css?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 23 Aug 2021 09:46:38 GMT
server: cloudflare
etag: W/"61236e7e-1568"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dMKLyJohAmF9QhpgYqsxIBrnfZMhJE7QzpK9omvkKHF5RbtzgSEqQxlIFX83T8pfRmL9%2BtlPQqnaO0W6lbp%2FRHhfr9i853PcCNGhpnJW2gphYvshn10ZpWVCisa33X31V4PevPLsSYsLEGMABWlq2pngm3uxjjUl"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=432000
cf-ray: 68ad75fe4f2bc2ae-FRA

GET
H3-29 200 dashicons.min.css
www.redpacketsecurity.com/wp-includes/css/ 58 KB
35 KB 50ms
41ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/css/dashicons.min.css?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/css/dashicons.min.css?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 15 Apr 2021 03:42:13 GMT
server: cloudflare
etag: W/"6077b615-e688"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H3tglvpWUoaj7pilbjI61NBi1s%2BhAVA5fBsJMFyqGFYDZewWacg6E6A52grrjVRcL%2BlIwEOl%2FhDXEs7K6JEDT%2BXfaSUgLO8CZYjEsZTIK02cd4Lsq8PFVrYbQQl5ECF1dGkAd2pZQ71OrohMRGtPWmUyuir5qKl5"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=432000
cf-ray: 68ad75fe4f2ec2ae-FRA

GET
H3-29 200 wp-pointer.min.css
www.redpacketsecurity.com/wp-includes/css/ 3 KB
1 KB 36ms
27ms Stylesheet
text/css 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/css/wp-pointer.min.css?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

a7e340aa92bb4abc075a1d50daa8a0a44fed34c75a52f376b306e9ddf5963ca1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/css/wp-pointer.min.css?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 15 Apr 2021 03:42:13 GMT
server: cloudflare
etag: W/"6077b615-cb0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mn6lJfFjcL8C1ksedg0B66tdc7WGK2%2B%2B9KsTOwzpP82amtXtKboUfVsBNnmLRejw%2FSQN7KPSj4jyqVsGr%2FGhWW%2BXSNNRzE8FXNw9EpZNL8lZCXD18wuRo%2BUQQTwvakrGfpnvxn0oqgBdqIep0B1RpMoKUaCf0naW"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=432000
cf-ray: 68ad75fe4f2ac2ae-FRA

GET
H3-29 200 api.js Show response
www.redpacketsecurity.com/cdn-cgi/bm/cv/669835187/ 35 KB
10 KB 13ms
12ms Script
text/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/cdn-cgi/bm/cv/669835187/api.js

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /cdn-cgi/bm/cv/669835187/api.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=21UJsO8I9dSZpINO84Tt2MQ52%2BY41FLA8Qnf7vdgfz7C99CcxDusZ8WWJ6nv34jJHT%2F1P8OeGr4UomHVIYcjZeg0XhHuW%2FTmskDtXL9Qc5JlrEbAP%2Bzug6wbCJxiKfC155vKz5hkwZrrJZJncurRYA8FWAMoMvLJ"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=604800, public
cf-ray: 68ad75fe6f61c2ae-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3-29 200 rocket-loader.min.js Show response
www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 15ms
14ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 Sep 2021 15:49:24 GMT
server: cloudflare
etag: W/"612fa104-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UUlN%2B4OMqW0Rd055UIFwl%2F%2BRnpODKN93NG1%2B9pqQXLWXtlS1pHOT1SGhJ5vEgUYmyFfdEiFDvdEMai2kX8kDdYjNXh3C5eODNNuvo5Lucb1cD4Pm2lHTC5wT%2F4r3%2BBEUez7fj9oRH5cIpAPQJnL4I6eDFZHKrsiB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800 public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 68ad75fe6f62c2ae-FRA
vary: Accept-Encoding
expires: Thu, 09 Sep 2021 05:15:43 GMT

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 13 KB
5 KB 74ms
73ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4efeeb957e361500bf19ba26282beae1a8e4083c5ccff10dccab2eaa09acd45

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: gzip
last-modified: Thu, 26 Aug 2021 22:03:28 GMT
server: cloudflare
etag: W/2021.8.2
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 68ad75fe6efdd709-FRA

GET
H3-29 200 gw00emcN9BpzKEYPUBk1NaZL9_8.js Show response
www.redpacketsecurity.com/cdn-cgi/apps/body/ 16 KB
5 KB 15ms
14ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/apps/body/gw00emcN9BpzKEYPUBk1NaZL9_8.js
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/apps/head/dzVfmdsktJhqzBiYTf0j-rfYP9E.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2235f7060e7b1158c85fdd8d850413d28a250daad04b1c812d923ed3087da34

Request headers

:path: /cdn-cgi/apps/body/gw00emcN9BpzKEYPUBk1NaZL9_8.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3952676
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: FEZ1GY3PZTCFD2H6
x-amz-id-2: fpQEovJ7HxDux70I2/Y8SZegJTLvsMhr5UBVPwItgnMY9d/P8WHU+EA32FK6CEa4GvXqbZcLVgk=
last-modified: Fri, 23 Jul 2021 11:10:20 GMT
server: cloudflare
etag: W/"f5b09d11bf7a962c42c7746f6d3bc124"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ouYJAcY644hkjIVCfrW%2Bjyrjl6P8WcQ14xDDWu7f29cTrVQjtAKh4BAw9ypiCoQYFIm5130rrsT%2BIp9LH5DXeUtfu5Hcww4hgrm0eulp7rq2BkZuKT%2Br7PcltZRKh1A4bL92XSSJOcN5Ig2AdKK0McmuwYIX%2BZcu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: HltfWyPIoutWwKGaCPA24kvS2mmCKmAW
cf-ray: 68ad75fe6f63c2ae-FRA

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-29 200 wp-embed.min.js Show response
www.redpacketsecurity.com/wp-includes/js/ 1 KB
1 KB 28ms
27ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/wp-embed.min.js?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/wp-embed.min.js?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 52
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 03 Feb 2021 22:01:16 GMT
server: cloudflare
etag: W/"601b1d2c-592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wSlEmmBio0wgfZVPsPycpXUZZgx2CNOTOL%2Fnxq26h7P8ZuXMQymcwqp7IEB4c%2BfSSPqIPTUZ6Rl30nXU4HANB6GGUKNfsaCaioABVJSSUTxWacJ95fNb8EsBMw7MNzkSn%2FHQL9JOdnZyGaKYrfgb4zIm9osPj%2BNk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff0804c2ae-FRA

GET
H3-29 200 smush-lazy-load.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/wp-smushit/app/assets/js/ 8 KB
4 KB 31ms
30ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.8.8

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

b30169a38c7ecd17eefc119177c0c61337b17a8f1abfd337ac37284d1a04a65b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.8.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 29 Jul 2021 06:30:02 GMT
server: cloudflare
etag: W/"61024aea-1eee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NBoXCvnF%2FlIdKNm1q4q72oKfKQC4tWdbl6FQ6PIqN0eQ7NxKRTTfUMuZwcS%2BCam8yW%2B1obKJMMLTrHNfbeNIOKSxsIRE0ziClKB0RPGlXrjaXWTzQkfQ7Jr9ysDPpbNlA50SFVHDE%2B3iwNcd3d4QZ0A4i4XTxm0%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff0806c2ae-FRA

GET
H3-29 200 product-image-preview.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/js/ 2 KB
1 KB 28ms
24ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/js/product-image-preview.min.js?ver=1.0.0

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

6716fefe49861853b89562048cf4d1cca696a940abc62c4d0b68eb3f399ac6d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/amazon-auto-links/template/_common/js/product-image-preview.min.js?ver=1.0.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 01 Sep 2021 05:32:39 GMT
server: cloudflare
etag: W/"612f1077-96a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CTfGDn4MLAp2mUIDZrgpCPyagYhe862NAkL0nrNylkM3pv5bIe4N4MRND5deI%2FTAtnamqR0r%2BObx4SqwQXJZNgTysuWqvLCWi9XK9sezcmp531FwTOE%2F%2B7gUMgaRgXGPtoxzG%2FLWYRGQC8Ze6t%2FMkf5LOxeDgksT"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1812c2ae-FRA

GET
H3-29 200 product-tooltip.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/js/ 1 KB
1 KB 30ms
26ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/js/product-tooltip.min.js?ver=1.0.0

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

1000abf34bf56e3a757816ca05551e1b79ebd035605f3b7b40bbf864ecb43959

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/amazon-auto-links/template/_common/js/product-tooltip.min.js?ver=1.0.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 01 Sep 2021 05:32:39 GMT
server: cloudflare
etag: W/"612f1077-4d3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=icy8zp0jrzqjlkPJs%2FUG6BRY7DhQT07H%2BQR646bE9GUxIJWzXAIKul%2BvsEm0OePtD%2Fa1BMBUWOh%2BIChpPqGcyrTne6Odn4z4XbcsKfFA1vRZPIZwNf0ULJQ9ea%2Fth5Oy%2FZUeUHQClgvTImi77jeoQw4Q6tLO7hWV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1814c2ae-FRA

GET
H3-29 200 pointer-tooltip.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/main/asset/js/ 638 B
990 B 30ms
26ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/main/asset/js/pointer-tooltip.min.js?ver=4.7.3

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

013ebd68f5fc8686a3424406191f0785f3a3d8d8ef2c10012dcd54989ee3ef59

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/amazon-auto-links/include/core/main/asset/js/pointer-tooltip.min.js?ver=4.7.3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 01 Sep 2021 05:32:41 GMT
server: cloudflare
etag: W/"27e-5cae86521eb02-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n0qdO%2B8fB99rKHT%2FITMd6HgDaPY20B0ngVNoFawLTmu8cCdSu%2BZ7vkgevRvGqayJeMtZTMNfQXyRUiFQQ2U7MLnBY%2BqlTDuXxoii78RBAsAjITzHXjr6LEB%2FCRKrH%2BS%2BviGFtu7NhoH0R%2FJCU6fCn4j6eSvxWuoE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-accel-version: 0.01
cache-control: max-age=432000
cf-ray: 68ad75ff1815c2ae-FRA

GET
H3-29 200 wp-pointer.min.js Show response
www.redpacketsecurity.com/wp-includes/js/ 4 KB
2 KB 31ms
26ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/wp-pointer.min.js?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

036cb212b79b6b41aa94647b00f4f03ba6cc127ebceaa72400663441d1f2b211

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/wp-pointer.min.js?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 10 Mar 2021 21:18:18 GMT
server: cloudflare
etag: W/"6049379a-e25"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oJ3RzGSzReo29nsQ31l3A26VId0ijARqGo8scr9VA059X4%2FZjs%2BG4%2FqDcO%2BE%2BgkB77ftc3R9EV7VfBRZqVo%2FNqvTuIgYy5EOk2qm8%2Fq9JpuSyHoXmlrTU0A4tTpUKYUVhLop6BP1zUgVfyBBMZPZYGo%2F3OmOQqex"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1816c2ae-FRA

GET
H3-29 200 i18n.min.js Show response
www.redpacketsecurity.com/wp-includes/js/dist/ 10 KB
4 KB 31ms
27ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/dist/i18n.min.js?ver=5f1269854226b4dd90450db411a12b79

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

dceda745a0fb58233a95eff6d10796026df6792cb960cdf675eb7b8a6750a2d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/dist/i18n.min.js?ver=5f1269854226b4dd90450db411a12b79
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 28 Jul 2021 06:20:01 GMT
server: cloudflare
etag: W/"6100f711-268a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8ZQI%2FvbNqxbSR1X9xUrJWEeq7gMGzhIjY2MGqX%2BeNtvpvphxzZYCzL6F83MAmsu%2Fcfvv9syNn9AXpTTv3cOxG%2FziC%2FKaHrp6SwI4gbofIJjwN9rGmDbbyKAri56zlc%2FFGCS6HyipZfAJsaZVEBP4%2FASyoXytV3cJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1817c2ae-FRA

GET
H3-29 200 hooks.min.js Show response
www.redpacketsecurity.com/wp-includes/js/dist/ 5 KB
2 KB 31ms
27ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/dist/hooks.min.js?ver=a7edae857aab69d69fa10d5aef23a5de

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

04e6fb814fccce3a0aecb83be0bc24665cf3e6a5e993f296471a63708f63e138

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/dist/hooks.min.js?ver=a7edae857aab69d69fa10d5aef23a5de
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 54
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 28 Jul 2021 06:20:01 GMT
server: cloudflare
etag: W/"6100f711-1540"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p4a47SX1C6on5Sv0R8dvsxSyD5bMCxc%2FIuGXSZ2X3Jhas8w3%2FLSIInRSlrJIlScm5BSXJ6viH9lA1kPEBeJ%2FZtLDW%2F7Xz5T0bn1s4L50EtMoskpZTI7tn9D93VBpHtidXGiJeQRU9Xtep18%2BZD13cHdyB%2FzDsl1Z"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1818c2ae-FRA

GET
H3-29 200 wp-polyfill.min.js Show response
www.redpacketsecurity.com/wp-includes/js/dist/vendor/ 16 KB
7 KB 31ms
27ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 54
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 28 Jul 2021 06:20:01 GMT
server: cloudflare
etag: W/"6100f711-4056"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XQNwxR3Sz7Rs5LgYWXWk29hqF%2F1KLJ%2BrqxbXAm1FudPO1kq8Fb9M0Cjs88xQ7MOglSlzKCRQM7q7Jmm3eX3zIPYuFPBQ5WmwzFn528BTE7E8jePAlph27lufW1biXAEWJHWmirAtIIfwnvRIz668ILMM%2FzSsGzcr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff181bc2ae-FRA

GET
H3-29 200 regenerator-runtime.min.js Show response
www.redpacketsecurity.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 32ms
28ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.7

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.7
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 54
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 28 Jul 2021 06:20:01 GMT
server: cloudflare
etag: W/"6100f711-1906"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iGUdtfSoKldwnB0l0yrKRb5LNiyz4HtBGaysWiXGC5FNcSE0rSEddrOsx2V4o%2FYqvhkIFLMvXhaF1hGqUuRNCp5ddtbu1INPKuFVU30S8cQbn4LWvIPPMd%2BuqiJNi75y2%2FqrXwuKtzkwl8jCUdo2BTuZHk3UBGys"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff181dc2ae-FRA

GET
H3-29 200 core.min.js Show response
www.redpacketsecurity.com/wp-includes/js/jquery/ui/ 20 KB
7 KB 32ms
28ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

0cd851e5b33af0fbb354df65506da39807b998e07723f3d08aba5179fa2ed97e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 54
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 15 Apr 2021 03:42:13 GMT
server: cloudflare
etag: W/"6077b615-5133"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7a71kYKsjOxCiOivfyySIi9D73mXMSCkjb%2F6RddXgDWHTwBt7Se8YzrxeZiZsxxdOhqwc3F3%2F3m%2Fr3LCQ1gywZnBFliig7pI8uZ0bnNdCrOXJBdjhd3Rka7IacfS3y9aV6XgwJrQFn3Q%2FKkSE2mkd25PG7ygPPjv"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff181ec2ae-FRA

GET
H3-29 200 colormag-custom.min.js Show response
www.redpacketsecurity.com/wp-content/themes/colormag/js/ 3 KB
2 KB 33ms
29ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag/js/colormag-custom.min.js?ver=2.0.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

2b32be0979cb9f2119bd22563ed89560525c15a8edfd6e662a1968314783f689

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag/js/colormag-custom.min.js?ver=2.0.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 55
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 05 Aug 2021 15:13:05 GMT
server: cloudflare
etag: W/"610c0001-b0a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EW89ufz7QK5KaAEMCeGKYVgrStta8fFifYjQ719HfAjYXLe7csS9oghgp2LxB4YFXGdEgLge%2BpRjD6LPCOr3vAGSU6WM6SC5OfVy95G72G8bj7ik6m5EZfw%2BzyI40dkwl5seGlcqhwAaKEdY9mGi57jdgnI5ntA0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff181fc2ae-FRA

GET
H3-29 200 skip-link-focus-fix.min.js Show response
www.redpacketsecurity.com/wp-content/themes/colormag/js/ 325 B
858 B 33ms
29ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag/js/skip-link-focus-fix.min.js?ver=2.0.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

53f829ae556bf7011727483015d83a98bcdb4b5796eecb728827c1282c971536

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag/js/skip-link-focus-fix.min.js?ver=2.0.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 55
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 05 Aug 2021 15:13:05 GMT
server: cloudflare
etag: W/"145-5c8d15b1c1005-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ikG2%2Bl6WXYcpZ7ZP9D3QwzTNXT47lPY51WIZj5SQ0HqYSK4w8ADE9I3Gd8QbM8tecosKyj8HCOiGU8l5kwKc7%2FCwH338O5Qf%2FScuDYrnqb30c%2FkdWxb1vBTL%2Bf1aAyx8nb4ctILpS%2BqjPMx9upJ3iZmjUib%2BRGHM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-accel-version: 0.01
cache-control: max-age=432000
cf-ray: 68ad75ff1820c2ae-FRA

GET
H3-29 200 jquery.fitvids.min.js Show response
www.redpacketsecurity.com/wp-content/themes/colormag/js/fitvids/ 2 KB
1 KB 33ms
29ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag/js/fitvids/jquery.fitvids.min.js?ver=2.0.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

8994924c0f3ab4474ee0a7c04417ad84933c4467cc9192fcb60b9774f15f5990

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag/js/fitvids/jquery.fitvids.min.js?ver=2.0.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 55
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 05 Aug 2021 15:13:05 GMT
server: cloudflare
etag: W/"610c0001-6da"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ilm3tuDtWlsGyhi%2BBGZ3pCAh4oHND3qJytzi297JpM%2BcwklNwF00AoyOf3hWAG1BqTqfiexLWa9hHwcvhxseo%2BYsYj5BRd2cxuARq78eW7f5%2FupkIzgI4TRdRRw5QoIO4TuUDsRCPxpeAgoEBSl%2BhkNDkSs1ZduQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1822c2ae-FRA

GET
H3-29 200 navigation.min.js Show response
www.redpacketsecurity.com/wp-content/themes/colormag/js/ 2 KB
1 KB 37ms
33ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag/js/navigation.min.js?ver=2.0.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

5b84335d42b38d3122349f53b20dd6a5cb0f45d1e45e5683fd572bcdda8c04a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag/js/navigation.min.js?ver=2.0.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 55
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 05 Aug 2021 15:13:05 GMT
server: cloudflare
etag: W/"610c0001-61f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wWo3q%2B24Uq3VD5vdHmoYrfbQOMTAvdMBOm2g3J4hSISeDzGXRS%2BbgErTr%2BeD1XxQJT6zaypRiAS1wF0ERy%2Fg5w1Lcf%2F7x2xz6OPY3YurgWYyvgD16%2Bc%2FgK%2Bq7dwnwrr0Vp2Frntmd9jPaS4ob50ctZL%2FgpZWQcJ%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1826c2ae-FRA

GET
H3-29 200 jquery.sticky.min.js Show response
www.redpacketsecurity.com/wp-content/themes/colormag/js/sticky/ 4 KB
2 KB 37ms
33ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag/js/sticky/jquery.sticky.min.js?ver=2.0.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

f9f94cc2cf984a2a8df89c1250c04396bc950e577b4143d5539ca88fb46de91b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag/js/sticky/jquery.sticky.min.js?ver=2.0.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 56
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 05 Aug 2021 15:13:05 GMT
server: cloudflare
etag: W/"610c0001-1087"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7HwrMb6oZZYV1URFx9Utj3jNv8h1v2vEfiwxU%2B2Xt9WssjENDDhrmLgXRu0Ff2t8cQRzyAxMhmqu1BhlWXrudf3uIo3Hc5BgVnmefHSSwvj0qbAD%2BKSH9u5nmZ%2BawL%2BmA0IAXJDbLbIsKNBmN2KU561GYqeCWXVL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1828c2ae-FRA

GET
H3-29 200 jquery.bxslider.min.js Show response
www.redpacketsecurity.com/wp-content/themes/colormag/js/ 23 KB
7 KB 37ms
33ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag/js/jquery.bxslider.min.js?ver=2.0.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

0157d11106d6b70289099fd1ce1f7bea3a9dfbb46cee3994edb07ce765bb92fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag/js/jquery.bxslider.min.js?ver=2.0.9
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 56
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 05 Aug 2021 15:13:05 GMT
server: cloudflare
etag: W/"610c0001-5d92"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j%2FnrF6BRK43LFYMJjPWkGMJC%2BzFb4MI5ewtA%2FKtlZ6TFB%2FW8wlt%2Bfxi%2FP2smw%2BlhbORZ0jRYwmzWJLaeO%2Fa9bgYGrSC2m0fiE3dKFPdrv3ggh9MueksoS0O7M%2FWM%2FXcKSez7IVhzaZNhX81EkSfkmegPysYykDYn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff182ac2ae-FRA

GET
H3-29 200 now-retrieving-updater.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/component/unit/asset/js/ 3 KB
2 KB 41ms
37ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/component/unit/asset/js/now-retrieving-updater.min.js?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

b5c642f4690b2fb0b6fe20a4b6f05d84a7c7d196bd608929456e43ebf1126bfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/amazon-auto-links/include/core/component/unit/asset/js/now-retrieving-updater.min.js?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 56
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 01 Sep 2021 05:32:41 GMT
server: cloudflare
etag: W/"612f1079-c04"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pVBco5V05kdSlSMNmYZ43rQRT2oYhmIOLfsD%2BiIhEzjiNqI59Z814LHQpKQTp%2BH3o2JLVjDIwHCrfRA4qlnbWp4jTaBgS3qIyokjGwNz%2BmeulpzWjk2YPCknI9LiOljNGnIl8WVv5iB8l3kTL5IqpArZny90JHq6"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff182bc2ae-FRA

GET
H3-29 200 iframe-height-adjuster.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/component/custom_oembed/asset/js/ 3 KB
2 KB 38ms
34ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/component/custom_oembed/asset/js/iframe-height-adjuster.min.js?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

7baeeb05ff0ee4e24a08c877dbf87509ff0285842079bd27678e8e0629a03029

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/amazon-auto-links/include/core/component/custom_oembed/asset/js/iframe-height-adjuster.min.js?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 56
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 01 Sep 2021 05:32:40 GMT
server: cloudflare
etag: W/"612f1078-a63"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xnOr9IqYH9zhvWNMLCDr8Uztz1HtHTqUQVO79jI3JOQU2eifZFduuDu88XwU09Pp%2B4y5KIhBALZk4rsAUCd0iLAUBXQZf14GXqRd2Fan5BS7N30PPOn4zrm3y9bQtrXsvgKycBgQM%2FAiZmMxc3Zw9F%2BVQ6ikchQ2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1830c2ae-FRA

GET
H3-29 200 app.js Show response
www.redpacketsecurity.com/wp-content/plugins/patreon-connect/assets/js/ 244 B
844 B 37ms
33ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/patreon-connect/assets/js/app.js?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

7d45256c95c1c245654bf298e27d9c538dc778a2ee050ba4678ac2a07f479869

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/patreon-connect/assets/js/app.js?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 56
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 14 Aug 2021 19:00:46 GMT
server: cloudflare
etag: W/"162-5c98995ebd613-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5kXz2kQl4ikS8veQzKtVL3som14sYQjX69xTCtWLaRbjzpDulTrjZyABD5EelCyZBkLULbwBAeeBZeQqgT%2BHjt%2BazuN2cl69uiKWEDTIbS9MBIggw6RC3a4hZl1LhfrGeRrC1jvwqwZapwyqiy3Cm24dkZGisZIv"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-accel-version: 0.01
cache-control: max-age=432000
cf-polished: origSize=354
cf-ray: 68ad75ff1834c2ae-FRA
cf-bgj: minify

GET
H2 200 widget.js Show response
comments.app/js/ 9 KB
3 KB 151ms
47ms Script
application/javascript 104.222.176.201
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.app/js/widget.js?2

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.201 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

482f450b7fdbac6f9304643f3e731df20bf66c51fb0599fa9a734e5d102a9e2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: gzip
last-modified: Fri, 19 Jun 2020 23:54:45 GMT
server: nginx/1.20.1
etag: W/"5eed5045-2390"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 138 KB
49 KB 50ms
27ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1536334219562771

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dab763234340993765a5ee4b57e7abbc830cc6a61d50db623a7a83b1c15c4c2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.redpacketsecurity.com
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49527
x-xss-protection: 0
server: cafe
etag: 8845775213513617054
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 07 Sep 2021 05:15:43 GMT

GET
H3-29 200 716aa9a3.js Show response
www.redpacketsecurity.com/wp-content/uploads/caos/ 48 KB
20 KB 37ms
34ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/caos/716aa9a3.js

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

50d72b7a44227a156b6714b4208be48c3acf8b773eb1b73f069442b07971a92e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/uploads/caos/716aa9a3.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 56
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 26 Aug 2021 14:00:37 GMT
server: cloudflare
etag: W/"61279e85-c1d5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kQzMu2i1w5bYCU1u3srJLX72Mxp5dG81AofSfgvZqc%2BfEy50XYAXBnXdDJHTPVzCjWHcQZxMnKmaudUakQgmQJGoD2LxSAKckblIEicXRwO0VJLLTVayDNyF6JqJrbAhUbg5Z9Su2OpVZghFSk5WAXfuT1OC7h%2Fv"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-polished: origSize=49621
cf-ray: 68ad75ff1838c2ae-FRA
cf-bgj: minify

GET
H3-29 200 front.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/cookie-notice/js/ 8 KB
3 KB 133ms
130ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.1.3

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

53c088f65c77c6b7af2804face3e267d4c1bf148177798a30fa3a15aa693c36f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/cookie-notice/js/front.min.js?ver=2.1.3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 23 Aug 2021 09:46:38 GMT
server: cloudflare
etag: W/"61236e7e-20b3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uU88980lVyfyiJVCm%2BLnl4pnTAFIAGVcagzGa9ZcifWJGjWt%2Bl5VUJsgZ9MFzLWVpJsR%2B1fWf1Bjjk4Rvwa5IKH66wdWgHGFWy2CydvoYiI72KVa1Hb5y6pS%2BQaQW3NuvEt3rRIXLEVhrEHcYXxJ7mLblM%2Fi9ZW1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff183cc2ae-FRA

GET
H3-29 200 jquery-migrate.min.js Show response
www.redpacketsecurity.com/wp-includes/js/jquery/ 11 KB
5 KB 40ms
36ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 57
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Tue, 22 Dec 2020 15:30:09 GMT
server: cloudflare
etag: W/"5fe21101-2bd8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FvVXi2meGE2HyQ%2BhkcvBGKJG7LsdXpRDHvLU2vTSLUmV%2BjMq6MLjHIjh8bqt9EUGD12sdY0t4%2FtmhM%2BTKnG60LzF2Ztwo7HY6%2BzbviV6Ca6bJpB7HbX93c7ojmvrihJDx%2B4xg70VDMJwqf43hFeKpuoNpi6N4N4D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1840c2ae-FRA

GET
H3-29 200 jquery.min.js Show response
www.redpacketsecurity.com/wp-includes/js/jquery/ 87 KB
32 KB 37ms
34ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/jquery/jquery.min.js?ver=3.6.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 57
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 28 Jul 2021 06:20:01 GMT
server: cloudflare
etag: W/"6100f711-15db1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=99scPfVrRTUyQftToiHAsu2licFs1JqvC4cUcZVTmlDJNz0QPxcQHZr0up%2BykYB%2B79D%2Fq7EMEJl67BHfIZB14AcljrQLuJ0VgWAdzcI6eG8Gj8oUxll0A0wJxqCeKVXtXL0XP%2FRmhvbLjyc9CnEmQfP95T1fASs7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad75ff1842c2ae-FRA

GET
H2 200 loader.js Show response
smartarget.online/ 17 KB
8 KB 97ms
55ms Script
application/javascript 2606:4700:e0::ac40:6725
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://smartarget.online/loader.js?ver=4141&u=1b3d7f524dc3adab2ac978844a1cb21dc61512bf&forceLocation=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&source=cloudflare_exit_popup_smartarget
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/apps/body/gw00emcN9BpzKEYPUBk1NaZL9_8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6725 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a96720a2a59f14c32d7232298b2eee0f760f476e8656f858c3b5127092d65fe

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:43 GMT
content-encoding: br
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AFHwg6aftbKcyWWzjM46K5o0oBj26VWxAQwY%2BRZyu2OEc2P0my0rOrt161RxH92h7TCjFz6RWt7TuVzASuKAcEzDMnCTGVtnXMPpPEluolj%2Bb6Y3FJKFY9S9fW1q84fGoTWpg2Q%2BF%2B2roSzeSjosFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-ray: 68ad75ff5b514ab5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 1 Jan 1970 00:00:00 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v23/ 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600&1&display=swap&ver=2.0.9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.redpacketsecurity.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 04:26:58 GMT
x-content-type-options: nosniff
age: 89325
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:25 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 04:26:58 GMT

GET
H3-29 200 fontawesome-webfont.woff2
www.redpacketsecurity.com/wp-content/themes/colormag/fontawesome/fonts/ 75 KB
76 KB 121ms
120ms Font
font/woff2 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/colormag/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/wp-content/themes/colormag/fontawesome/css/font-awesome.min.css?ver=2.0.9

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/themes/colormag/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0
pragma: no-cache
origin: https://www.redpacketsecurity.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/wp-content/themes/colormag/fontawesome/css/font-awesome.min.css?ver=2.0.9
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.redpacketsecurity.com
Referer: https://www.redpacketsecurity.com/wp-content/themes/colormag/fontawesome/css/font-awesome.min.css?ver=2.0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:43 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 77160
last-modified: Thu, 05 Aug 2021 15:13:05 GMT
server: cloudflare
etag: "610c0001-12d68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mHtLFFH8w0zGn%2FVBF91zagTra2e5%2FqV%2FumDLo6ATLj0JikJ3mJMwqhbMVxqT5nUQb5YelCqcsa8dqaJTQXvhJG0h%2FRUz8JrcwfxLW111HMvTVPP9GlRUjRdB0S2S9TZ76njCJRpKW8tIipSvyFh2MrzSsLGOlXzx"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad75ff1843c2ae-FRA

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v23/ 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem5YaGs126MiZpBA-UNirkOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600&1&display=swap&ver=2.0.9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.redpacketsecurity.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:10:42 GMT
x-content-type-options: nosniff
age: 3901
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14956
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:40 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 04:10:42 GMT

GET
H2 200 1b3d7f524dc3adab2ac978844a1cb21dc61512bf Show response
api.smartarget.online/app/connect/ 807 B
1 KB 186ms
135ms Fetch
text/html 2606:4700:e0::ac40:6625
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.smartarget.online/app/connect/1b3d7f524dc3adab2ac978844a1cb21dc61512bf?source=cloudflare_exit_popup_smartarget&forceLocation=https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
Requested by: Host: smartarget.online
URL: https://smartarget.online/loader.js?ver=4141&u=1b3d7f524dc3adab2ac978844a1cb21dc61512bf&forceLocation=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&source=cloudflare_exit_popup_smartarget
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6625 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da1a4dfe7e542e7df162a6e7a056814b061d04e7caaeba7ffa34a9205873f655

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-mod-pagespeed: 1.13.35.2-0
access-control-allow-methods: POST, PUT, DELETE, OPTIONS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wYIzp0SsW%2Ffe3TebT8az6SG%2BbiUI0BdoMqYmWeWb9eH4sJ5UN15E4hmvCaV%2BmXM1E2%2BYBqPB2wG6NpKsn9KfwXP3%2F%2F06c8kOhZ1FsJ%2FwLV1YQTTjViX%2FgKhe96r553CJ0Lkq0BEPJPvBHD1wkUEmQKzgZ7o%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.redpacketsecurity.com
cache-control: max-age=0, no-cache, s-maxage=10
access-control-allow-credentials: true
cf-ray: 68ad76010be643b8-FRA
access-control-allow-headers: app-version, content-type, content-length

POST
H3-29 204 result Show response
www.redpacketsecurity.com/cdn-cgi/bm/cv/ 0
773 B 10ms
10ms XHR
text/plain 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/bm/cv/result?req_id=68ad75fd2c7a1762
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/bm/cv/669835187/api.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-fetch-mode: cors
origin: https://www.redpacketsecurity.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
content-length: 488
:path: /cdn-cgi/bm/cv/result?req_id=68ad75fd2c7a1762
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zTGNGiuIo9lPhXKxPIHS1a6eZtF5DjHXjtDUYnOUvG%2BcZgrPMTjx3%2B9%2Bt0E7%2BR85H0hb04DurnHKN6x%2F3RfqTaCU6sIa%2F7GTDNURfCcslkq2u0yz9HjzXyBVyxlyPNlh1IqexWDfmL835yQAPcLQVC4hNgITxbuA"}],"group":"cf-nel","max_age":604800}
set-cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; path=/; expires=Tue, 07-Sep-21 05:45:44 GMT; domain=.redpacketsecurity.com; HttpOnly; Secure; SameSite=None
cf-ray: 68ad7600da32c2ae-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3-29 200 wp-emoji-release.min.js Show response
www.redpacketsecurity.com/wp-includes/js/ 18 KB
5 KB 31ms
31ms Script
application/javascript 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/wp-emoji-release.min.js?ver=0ac25f200364ea11ab30f5f155d15828

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=0ac25f200364ea11ab30f5f155d15828
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 58
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 28 Jul 2021 06:20:01 GMT
server: cloudflare
etag: W/"6100f711-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7kgTCrbPuRhKiaGmigoxeX7AwjO8xmwL%2Fd%2FMz6mC4A12T8mmSu4xSg8x4XzwzRSYxT6BhBR142H60wfIzsXuRjOH4J8oaxByX5SDhIux3NibOwsQkvHw9SQkvHfPfxZtxhF%2BrNkJyaFs0s3PhlJ5vIVZ0eZcyDmS"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=432000
cf-ray: 68ad76010a93c2ae-FRA

POST
H3-29 503 collect Show response
www.redpacketsecurity.com/wp-json/caos/v1/proxy/j/ 11 KB
12 KB 15ms
15ms XHR
text/html 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-json/caos/v1/proxy/j/collect?v=1&_v=j93&a=1285917805&t=pageview&_s=1&dl=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&ul=en-us&de=UTF-8&dt=Pacific%20City%20Bank%20hit%20by%20AVOS%20Locker%20Ransomware%20-%20RedPacket%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=1343331634&gjid=1203919286&cid=2007483637.1630991744&tid=UA-64877284-1&_gid=227926819.1630991744&_r=1&_slc=1&z=1214318712

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/wp-content/uploads/caos/716aa9a3.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45eb24f5baf6691c73c6e91e475041555a6e0e317ea7139760efc9c163e999f0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://www.redpacketsecurity.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
content-length: 0
:path: /wp-json/caos/v1/proxy/j/collect?v=1&_v=j93&a=1285917805&t=pageview&_s=1&dl=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&ul=en-us&de=UTF-8&dt=Pacific%20City%20Bank%20hit%20by%20AVOS%20Locker%20Ransomware%20-%20RedPacket%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=1343331634&gjid=1203919286&cid=2007483637.1630991744&tid=UA-64877284-1&_gid=227926819.1630991744&_r=1&_slc=1&z=1214318712
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: text/plain
accept: */*
cache-control: no-cache
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D6jd7oN12JmjJNjgB7wma7DDpzHlv0pKA4F7C4bfJqPBJAXUo6h6eL2%2FhyQwV5PzBpjOYXux7Vej%2BxT02xFJ%2FqI93dwW4HbprSKiNfUudNs9NQFdkDE3mLdMi56PqrXXQUeg4pTXlgaYEuh4oRHu%2BL36nmGXxMlf"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray: 68ad76010a94c2ae-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/ 250 KB
93 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1536334219562771&plah=www.redpacketsecurity.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1536334219562771

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cb658d8af264091d320d32e952cb1756ea0145c2f6497b182a39e7ce4e466653

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95178
x-xss-protection: 0
server: cafe
etag: 9330497266985682447
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 07 Sep 2021 05:15:44 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210831/r20190131/ Frame 4695 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210831/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1536334219562771

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210831/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 06 Sep 2021 16:02:37 GMT
expires: Mon, 20 Sep 2021 16:02:37 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
age: 47587
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 view Show response
comments.app/embed/ Frame 99DF 7 KB
3 KB 61ms
61ms Document
text/html 104.222.176.201
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Pacific%20City%20Bank%20hit%20by%20AVOS%20Locker%20Ransomware%20-%20RedPacket%20Security&limit=5&color=E22F38

Requested by

Host: comments.app
URL: https://comments.app/js/widget.js?2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.201 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

8ca395d4b5b90db22d9acbe97aa5b3514f384cb6659c77880b462a00b9c099a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

:method: GET
:authority: comments.app
:scheme: https
:path: /embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Pacific%20City%20Bank%20hit%20by%20AVOS%20Locker%20Ransomware%20-%20RedPacket%20Security&limit=5&color=E22F38
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

server: nginx/1.20.1
date: Tue, 07 Sep 2021 05:15:44 GMT
content-type: text/html; charset=utf-8
content-length: 2553
set-cookie: bcom_on=1; expires=Fri, 16 Sep 2022 21:55:47 GMT; path=/; samesite=None; secure; HttpOnly
pragma: no-cache
cache-control: no-store
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload

GET
H3-29 200 logopng-e1609920151567.png
www.redpacketsecurity.com/wp-content/uploads/2015/07/ 7 KB
7 KB 19ms
17ms Image
image/png 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2015/07/logopng-e1609920151567.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

b71eda2a49bf8c9d5a31ac22dfdd01a45a0b436a35821f8d249bfc1eb6d1338b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/uploads/2015/07/logopng-e1609920151567.png
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 59
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6678
last-modified: Wed, 06 Jan 2021 08:02:31 GMT
server: cloudflare
etag: "5ff56e97-1a16"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IWhbuG7L1OpGixsJSsDFfd0Q2jlHWAOiIHolhFhIHs4y0Sh4mdMFjYa2PrzAkUSAj6RCHpVjzsMMoJgBOkLKRUdIc4yjtryZB6HcA8V8gnONcko1SgIQIViv5BfeQwlHFiiEY8olrseO%2FxAJHJV49tf7uXQTc62U"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad76016af5c2ae-FRA

GET
H3-29 200 iconfinder_twitter_circle_294709.png
www.redpacketsecurity.com/wp-content/uploads/2020/12/ 2 KB
2 KB 15ms
12ms Image
image/png 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2020/12/iconfinder_twitter_circle_294709.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

2092be07bff9503312074b6d5cdbd26849f298240af86811d024a37cfe9e97b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/uploads/2020/12/iconfinder_twitter_circle_294709.png
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1591
last-modified: Wed, 23 Dec 2020 22:17:23 GMT
server: cloudflare
etag: "5fe3c1f3-637"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c7Xtz3yTHhUY%2FcJZ%2BEBaQ6G1K4QH%2FSkSZrXi5i4pTHxdtcu5vNRxwv%2F8fYSMirY7DvFE4SMKqurFcgTkjIT6zpj0IqGSgeqdavEA6M07sePmtPe7mYBeY0mDYmwLxPS2ZuXYY2MF4xrTDbsCYJniT%2FW7EZuvb0XV"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad76016af7c2ae-FRA

GET
H3-29 200 telegram_PNG34-e1591362686455.png
www.redpacketsecurity.com/wp-content/uploads/2020/06/ 2 KB
3 KB 18ms
16ms Image
image/png 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2020/06/telegram_PNG34-e1591362686455.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

ac2b8f24354dedbeaacadf80e2141a989e5d33ebb3f8e361d936d0fd818c9674

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/uploads/2020/06/telegram_PNG34-e1591362686455.png
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2474
last-modified: Fri, 05 Jun 2020 13:11:26 GMT
server: cloudflare
etag: "5eda447e-9aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ntn4i5lmG4LnRtV%2BdAf5p5Qw%2FpS%2BelbowU0yuU8aIjQxKvMnV5ZoPyE4efJtLmySOAWL1Za2NYpl985ru%2FvBwJsSHbAzYXn3%2BN4zqHoHt%2FAyjG6zum4lrGaUM34g8TJGqJhEwsM4CQLU%2BnybMLMV%2FnFGHunP8iMw"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad76016afac2ae-FRA

GET
H3-29 200 reddit-1.png
www.redpacketsecurity.com/wp-content/uploads/2020/12/ 4 KB
5 KB 16ms
15ms Image
image/png 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2020/12/reddit-1.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

8c582f22b6db80071eb06a7fe7a046261faa879228afac0c651e5c606d33b1d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/uploads/2020/12/reddit-1.png
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4419
last-modified: Wed, 23 Dec 2020 17:19:28 GMT
server: cloudflare
etag: "5fe37c20-1143"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zzPxz7CYXBjl93hnx1xy%2FGwps1tn7JBwTMWQoC9GekXNQo1%2BMJnd8ruUWCedqwnk1bu8yBJfKe4Ej435Foji7RhanW%2B%2BxuOGlVNEvXZ68zHtarKbmxoOJC94RAr%2B%2Brhr00IFf5dk%2FNFQbiid7KKY6HKqcfQKo1CJ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad76016afcc2ae-FRA

GET
H3-29 200 discord-logo-png-7617-e1609320732895.png
www.redpacketsecurity.com/wp-content/uploads/2020/12/ 3 KB
4 KB 20ms
18ms Image
image/png 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2020/12/discord-logo-png-7617-e1609320732895.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

2ea2602e2120c775d8c861066a613210666aaf67adb13928067f5978f8e1975a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/uploads/2020/12/discord-logo-png-7617-e1609320732895.png
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3322
last-modified: Wed, 30 Dec 2020 09:32:12 GMT
server: cloudflare
etag: "5fec491c-cfa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K1OjZljORgPHQVjuRzC0n940Bac1LKajlSSCSGGyXEdSxXClzwvXOSaa0xZVed%2F%2BR54DvFif9fD7q79OmivDbNch1UdZufE7CJ8cvrb5fNmj%2Bq0wsMtep7OR%2FhRp206O6C4rTa0mNXyZk%2FCFkg3qehXbBV1Tft1U"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad76016afdc2ae-FRA

GET
H3-29 200 PATREON-SQUARE-300x300.jpg
www.redpacketsecurity.com/wp-content/uploads/2021/05/ 19 KB
19 KB 18ms
16ms Image
image/jpeg 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2021/05/PATREON-SQUARE-300x300.jpg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

b28fee1eac5fa6d375a18ca1bc7a0200a972073b95669028734c3c13e7d4ecf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/uploads/2021/05/PATREON-SQUARE-300x300.jpg
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 19193
last-modified: Wed, 12 May 2021 10:31:12 GMT
server: cloudflare
etag: "609bae70-4af9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xdmh2Iamt65Xxy%2Br3wIKoZQTQkPgu0C28oOCRgWgCdKTfBWP2my7qKXrHco5gSvA4qhOwcvEiZ5yIQ2kLRpQmbT0FKilmt7oinH2vCc3dreKfeayeORjaE9zwYQ%2BWRMoJjWFSm%2BgECKSjwCjEwHOWm4sAsxgC8Ci"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad76016b01c2ae-FRA

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 13 KB
5 KB 57ms
56ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4efeeb957e361500bf19ba26282beae1a8e4083c5ccff10dccab2eaa09acd45

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Thu, 26 Aug 2021 22:03:28 GMT
server: cloudflare
etag: W/2021.8.2
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 68ad76016a86d709-FRA

GET
H3-29 200 smush-placeholder.png
www.redpacketsecurity.com/wp-content/plugins/wp-smushit/app/assets/images/ 995 B
2 KB 107ms
106ms Image
image/png 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/wp-smushit/app/assets/images/smush-placeholder.png

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

d8780c6aefcc4f67ef6f836c6bf5d8a554e3b46c82e555cc9d172ce3e58c746f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/plugins/wp-smushit/app/assets/images/smush-placeholder.png
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 995
last-modified: Thu, 29 Jul 2021 06:30:02 GMT
server: cloudflare
etag: "3e3-5c83d3ba50ae2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R%2BG402FukUuYxJELReKNdpaSUpq5pV2HVtyJRcC3%2BKMPbOfJVKge9CUvJXeK0C3WdOmOQqR0dyjYfmvLNBwJjvSiYaZdQYCxChAkI00BgyRBs6DYs3w8lr1%2BOIERpqnfijur3OZFYMhS0iuRfFBer5tv601dzbkC"}],"group":"cf-nel","max_age":604800}
content-type: image/png
x-accel-version: 0.01
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad76016b02c2ae-FRA

GET
H2 200 Pacific-City-Bank-1.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2021/09/ 80 KB
80 KB 102ms
32ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2021/09/Pacific-City-Bank-1.png?resize=1024,513&ssl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

e895e5a8292868e89c3f0ba4076f378731d5515e7aa94c96659e020a47131e44

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT hhn 3
date: Tue, 07 Sep 2021 05:15:44 GMT
x-content-type-options: nosniff
last-modified: Mon, 06 Sep 2021 22:07:43 GMT
server: nginx
etag: "8d57e29b05532191"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2021/09/Pacific-City-Bank-1.png>; rel="canonical"
content-length: 81604
expires: Thu, 07 Sep 2023 10:07:43 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 211 B
664 B 124ms
53ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.redpacketsecurity.com&callback=_gfp_s_&client=ca-pub-1536334219562771

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1536334219562771&plah=www.redpacketsecurity.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

a976db2ba03b446964bf86aaa0e98ae45e70c3a823e848ee78c71f4e8e8e5fde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 198
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 16ms
14ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 17ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 58CC 106 KB
30 KB 394ms
391ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&adk=1812271804&adf=3025194257&lmt=1630944204&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744187&bpp=3&bdt=473&idt=66&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8553269379453&frm=20&pv=2&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=86

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0949fbffb7d97f42804c4d980950fe0eda340eec542073a6f95bc56c1136bbf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1536334219562771&output=html&adk=1812271804&adf=3025194257&lmt=1630944204&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744187&bpp=3&bdt=473&idt=66&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8553269379453&frm=20&pv=2&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=86
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 07 Sep 2021 05:15:44 GMT
server: cafe
content-length: 30662
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 07-Sep-2021 05:30:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:44 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bd3a2482b7b952b621e16a05c3bb1847829d057fb1384f4c32d1362b8153e967

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630496339498273"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27562
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:44 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 99DF 4 KB
617 B 26ms
21ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500

Requested by

Host: comments.app
URL: https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Pacific%20City%20Bank%20hit%20by%20AVOS%20Locker%20Ransomware%20-%20RedPacket%20Security&limit=5&color=E22F38

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 03:25:49 GMT
server: ESF
date: Tue, 07 Sep 2021 05:15:44 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Sep 2021 05:15:44 GMT

GET
H2 200 bootstrap.min.css
tg.dev/css/ Frame 99DF 42 KB
10 KB 161ms
45ms Stylesheet
text/css 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/css/bootstrap.min.css?3

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-a61b"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 bootstrap-extra.css
tg.dev/css/ Frame 99DF 70 KB
13 KB 180ms
64ms Stylesheet
text/css 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/css/bootstrap-extra.css?2

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

6342d16a93416b5e826f6d0e0e930ef033efb682851ae46270f3c4f5b4a1c194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-11648"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 widget-frame.css
tg.dev/css/ Frame 99DF 67 KB
17 KB 190ms
75ms Stylesheet
text/css 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/css/widget-frame.css?45

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

d73efe70be2927ba40fb4617468ffa04712439f55dd935568313ce4a09320418

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 15:20:58 GMT
server: nginx/1.18.0
etag: W/"6001b2da-10b33"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 comments.css
comments.app/css/ Frame 99DF 83 KB
20 KB 75ms
71ms Stylesheet
text/css 104.222.176.201
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.app/css/comments.css?31

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.201 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

e450af4a7c4974ea3ff324b629876380e0ca9605333a57152a953310c4a4661a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Pacific%20City%20Bank%20hit%20by%20AVOS%20Locker%20Ransomware%20-%20RedPacket%20Security&limit=5&color=E22F38
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 24 Jul 2020 12:57:13 GMT
server: nginx/1.20.1
etag: W/"5f1adaa9-14b98"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css

GET
H2 200 jquery.min.js Show response
tg.dev/js/ Frame 99DF 94 KB
38 KB 199ms
84ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-1762a"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 jquery-ui.min.js Show response
tg.dev/js/ Frame 99DF 96 KB
32 KB 216ms
101ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/jquery-ui.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

eb46d82ef6f86859f18e379660e0f45b85c6f69fa97111905f0c125a08506376

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-181a9"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 bootstrap.min.js Show response
tg.dev/js/ Frame 99DF 31 KB
10 KB 223ms
108ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

b5e930df6a2976d5df996e18b347e091756699ea32716dc53d0e1c0fd814c526

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-7d0d"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 main-aj.js Show response
tg.dev/js/ Frame 99DF 34 KB
10 KB 211ms
97ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/main-aj.js?54

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

ec69865e0075b81b472ece2aae8d022053975db2c4280cd9ab77a1b6179733ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 13 Aug 2021 18:40:37 GMT
server: nginx/1.18.0
etag: W/"6116bca5-8752"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 tgsticker.js Show response
tg.dev/js/ Frame 99DF 14 KB
4 KB 228ms
114ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/tgsticker.js?24

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

7af53d7077c16f6ad9efd63a975749c4835ce6e495c337fa4176f15ed385f80b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 18 Dec 2020 15:22:10 GMT
server: nginx/1.18.0
etag: W/"5fdcc922-3663"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 telegram-widget.js Show response
oauth.tg.dev/js/ Frame 99DF 18 KB
6 KB 154ms
48ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://oauth.tg.dev/js/telegram-widget.js?15

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

90ca8055f760f720c49cf2567cec73385fbef57accc88de14d74a4cef3a75446

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 14 May 2021 08:57:07 GMT
server: nginx/1.18.0
etag: W/"609e3b63-4820"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 widget-frame.js Show response
tg.dev/js/ Frame 99DF 81 KB
23 KB 223ms
112ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/widget-frame.js?47

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

9d0492bc4ca5962e56afef0a0a1d82b09b620e7004e9931bcced638312ce465c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Fri, 14 May 2021 08:57:07 GMT
server: nginx/1.18.0
etag: W/"609e3b63-1449b"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Sat, 11 Sep 2021 05:15:44 GMT

GET
H2 200 comments.js Show response
comments.app/js/ Frame 99DF 81 KB
22 KB 83ms
80ms Script
application/javascript 104.222.176.201
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.app/js/comments.js?35

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.201 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

aa441bf5f2ac8c608371513bad73ea45ad6dc8b7c50e3c6841af81147d0b96ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Pacific%20City%20Bank%20hit%20by%20AVOS%20Locker%20Ransomware%20-%20RedPacket%20Security&limit=5&color=E22F38
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
last-modified: Tue, 17 Nov 2020 20:59:36 GMT
server: nginx/1.20.1
etag: W/"5fb439b8-142f4"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript

GET
H2 200 loader.js Show response
smartarget.online/ 17 KB
8 KB 331ms
29ms Script
application/javascript 2606:4700:e0::ac40:6725
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://smartarget.online/loader.js?ver=4141&u=1b3d7f524dc3adab2ac978844a1cb21dc61512bf&forceLocation=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&source=cloudflare_exit_popup_smartarget
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/apps/body/gw00emcN9BpzKEYPUBk1NaZL9_8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6725 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a96720a2a59f14c32d7232298b2eee0f760f476e8656f858c3b5127092d65fe

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: br
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IfiFTKng31As7oqY7tw4Pacs5NsVrqKKTtSvwgZNknOfycNUZWT0mJQHYsle19meL4OB1a0e5vaO74UC4eZQ7RDmptqXA8BM7T82YYRjaackRSUZGK2syemX%2FcySpznzuVgtbvzZKfaUDD1p26%2FMjg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-ray: 68ad7603bb414ab5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 1 Jan 1970 00:00:00 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 29ms
27ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210831&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1a14ce669e88de2f6948a3e342376a781bddb11615d09270217016334999890

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8473
x-xss-protection: 0

GET
H3-29 200 loading.gif
www.redpacketsecurity.com/wp-admin/images/ 1 KB
2 KB 147ms
146ms Image
image/gif 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-admin/images/loading.gif

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

6d53299eeb9516dbba670ceeb55e8e5ce2186edb71518f6a1bd16553308f17c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-admin/images/loading.gif
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 16 Jan 2020 19:35:16 GMT
server: cloudflare
x-powered-by: PleskLin
etag: "5e20baf4-55c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cGAf3X4vUu8vmbjr%2FORD6nlZ%2BJV5U8D3PNaPLwrtIz1CzLA7Kz2zzLxHxVJBBob8HpzUzXWWoAifvjB%2FLMMiw7KQ8a%2BQHgaRsV6i3oGi9HQcpdvFV2ZRC8M0%2FkZNChqJB6S9SsUhgolru7kk7wNOzBR36nkvl08a"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68ad7601eb86c2ae-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1372

POST
H3-29 200 rum Show response
www.redpacketsecurity.com/cdn-cgi/ 0
173 B 12ms
11ms XHR
text/plain 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-fetch-mode: cors
origin: https://www.redpacketsecurity.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1
content-length: 1476
:path: /cdn-cgi/rum?
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.redpacketsecurity.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 68ad7601fb9fc2ae-FRA
vary: Origin

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:44 GMT

GET
H2 200 end_of_trial.bundle.js Show response
smartarget.online/apps/ 20 KB
7 KB 345ms
43ms Script
application/javascript 2606:4700:e0::ac40:6725
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://smartarget.online/apps/end_of_trial.bundle.js?ver=0.23875261926215674
Requested by: Host: smartarget.online
URL: https://smartarget.online/loader.js?ver=4141&u=1b3d7f524dc3adab2ac978844a1cb21dc61512bf&forceLocation=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&source=cloudflare_exit_popup_smartarget
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6725 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84dd2797c3d7bbde2318271c7e87c5caa1e7f65acb7b89c1a60d5e2e2b32047d

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 17 Aug 2021 16:36:31 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1TjavMCyHON2nFxq8p0hD64NXnvlhEF0zKABsNeYqFMiKYZixJNdFlbHP4nGISN7NiveQQK9t06eTbBNc%2BeskEJzXs8nclKBDxzKLGX%2FQbSYdyinLKgYASwr7PCJP6fotHCnshAWy9uBBz9vyhyDcA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400, s-maxage=10
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 68ad76041c144ab5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 61WRz4V+ADL._SL125_.jpg
m.media-amazon.com/images/I/ 5 KB
6 KB 23ms
7ms Image
image/jpeg 2a04:4e42:3::272
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.media-amazon.com/images/I/61WRz4V+ADL._SL125_.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::272 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 5dee4fc8039e8b8a1a3c020ad83aaf41346ccd0ce2bd7729ba07de01a30b1303

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: https://www.amazon.in, https://www.amazon.com
date: Tue, 07 Sep 2021 05:15:44 GMT
last-modified: Mon, 11 Jun 2018 01:57:20 GMT
age: 425610
x-cache: HIT from fastly, HIT from fastly
x-nginx-cache-status: MISS
access-control-allow-origin: *
expires: Wed, 28 Aug 2041 07:02:14 GMT
cache-control: max-age=630720000,public
x-amz-ir-id: baf5b5db-183f-4454-99dd-19ce22e84b65
accept-ranges: bytes
content-type: image/jpeg
content-length: 5582
x-served-by: cache-dca17748-DCA, cache-fra19124-FRA

GET
H2 200 41SgYV7BhqL._SL125_.jpg
m.media-amazon.com/images/I/ 3 KB
4 KB 22ms
7ms Image
image/jpeg 2a04:4e42:3::272
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.media-amazon.com/images/I/41SgYV7BhqL._SL125_.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::272 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4bc64c32b5749ea78f10771ad631ee2cf3379913a98e83637528e1214c3c776b

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: https://www.amazon.in, https://www.amazon.com
date: Tue, 07 Sep 2021 05:15:44 GMT
last-modified: Mon, 13 Apr 2020 13:39:24 GMT
age: 1365749
x-cache: HIT from fastly, HIT from fastly
x-nginx-cache-status: MISS
access-control-allow-origin: *
expires: Sat, 17 Aug 2041 09:53:15 GMT
cache-control: max-age=630720000,public
x-amz-ir-id: d0a3abe5-dc4b-4548-a0ee-1248f2f5554c
accept-ranges: bytes
content-type: image/jpeg
content-length: 3366
x-served-by: cache-dca17779-DCA, cache-fra19124-FRA

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 8F7B 12 KB
5 KB 15ms
12ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Mon, 06 Sep 2021 22:16:35 GMT
expires: Tue, 06 Sep 2022 22:16:35 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 25149
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 11CB 783 B
765 B 15ms
15ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7c0982edbe4920ddb69efbd6e9458fd6f1a1aefe05271301fc87801a33390791

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-K73ODTLH3XF8XDxPFmq60g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

expires: Tue, 07 Sep 2021 05:15:44 GMT
date: Tue, 07 Sep 2021 05:15:44 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-K73ODTLH3XF8XDxPFmq60g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 515
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js Show response
pagead2.googlesyndication.com/bg/ Frame 8F7B 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad694c05f6bd32953ca1d52060ed974be8d02bf28ef5a27237326f8e08f3c7ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13326
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:18:17 GMT

GET
DATA 200
OK truncated
/ Frame 99DF 694 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 76216b6c25b768e5bee4b758dacfef993b3e87cc2d7fd9bf192bd685d1ae9bfb

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 99DF 706 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b28d8e93ecf9067ff746e514c79ad5adc53cc00965630bfe0b118cf80f7bf065

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 99DF 16 KB
16 KB 18ms
16ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://comments.app
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 07:54:01 GMT
x-content-type-options: nosniff
age: 336103
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 07:54:01 GMT

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 99DF 15 KB
15 KB 15ms
14ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://comments.app
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 10:59:45 GMT
x-content-type-options: nosniff
age: 324959
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 10:59:45 GMT

GET
H3-29 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 32ms
31ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210831&jk=1802954669018483&bg=!jo2ljcnNAAYJpm41CaY7ACkAdvg8Wvo9s4X02i4QTG9V7nHt_i3jQg6Q0yEMt-X7_bkff8ziZE5DNwIAAABzUgAAAAxoAQcKAA5KKy5o6lb2PHNWWSU0zpkCj1tEK_g0eIqF1fyGOmI3DK1gvnco_ICcS_ygJetsdpUxeQHqChP2z3WwLiIngQ3scbP2Xk1SG_Vxl86rjwKwVniXxawYNHlIa1pU9KqITT_kkHKYieWmmHnV94h9iUAw-1he2X-WYZf3-pWjovAtPn32LDZYi2Ac62xQIsHc-A5eDpvH7u7GhqkcZEXS4q5PWaKcax8CZ-yfhTPW82FJzl6z-mlh-QHaZKPhcVwUJVKKAr0-wdDCP_FPZDMdnVJSePvfc2d9IYf4v-VkNlEmcLD6B2XlKNnb7sJlOrlrSpmT9TUpVaH1koxjRbXx7a0eLXTmO1YNA2y8GPUoGYYaqSv8mdaq1XsMh-ypS--oBVqE8mQIiI4IfJxWItLPpoA9K4HYGA8FsD5Ra-cgNg_9Tjj1aOIHRBVRJIuetFyEM3KnTCWaH0qW2zYeabk7abw7Lg0hqRWLt5YlUzicA0pWS0XCB4ce19k4enR9ICnjAbrtKkWr9lkHtUzQ4gWDvBVoWgHpmxvZuwXy1JC_C1vJqfd5k8XscxyHRAux1PxOZZ39iveiO-xGX5SIfqa1mai4Na6cEJdtFzLOVrr1yiyzTeLFXOtjfSYOsmKsnAFBprs6Sl4GZBGXnnxeAq6urbB_gz3Nc3gnvOaVcffPBIy1Pm2u2EyZB_SHPZHCLkYvT9QmetuETBTeyZWda2ihkaHGOG9A21JdU-V1fpvWXiLbsP3rTWj5VuxC-aB2Whj6EyI9lErWqz3hA5J15SWoGk_BBeXLXZyXbxruJHAte8Y6VwIMRGkAzqZk0905u3NQB5IpBs_MOhBldg5Q7RDFEqr52YZES-akuIeAyQ98BGaETfSPldwiQLWCebOOZtR00Jo
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H2 200 1b3d7f524dc3adab2ac978844a1cb21dc61512bf Show response
api.smartarget.online/app/connect/ 807 B
822 B 428ms
127ms Fetch
text/html 2606:4700:e0::ac40:6625
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.smartarget.online/app/connect/1b3d7f524dc3adab2ac978844a1cb21dc61512bf?source=cloudflare_exit_popup_smartarget&forceLocation=https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
Requested by: Host: smartarget.online
URL: https://smartarget.online/loader.js?ver=4141&u=1b3d7f524dc3adab2ac978844a1cb21dc61512bf&forceLocation=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&source=cloudflare_exit_popup_smartarget
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6625 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da1a4dfe7e542e7df162a6e7a056814b061d04e7caaeba7ffa34a9205873f655

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-mod-pagespeed: 1.13.35.2-0
access-control-allow-methods: POST, PUT, DELETE, OPTIONS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zMM%2Ft2O9vl9uugyNf3Q9sTlbVvn3uFf2esV7dW0OIH7XOZ1uxrCiyeNa3IgUsudpB5UhzjGQb5JvyVaMr%2FQ%2Bd29ZO79MdbeXzvRyxvoszOIXCdmns8RNHQeiVkZb4wq9IIMN2VANadwio5zmU%2FEmMbJY8X8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.redpacketsecurity.com
cache-control: max-age=0, no-cache
access-control-allow-credentials: true
cf-ray: 68ad7605cf5b43b8-FRA
access-control-allow-headers: app-version, content-type, content-length

GET
H3-29 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/ 145 KB
52 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109010101/reactive_library_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50f36dfa6fece434e88e474d214553f6dc1972a8b05f4cdcc3db65890644bd7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53147
x-xss-protection: 0
server: cafe
etag: 6967682741169739163
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 07 Sep 2021 05:15:44 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 28ms
14ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 31ms
16ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 736E 122 KB
38 KB 496ms
496ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=299020469&adf=1105561471&pi=t.aa~a.539797476~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=2&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0&nras=2&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1480&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=68ep1SfYkS&p=https%3A//www.redpacketsecurity.com&dtd=15

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4c603d9e5f3f7e33112b27c3f621c2350ea97996ef1a53295bfeb33f5a613c10

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLWKz9yN7PICFYwT4Aod5YEEQg&gqi=gPU2YeP9LM_03wP-kLK4Dg&layout=/sadbundle/%24csp%253Der3%24/125369472215333082/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=299020469&adf=1105561471&pi=t.aa~a.539797476~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=2&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0&nras=2&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1480&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=68ep1SfYkS&p=https%3A//www.redpacketsecurity.com&dtd=15
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLWKz9yN7PICFYwT4Aod5YEEQg&gqi=gPU2YeP9LM_03wP-kLK4Dg&layout=/sadbundle/%24csp%253Der3%24/125369472215333082/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 07 Sep 2021 05:15:45 GMT
server: cafe
content-length: 39304
x-xss-protection: 0
set-cookie: IDE=AHWqTUmFYdJIwP99m0hMchr3TfuAlpYQpstePzDXpoQ-NFyksYC33YgQBmlzrbulKdk; expires=Sun, 02-Oct-2022 05:15:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 16A5 122 KB
38 KB 572ms
571ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4150600299&adf=3123284526&pi=t.aa~a.1372487962~rp.4&w=800&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=800x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250&nras=3&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1859&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=3GDqLyftHS&p=https%3A//www.redpacketsecurity.com&dtd=36

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aff3aeb583ed15c7cee90a37889edf6de8cedde06a4c6b97e1305857ceef497b

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMWh0NyN7PICFY1O4Aodw-oJCg&gqi=gPU2YdGbLuWM3gO054CACw&layout=/sadbundle/%24csp%253Der3%24/6024863510128231961/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4150600299&adf=3123284526&pi=t.aa~a.1372487962~rp.4&w=800&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=800x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250&nras=3&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1859&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=3GDqLyftHS&p=https%3A//www.redpacketsecurity.com&dtd=36
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMWh0NyN7PICFY1O4Aodw-oJCg&gqi=gPU2YdGbLuWM3gO054CACw&layout=/sadbundle/%24csp%253Der3%24/6024863510128231961/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 07 Sep 2021 05:15:45 GMT
server: cafe
content-length: 39294
x-xss-protection: 0
set-cookie: IDE=AHWqTUmxC85KtXr-YAA1EhCHs7YXIA5EP5bPIhBZkCYImY3S8c3MfFe-jJ6dUAazY2I; expires=Sun, 02-Oct-2022 05:15:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F0FB 121 KB
38 KB 666ms
665ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=1607111869&adf=1867724945&pi=t.aa~a.1057262345~rp.1&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280&nras=4&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1882&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=Klb3kcPq8y&p=https%3A//www.redpacketsecurity.com&dtd=40

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0e0781e3016b912e5e6da6e403278f5c4c3b5b9dddc42b08d407376132235d3e

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJbK0NyN7PICFcDAEQgdRY4ALQ&gqi=gPU2Yc2_LpiY3gOgvIK4AQ&layout=/sadbundle/%24csp%253Der3%24/16382388194385666789/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=1607111869&adf=1867724945&pi=t.aa~a.1057262345~rp.1&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280&nras=4&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1882&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=Klb3kcPq8y&p=https%3A//www.redpacketsecurity.com&dtd=40
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJbK0NyN7PICFcDAEQgdRY4ALQ&gqi=gPU2Yc2_LpiY3gOgvIK4AQ&layout=/sadbundle/%24csp%253Der3%24/16382388194385666789/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 07 Sep 2021 05:15:45 GMT
server: cafe
content-length: 38992
x-xss-protection: 0
set-cookie: IDE=AHWqTUlRfAyU6R0vT208i6qLyoz3Ixohl6y6NtPxKMuseMV5npYKlTmad1-A87rM7O4; expires=Sun, 02-Oct-2022 05:15:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C401 69 KB
27 KB 287ms
286ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efee1255c89a8355ddb3daa16dc49c82a74956d8d08bfa9cc9b05ea61798d2e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 07 Sep 2021 05:15:45 GMT
server: cafe
content-length: 27196
x-xss-protection: 0
set-cookie: IDE=AHWqTUkAeprG-NRhZI_3duFfF-ETVkElYAlxpy6DO3olQx4yxTK99OnLTRRFiauCTE0; expires=Sun, 02-Oct-2022 05:15:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DAC3 121 KB
38 KB 325ms
324ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3130937508&adf=1730821504&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600&nras=6&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=4231&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=zomBIt2Ok5&p=https%3A//www.redpacketsecurity.com&dtd=50

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84c698cc51f4561833450fc2bf3b99d799569774db6aecbcaa1cb846f5a470b2

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN6t0dyN7PICFQezewodbQUGNQ&gqi=gPU2YYSeL7OYrASsuJOoDg&layout=/sadbundle/%24csp%253Der3%24/5559390358210701251/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3130937508&adf=1730821504&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600&nras=6&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=4231&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=zomBIt2Ok5&p=https%3A//www.redpacketsecurity.com&dtd=50
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN6t0dyN7PICFQezewodbQUGNQ&gqi=gPU2YYSeL7OYrASsuJOoDg&layout=/sadbundle/%24csp%253Der3%24/5559390358210701251/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 07 Sep 2021 05:15:45 GMT
server: cafe
content-length: 38958
x-xss-protection: 0
set-cookie: IDE=AHWqTUnGgJffevWaU0_lg7ZMbNybD_SnY-AwBDanIp4hRUJUBd0k5uo3wyJzsxMGphw; expires=Sun, 02-Oct-2022 05:15:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3675 120 KB
38 KB 617ms
617ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3147369498&adf=1037197063&pi=t.aa~a.2404515935~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1140x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=1&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600%2C1200x90&nras=7&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=4331&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=cSYQn82Yjl&p=https%3A//www.redpacketsecurity.com&dtd=53

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

582cb5958b4d628d836793e7c0b6e5178e379cc7909aa246abf1930358cf09bc

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJPU0dyN7PICFZJK4AodGp8MGg&gqi=gPU2YafFL9Hm3wONrrLACw&layout=/sadbundle/%24csp%253Der3%24/17482830078537030830/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3147369498&adf=1037197063&pi=t.aa~a.2404515935~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1140x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=1&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600%2C1200x90&nras=7&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=4331&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=cSYQn82Yjl&p=https%3A//www.redpacketsecurity.com&dtd=53
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJPU0dyN7PICFZJK4AodGp8MGg&gqi=gPU2YafFL9Hm3wONrrLACw&layout=/sadbundle/%24csp%253Der3%24/17482830078537030830/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 07 Sep 2021 05:15:45 GMT
server: cafe
content-length: 38598
x-xss-protection: 0
set-cookie: IDE=AHWqTUl8bIbm5NAyU7tie6fkgxquL3E0bVPTo6-Vsjo3gFRwtxW6kI0mw7OGv9S0qH8; expires=Sun, 02-Oct-2022 05:15:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

GET
H2 200 logo.webp
smartarget.online/images/ 12 KB
12 KB 323ms
21ms Image
image/webp 2606:4700:e0::ac40:6725
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartarget.online/images/logo.webp?ver=12
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6725 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d5f23634a7945e1e7fb044c67d1e5cbfb6f21d7af5d75d9ddb1ad239735cd7e

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
cf-cache-status: HIT
last-modified: Sat, 13 Feb 2021 18:45:03 GMT
server: cloudflare
age: 3429
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y43ZRYGiwrmK%2Fv2SR%2B6UuxfPY%2BkiQh0gMpJPsgSWPm%2FjZmJspI2wnuOLiGwQ3MhN7K8Cge4P7jN%2FK7WMG6gR5VGvX6COvxOxcq75WMH5hAF6f0V647mo9%2Bf2M6NeV%2BYhw4akypZODbpVvvv7WIruew%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68ad7606d9034ab5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 12376

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/ Frame EBD9 10 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.redpacketsecurity.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.redpacketsecurity.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 06 Sep 2021 06:38:13 GMT
expires: Mon, 20 Sep 2021 06:38:13 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
age: 81451
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame EBD9 0
0 29ms
28ms Fetch
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CQhf5gPU2YeLUEfKFx_AP36iSgAzImq3UY8f8zfmiDtistpWLAxABILWvoCdglQKgAdO1wo4DyAECqQKWgVNRCO-zPqgDAcgDyQSqBP4BT9BxvcXwPthigWr23mQzLHJUM28OhSsrKmTyYNm7ngXlWgaF9KhiTNT3aBfCAupvLozWjhG7gqvny3dTjhTGEgXQU9qaRp3-ONC9B05bVHUU7J-IXkXF7ZlwSvkRjTmxnavTqsm_FYz99sPcJUCPAOhvpeVSCTpk_Ps3p07FOdPAOcTCPLlgv81ix_gnsw5o3MQ5uKQ1VJqJYXzU1BB3-3ArRQJHrZHTqmctsGXkIJxlggw6HwqK-_p1ou-Mk-HQ0Rz7HaaFWV6jkuy0vNs99XRlyaDkmG9ceBq3SHSk0QVleKf5cMu9A6Z-rJIV-ujE1z-ZmKDm8lKnm-kEF27ABJXFxPG9A5IFBAgEGAGSBQQIBRgEoAYCgAecsJfCAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwHyBwQQ-Y8z0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=e3XeLEpFb18

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 07 Sep 2021 05:15:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:44 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/ Frame EBD9 18 KB
7 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:59:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 962
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 04:59:42 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame EBD9 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 778
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:02:46 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EBD9 122 KB
37 KB 33ms
19ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0299ce766df424b69a25530d8afe7c2352cb6240c7510fe7be67d8cd53bd3467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:44 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630496346997469"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37796
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:44 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame EBD9 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:11:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 228
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:11:56 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame EBD9 26 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

331c8dbc087f677d4eca8035d19626c0662a712b95d0d78bbeba05b7c3bbe7dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 20:50:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30327
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10845
x-xss-protection: 0
server: cafe
etag: 14737611871312058204
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Sep 2021 20:50:17 GMT

GET
H3-29 200 4053675380233309100
tpc.googlesyndication.com/simgad/ Frame EBD9 45 KB
45 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4053675380233309100?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkCg7upsxf36b0050hdXIMIdS6gBw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1938de748ea61cae8deff150772b8df810269d025395a1a276157978f2ad72ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 05 Sep 2021 10:55:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 07 Jul 2021 08:12:27 GMT
server: sffe
age: 152399
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45660
x-xss-protection: 0
expires: Mon, 05 Sep 2022 10:55:45 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0E7F 143 B
163 B 6ms
5ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 07 Sep 2021 05:02:16 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 808
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0E7F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
14ms

Document
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmoLe20BdaEqzc8dR4oNfQR8SpV7NzjO4fWoPBRv48KRZGVahmDn0T8OqZLuuU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:44 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 07-Sep-2021 06:15:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:44 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:44 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js Show response
pagead2.googlesyndication.com/bg/ Frame AE2E 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210831/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad694c05f6bd32953ca1d52060ed974be8d02bf28ef5a27237326f8e08f3c7ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13326
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:18:17 GMT

GET
H3-29 200 15621272218128928679
tpc.googlesyndication.com/simgad/ Frame C401 75 KB
75 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15621272218128928679?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlq0LqwjFKTqf9ORm98FHR0a-UMFg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53ebb0215cac65c2f0bbc3c745f7ca8cdaf6c49ef917382aefa019851c6d10fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 31 Aug 2021 16:16:03 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 May 2021 06:27:19 GMT
server: sffe
age: 565182
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 76742
x-xss-protection: 0
expires: Wed, 31 Aug 2022 16:16:03 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/ Frame C401 18 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:59:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 963
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 04:59:42 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame C401 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 779
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:02:46 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C401 122 KB
37 KB 215ms
214ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0299ce766df424b69a25530d8afe7c2352cb6240c7510fe7be67d8cd53bd3467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630496346997469"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37796
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame C401 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:11:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:11:56 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame C401 0
0 14ms
13ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQyf0K7Xl3uUpzMK28E9k67qL01ds9lMtL7sXsLWG8esmikyYb4IcoQx6jiHp2_f7PuDGpO0oTarOuHIk7PVFuSHBywfw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame C401 26 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

331c8dbc087f677d4eca8035d19626c0662a712b95d0d78bbeba05b7c3bbe7dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 20:50:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30328
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10845
x-xss-protection: 0
server: cafe
etag: 14737611871312058204
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Sep 2021 20:50:17 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame C401 0
0 29ms
29ms Fetch
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CFxqYgPU2YcaxL5bH7gOznYKgDf3_soRkxN_31MwNoreb4OsoEAEgta-gJ2CVAqABk_uC1ALIAQKoAwHIA8kEqgT_AU_Qg6s4afb4Hf8k0Ql2wwmlYvS4IJiQXfAOMFx0r3mEwJx4Fy-VW4ZMJOiVQeMGgLTEmtL9n4irhK9Aks08PvSXA30XVxnK96yCG3zyL5wk_nim_wrzCMI0zbDda4r4DM-3OLxBn2Lk4orGt45e_5Z8YvLNSoNU8ncMwNujEQPYTkTalqA5cCUUduWmhxDhkzpG8mc5slxk3L_HUdx8KYduy5MXwLDs6J4h3wYuRa7tnXT_spUuedUzNNQYceMnefS5hKNyQp1szvBLstApOSE79ZSJZA2gOjnBkavnUrUpCayK81aKHiz-tAZTz66T0eyI4__DZBD1oShRocNxdMAEi-6EndMDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBgKAB9WE_asBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G9gHAfIHBBD7zgLSCAkIgOGAEBABGB-ACgHICwHYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItMTUzNjMzNDIxOTU2Mjc3MRgA&sigh=cEd5eRkmZ1M

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 07 Sep 2021 05:15:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F8EE 143 B
163 B 8ms
5ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUkAeprG-NRhZI_3duFfF-ETVkElYAlxpy6DO3olQx4yxTK99OnLTRRFiauCTE0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 07 Sep 2021 05:02:16 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 809
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3D67 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 06 Sep 2021 13:41:14 GMT
expires: Tue, 07 Sep 2021 13:41:14 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 56071
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3D67
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPLPXVGLnu5OcbiO27_YNs807h0qKp7UekUll36...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVRiMWdRQUFBTUprNXk1RA&google_push=AYg5qPLPXVGLnu5OcbiO27_YNs807h0qKp7UekUll36fuXfWQ3h3qjpE5iSxOiR_dX1O3xx7ht_DWY7Ma8en6Bmh8Kri5yRfnnQ

170 B
188 B

85ms
43ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVRiMWdRQUFBTUprNXk1RA&google_push=AYg5qPLPXVGLnu5OcbiO27_YNs807h0qKp7UekUll36fuXfWQ3h3qjpE5iSxOiR_dX1O3xx7ht_DWY7Ma8en6Bmh8Kri5yRfnnQ

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVRiMWdRQUFBTUprNXk1RA&google_push=AYg5qPLPXVGLnu5OcbiO27_YNs807h0qKp7UekUll36fuXfWQ3h3qjpE5iSxOiR_dX1O3xx7ht_DWY7Ma8en6Bmh8Kri5yRfnnQ
Date: Tue, 07 Sep 2021 05:15:45 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3D67
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEFaHSR8Ua-Qv5ZNMIvKZENQ&google_cver=1&google_push=AYg5qPIntx0dpECHXEkFgNQ-f4T3OVOywQidSJIjXpeSR1vwvYKHsSpoQTZzN4vHSVmN2VQQCa8tZNRVX0qMoKA0G_JGFZLSIXg
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIntx0dpECHXEkFgNQ-f4T3OVOywQidSJIjXpeSR1vwvYKHsSpoQTZzN4vHSVmN2VQQCa8tZNRVX0qMoKA0G_JGFZLSIXg&google_hm=Q0FFU0VGYUhTUjhVYS1Rdj...

170 B
188 B

73ms
41ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIntx0dpECHXEkFgNQ-f4T3OVOywQidSJIjXpeSR1vwvYKHsSpoQTZzN4vHSVmN2VQQCa8tZNRVX0qMoKA0G_JGFZLSIXg&google_hm=Q0FFU0VGYUhTUjhVYS1RdjVaTk1JdktaRU5R

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 07 Sep 2021 05:15:44 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIntx0dpECHXEkFgNQ-f4T3OVOywQidSJIjXpeSR1vwvYKHsSpoQTZzN4vHSVmN2VQQCa8tZNRVX0qMoKA0G_JGFZLSIXg&google_hm=Q0FFU0VGYUhTUjhVYS1RdjVaTk1JdktaRU5R
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 3D67 43 B
324 B 97ms
36ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEBMLfCJPFWLZ1wulyPLsq0M&google_push=AYg5qPKL6dDzmcGPqxcyGW2h4KKlUTdZjzAZxh1aX8pm2RI2FMljDcQSJk_JpMAeWALXuEDrzO610bO-SoCFazJFP-zuAwLdIPg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3D67
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RY7yJ-2CSPaqRb5DLhVxQQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

43ms
42ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RY7yJ-2CSPaqRb5DLhVxQQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKbxwcuy38DE1uZUq_3wm-EhSSE1q-z_4mOIN2mCiZdgG7t-rINGY9VmzEHM2uqJAx647HJR4IJsvKdJYEP2We03MjE1zs

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RY7yJ-2CSPaqRb5DLhVxQQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKbxwcuy38DE1uZUq_3wm-EhSSE1q-z_4mOIN2mCiZdgG7t-rINGY9VmzEHM2uqJAx647HJR4IJsvKdJYEP2We03MjE1zs
date: Tue, 07 Sep 2021 05:15:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3D67
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFj-zOPFZO696MGvdtv9-1Q&google_cver=1&google_push=AYg5qPJDBp_phjXHZkkRLuXBrsHPBL2FraxcqTfNLjVtkT5WzbE3U_90dbVW1cqWQphVnDRCGFs...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Q5TURHV0ItMVItNFBQSg==&google_push=AYg5qPJDBp_phjXHZkkRLuXBrsHPBL2FraxcqTfNLjVtkT5WzbE3U_90dbVW1cqWQphVnDRCGFsvBl9cOv3Ig-MCg8Kv_pXDYtA

170 B
188 B

81ms
42ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Q5TURHV0ItMVItNFBQSg==&google_push=AYg5qPJDBp_phjXHZkkRLuXBrsHPBL2FraxcqTfNLjVtkT5WzbE3U_90dbVW1cqWQphVnDRCGFsvBl9cOv3Ig-MCg8Kv_pXDYtA

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Q5TURHV0ItMVItNFBQSg==&google_push=AYg5qPJDBp_phjXHZkkRLuXBrsHPBL2FraxcqTfNLjVtkT5WzbE3U_90dbVW1cqWQphVnDRCGFsvBl9cOv3Ig-MCg8Kv_pXDYtA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 3D67
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 3D67 43 B
296 B 82ms
22ms Image
image/gif 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESENeCRHiMRALNO9nr7HH77O8&google_cver=1&google_push=AYg5qPKhx-7ilD5huFHA9urhrphkc1HVQLKAe7S1iGrbyuhsJkOI6A4pvKPI5zwWLQIZIZ2o0mMLtPpVBOMekbf_qAjcLTRbRUo
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=600&adk=453381890&adf=172462482&pi=t.aa~a.4161679147~rp.4&w=296&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=296x600&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250&nras=5&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=2479&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=baHADvgXAS&p=https%3A//www.redpacketsecurity.com&dtd=47
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 3D67 0
253 B 123ms
39ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IMdFcwaO5SFDZuTVgfpbpbBy70NMlL8IGeWAFCfVnKaWVXPEFCFTmWH95mONJtvNXEISkS

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F8EE
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

19ms
15ms

Document
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnGgJffevWaU0_lg7ZMbNybD_SnY-AwBDanIp4hRUJUBd0k5uo3wyJzsxMGphw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 07-Sep-2021 06:15:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/ Frame B639 53 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be433bf6927e928db0a7f4e6f4765f69bfdb391d0aa969446b23d2ac1ee7d636

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/5559390358210701251/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Fri, 03 Sep 2021 03:02:40 GMT
expires: Sat, 03 Sep 2022 03:02:40 GMT
last-modified: Tue, 20 Apr 2021 05:23:24 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 8240
age: 353585
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2B31 0
0 32ms
32ms Fetch
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CsgBdgPU2Yd7tL4fm7gPtipioA6SJzp9kuary_skNnNO2_9ocEAEgta-gJ2CVAqABzLya2QPIAQmpAo8KDDEY67M-qAMByANIqgSNAk_QexkswR_xWtZK9qv-zWMmOZEB1Gz4EFCzGmSIxiNSMd6x5pAyTSZSIYmiJnDzzP5JexwLpidMuoLMRy1BN7LuSCkld8FeonnGflT91UGTXUc5lGkXCtXgZu4umGhvFxEljyBV-NDSdXOisE30X-Lj72KqAOVg5fdxmh3qC24peB9HdurqYFGuNTEMuClG-B5ssjvF9Bne2HFIrwEcx_aQCW_kEsF2N50kT4YVD4mLlTSZ1dkRhzFVQhaIYanl0R6hynq3spT_H_ZnPLvVm6EZ0uEFFxB4otR9CvSoy1MoxP89Fg7STWn2_yTteY1A2js0zCzJnxf1-eI2yvlewtDEgIYauq7gj0BJZe7awASEuvTBxAOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHnMPlJqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQi8QI0ggJCIDhgBAQARgfgAoByAsB2BMMiBQB0BUBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=tWVw4rR7sC8&template_id=419

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3130937508&adf=1730821504&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600&nras=6&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=4231&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=zomBIt2Ok5&p=https%3A//www.redpacketsecurity.com&dtd=50
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 07 Sep 2021 05:15:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/ Frame 2B31 18 KB
7 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3130937508&adf=1730821504&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600&nras=6&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=4231&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=zomBIt2Ok5&p=https%3A//www.redpacketsecurity.com&dtd=50

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:59:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 963
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 04:59:42 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame 2B31 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 779
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:02:46 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2B31 122 KB
37 KB 158ms
157ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0299ce766df424b69a25530d8afe7c2352cb6240c7510fe7be67d8cd53bd3467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630496346997469"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37796
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame 2B31 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:11:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:11:56 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 2B31 0
0 17ms
17ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTW9OciUMDoYYznE71bJesO1_gPlTmvTMDHWygjIrjFNYMrBQ_o92uoxSPOrNFusyzMp635vx2DYX4ZPvPRoMsmhL_kSg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3130937508&adf=1730821504&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600&nras=6&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=4231&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=zomBIt2Ok5&p=https%3A//www.redpacketsecurity.com&dtd=50
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A91C 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3130937508&adf=1730821504&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600&nras=6&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=4231&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=zomBIt2Ok5&p=https%3A//www.redpacketsecurity.com&dtd=50
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnGgJffevWaU0_lg7ZMbNybD_SnY-AwBDanIp4hRUJUBd0k5uo3wyJzsxMGphw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3130937508&adf=1730821504&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600&nras=6&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=4231&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=zomBIt2Ok5&p=https%3A//www.redpacketsecurity.com&dtd=50

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 07 Sep 2021 05:02:16 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 809
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 2B31 0
20 B 29ms
28ms Other
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN6t0dyN7PICFQezewodbQUGNQ&gqi=gPU2YYSeL7OYrASsuJOoDg&layout=/sadbundle/%24csp%253Der3%24/5559390358210701251/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame B639 9 KB
3 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 17:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 17:48:17 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame B639 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 20:55:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30003
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 20:55:42 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame B639 3 KB
622 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Questrial%7cRoboto+Condensed:regular

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

07b0cb6ded8444987f7d06649fa10c975acff255555cd21642fa227d968395cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 04:56:44 GMT
server: ESF
date: Tue, 07 Sep 2021 05:15:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 gitterrost.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/ Frame B639 61 KB
61 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/gitterrost.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da3a1be18178e12acd55face27ef827c62f224ad4e47c0b529fcac5e3256c92b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 353598
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62634
x-xss-protection: 0
last-modified: Tue, 20 Apr 2021 05:23:24 GMT
server: sffe
date: Fri, 03 Sep 2021 03:02:27 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 03:02:27 GMT

GET
H3-29 200 MEA_Logo.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/ Frame B639 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/MEA_Logo.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5559390358210701251/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9cf770e94b7e0cc3b6c2eb1bb38016df3e2e359a7dde7c369f48f27df032663

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 93208
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2008
x-xss-protection: 0
last-modified: Tue, 20 Apr 2021 05:23:24 GMT
server: sffe
date: Mon, 06 Sep 2021 03:22:17 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 03:22:17 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A91C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
15ms

Document
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnGgJffevWaU0_lg7ZMbNybD_SnY-AwBDanIp4hRUJUBd0k5uo3wyJzsxMGphw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 07-Sep-2021 06:15:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2
fonts.gstatic.com/s/robotocondensed/v19/ Frame B639 15 KB
15 KB 9ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v19/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Questrial%7cRoboto+Condensed:regular

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53b907326f7c21a04f6d39cc32ff471aafec57d887feabfabb53394f378c659f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:35:27 GMT
x-content-type-options: nosniff
age: 13218
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15720
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:08:56 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 01:35:27 GMT

GET
H3-29 200 rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js Show response
pagead2.googlesyndication.com/bg/ Frame B639 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad694c05f6bd32953ca1d52060ed974be8d02bf28ef5a27237326f8e08f3c7ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14248
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13326
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:18:17 GMT

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/ Frame DF18 35 KB
7 KB 8ms
7ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a32f2a17d90e4f6c9a6232baae8005d8fb315ec17f1c918152e6cd40b7905a41

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/125369472215333082/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Sun, 05 Sep 2021 07:55:11 GMT
expires: Mon, 05 Sep 2022 07:55:11 GMT
last-modified: Wed, 30 Jun 2021 08:31:19 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 6780
age: 163234
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 62CF 0
0 30ms
30ms Fetch
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=COIelgPU2YbXKLYyngAflg5KQBPGm6-Zk7JbtjIQO6Kq2lYsDEAEgta-gJ2CVAqABvfz8nAPIAQmpApaBU1EI77M-qAMByANIqgT-AU_QCuDrUErXJN8U6pUuunE2NXlZclJn2Tem-hnC6WTkSW-hkNRBeWl9DaJ8XcWIbPlRVBhABas5TJ_nf-uCFUvJh19C83rMrixWFqSIKngCJ97gybBMwcyolbqffucorYR-M_gbIA0QNOBz3LZtkeJvcPi_VcBkcBJbSbvGnfEiGtCXjtIBmegAmOQBlF9HkEgQ25FCKQQT3YU08fN2gwaiRjDn516DhBto4mCo6AJ-UP6nsAv1L5H9Y9GGtGIlJXSl845_30llGIjLxJt-EIuJNHed4vFGt4PVcGl2szvx9TQCJ0sY9qIfcRPUqKgFI3Pl1ueMZyEHnctT5B9KwATd9rfbyAOSBQQIBBgBkgUECAUYBKAGLoAHq4ODY6gH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQptUH0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=zSqfEG9JAlw&template_id=419

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=299020469&adf=1105561471&pi=t.aa~a.539797476~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=2&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0&nras=2&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1480&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=68ep1SfYkS&p=https%3A//www.redpacketsecurity.com&dtd=15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 07 Sep 2021 05:15:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/ Frame 62CF 18 KB
7 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=299020469&adf=1105561471&pi=t.aa~a.539797476~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=2&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0&nras=2&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1480&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=68ep1SfYkS&p=https%3A//www.redpacketsecurity.com&dtd=15

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:59:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 963
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 04:59:42 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame 62CF 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 779
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:02:46 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 62CF 122 KB
37 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0299ce766df424b69a25530d8afe7c2352cb6240c7510fe7be67d8cd53bd3467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630496346997469"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37796
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame 62CF 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:11:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:11:56 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 62CF 0
0 15ms
14ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaStrioA6HSdfDIRtfSBuufLfJAZAx8RBDwYzvJzfwslVPHtuWM92J7YB8BbKOPMFeN8ta6cbmgn0lQmR71drL0vb_mp_Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=299020469&adf=1105561471&pi=t.aa~a.539797476~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=2&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0&nras=2&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1480&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=68ep1SfYkS&p=https%3A//www.redpacketsecurity.com&dtd=15
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame C401 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 452d85f076db5debbe085abcd4a6032be46b2f0ecaa805e77e263e16080832c0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 2B31 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99ccf7ad58d3db741bf165f3cfc2bf515d2e35539ee0cb8ccb0056a24558adba

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 119C 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=299020469&adf=1105561471&pi=t.aa~a.539797476~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=2&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0&nras=2&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1480&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=68ep1SfYkS&p=https%3A//www.redpacketsecurity.com&dtd=15
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUmxC85KtXr-YAA1EhCHs7YXIA5EP5bPIhBZkCYImY3S8c3MfFe-jJ6dUAazY2I
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=299020469&adf=1105561471&pi=t.aa~a.539797476~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=2&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0&nras=2&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1480&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=68ep1SfYkS&p=https%3A//www.redpacketsecurity.com&dtd=15

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 07 Sep 2021 05:02:16 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 809
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 62CF 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cb83466d2a1cc769eaa5c56e09ba0b7910da355fdb1eb0beb0743d4523a49b77

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 62CF 0
20 B 31ms
30ms Other
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLWKz9yN7PICFYwT4Aod5YEEQg&gqi=gPU2YeP9LM_03wP-kLK4Dg&layout=/sadbundle/%24csp%253Der3%24/125369472215333082/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame DF18 9 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 17:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 17:48:17 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame DF18 26 KB
10 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 20:55:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30003
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 20:55:42 GMT

GET
H3-29 200 f26fdea10cef6ab9d68e407cf7c21487.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/ Frame DF18 74 KB
19 KB 8ms
8ms Script
application/x-javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/f26fdea10cef6ab9d68e407cf7c21487.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4427a7a29dd9086c912a5c9ae99901585889e2e24f4120a13c69e8c13a49ce88

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 88197
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19283
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:31:19 GMT
server: sffe
date: Mon, 06 Sep 2021 04:45:48 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 04:45:48 GMT

GET
H3-29 200 rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js Show response
pagead2.googlesyndication.com/bg/ Frame 672A 35 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad694c05f6bd32953ca1d52060ed974be8d02bf28ef5a27237326f8e08f3c7ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14248
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13326
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:18:17 GMT

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/ Frame CD1E 33 KB
6 KB 8ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f78d9baf1bfc9f2b6acde94750d85c1ae6d397b2c617ab3021b4b4d16470004

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/6024863510128231961/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Tue, 31 Aug 2021 22:02:50 GMT
expires: Wed, 31 Aug 2022 22:02:50 GMT
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 6595
age: 544375
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame C0C8 0
0 32ms
30ms Fetch
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C6nl9gPU2YcXhLo2dgQfD1adQ8abr5mTv7bug0g7oqraViwMQASC1r6AnYJUCoAG9_PycA8gBCakCloFTUQjvsz6oAwHIA0iqBP4BT9DqTA7pVp5jtlTpRVqiLOuv1jm2OwaQgQg2OhLxvRXzhmj4k7zFoQ-RvT3D-ex_4-3eKniuY660yt-kJvBvx-fcbh5MKL00JHkIPVMMd2K5l3bwAv-KgCogyBLFJz-Yx5BjTrK58RcUKwXG-POjm_ORjHNAALNaij-iURMxgvhGXxoJ-KQ6GbmBM1-umf33jiasbpuNLtGEEffsI1NImRojfSS_g_IetgfYDCJ4oq32Rg9rzLmYKqYp8SrIkebfNKfVKTafutJcMWHBLo8szZkAhivDdT2YakhDX2lcruajksBVkQGwguTIYDbl5T-5GyRqtj2n9eJppKHzvY3ABN32t9vIA5IFBAgEGAGSBQQIBRgEoAYugAerg4NjqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G9gHAPIHBBCmiyzSCAkIgOGAEBABGB-ACgHICwHYEw2IFAHQFQGAFwGyFxwKGggAEhRwdWItMTUzNjMzNDIxOTU2Mjc3MRgA&sigh=iMP_3FutVZw&template_id=419

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4150600299&adf=3123284526&pi=t.aa~a.1372487962~rp.4&w=800&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=800x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250&nras=3&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1859&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=3GDqLyftHS&p=https%3A//www.redpacketsecurity.com&dtd=36
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 07 Sep 2021 05:15:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/ Frame C0C8 18 KB
7 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4150600299&adf=3123284526&pi=t.aa~a.1372487962~rp.4&w=800&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=800x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250&nras=3&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1859&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=3GDqLyftHS&p=https%3A//www.redpacketsecurity.com&dtd=36

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:59:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 963
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 04:59:42 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame C0C8 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 779
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:02:46 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C0C8 122 KB
37 KB 30ms
27ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0299ce766df424b69a25530d8afe7c2352cb6240c7510fe7be67d8cd53bd3467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630496346997469"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37796
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame C0C8 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:11:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:11:56 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame C0C8 0
0 16ms
14ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQzQTnoRmKWfgoqBu6r5b_j4GGVGpNHEpudZa-HTHr2VEQ_P6uRpkFFzLKLAyCBma9bStXQF1nrYovRFRYc32c5fnP6tg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4150600299&adf=3123284526&pi=t.aa~a.1372487962~rp.4&w=800&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=800x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250&nras=3&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1859&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=3GDqLyftHS&p=https%3A//www.redpacketsecurity.com&dtd=36
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/ Frame DC95 18 KB
4 KB 6ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d643a5bfb1ea3db5f1781bf93afd45476c9a711cd78be36a4a28da05710f720

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/17482830078537030830/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Sun, 05 Sep 2021 07:05:04 GMT
expires: Mon, 05 Sep 2022 07:05:04 GMT
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 4247
age: 166241
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 248F 0
0 29ms
29ms Fetch
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CF3ojgPU2YZOUMJKVgQeavrLQAaroxK9k7P7R0bIO__WQ49cCEAEgta-gJ2CVAqABvouR0APIAQmpApaBU1EI77M-qAMByANIqgSEAk_Q9mb0j6IoAy9RJmYbLTPJBHPqgpvY8DsyTysv97J8cakvkyPGMg9em2DfNYc9GVFBdPOPCBX8uyhCdIdM36QVLOoE9uLnpo4Mjhsf-36cLi886Sgz_wmcpfxhEN443B8fGnUnN0XXxPK47J9GJhq_RphpxJPvjT_TY2nvC7RrLVFMMJbPQatzQeQcNl3cigoIoC_9-FWifp2aZmveGgKJem2av8DA0aTPPcXCL3biDwmkibUSvn4e2lp1g1ns9ti_3zTtZmuWE_z91B3qoD9OLJtunwbCqaJ3JlBoBKR-kF6XIInkL-8qYNyESQs8FLPfZCfxwzDUV10AFNtPyWMCmAr8wATcs7Gz9AOSBQQIBBgBkgUECAUYBKAGLoAH6tKVMKgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQta8W0ggJCIDhgBAQARgfgAoByAsB2BMNiBQB0BUBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=8u9OOCxNv2E&template_id=419

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3147369498&adf=1037197063&pi=t.aa~a.2404515935~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1140x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=1&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600%2C1200x90&nras=7&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=4331&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=cSYQn82Yjl&p=https%3A//www.redpacketsecurity.com&dtd=53
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 07 Sep 2021 05:15:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/ Frame 248F 18 KB
7 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3147369498&adf=1037197063&pi=t.aa~a.2404515935~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1140x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=1&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600%2C1200x90&nras=7&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=4331&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=cSYQn82Yjl&p=https%3A//www.redpacketsecurity.com&dtd=53

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:59:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 963
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 04:59:42 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame 248F 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 779
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:02:46 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 248F 122 KB
37 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0299ce766df424b69a25530d8afe7c2352cb6240c7510fe7be67d8cd53bd3467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630496346997469"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37796
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame 248F 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:11:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:11:56 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame DF18 5 KB
690 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/f26fdea10cef6ab9d68e407cf7c21487.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e698b324b44b78001346a831c0cf96da80f9edf3444ddaef06d01fa86f23cd59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 05:15:45 GMT
server: ESF
date: Tue, 07 Sep 2021 05:15:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 01088ea71a25692ba2b13472125ca61a.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/media/ Frame DF18 35 KB
35 KB 8ms
8ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/media/01088ea71a25692ba2b13472125ca61a.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97c4a6f1fdcf989c76fed5bf120c2fc18fc902f0db51bcd7a526bf2cef7dd610

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 346030
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35506
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:31:19 GMT
server: sffe
date: Fri, 03 Sep 2021 05:08:35 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 05:08:35 GMT

GET
H3-29 200 3b749e2a3b687be203005f8ecef7f6fd.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/media/ Frame DF18 679 B
467 B 7ms
6ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/media/3b749e2a3b687be203005f8ecef7f6fd.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52cba504db8540c0ce693d325ae20b20730dbe808cd3f57706d38371c7c19932

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 112216
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 434
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:31:19 GMT
server: sffe
date: Sun, 05 Sep 2021 22:05:29 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 22:05:29 GMT

GET
H3-29 200 db5f570a11c2c19132aaf376e837f669.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/media/ Frame DF18 3 KB
2 KB 8ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/media/db5f570a11c2c19132aaf376e837f669.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/125369472215333082/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f0fb5e7aee1812174996e6d522c9920704a3c9397d1599000fa9a79070e446d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 163233
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1527
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:31:19 GMT
server: sffe
date: Sun, 05 Sep 2021 07:55:12 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 07:55:12 GMT

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/ Frame 7C2B 18 KB
4 KB 7ms
7ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

730a42a7c6e3a903b95f415359bb560282542bed2f264c95aee21e0e132e70d7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/16382388194385666789/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Tue, 07 Sep 2021 04:17:21 GMT
expires: Wed, 07 Sep 2022 04:17:21 GMT
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 4151
age: 3504
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame A730 0
0 30ms
29ms Fetch
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CDqiEgPU2YZaKL8CBx_APxZyC6AKq6MSvZPz80dGyDv_1kOPXAhABILWvoCdglQKgAb6LkdADyAEJqQKWgVNRCO-zPqgDAcgDSKoE_wFP0NwNSuQB1phJ82-VtObHfq3Ove5mLIqQg875D0dEznyleN6_uF1YIvWpi1RUsNJpg-fTFhhWCrw6mEZH2oegXGzBt5NSdZILvKPu2kvjUzRuZXTMJ8y0CIHgTWHz-AuHCUuBi-zjpyRePv3wYNH_F6_2sdjz_kH9unJjs8zMnyr2GFsIvmQoq_B_SZbEaGJJYtPyPWU-2qo3jt3RB5htQf6D-VWqNNzU5FN1nsGFgggXCsQOH1Q9SVJpHw04DHyg9wJ7wplKoymOD9upuLcOHA_3LCPZ1KE8F0zcLfoSApzkfeR8LGPi_ILyrz9fxytMc_eTJ8rR3XD8OGh2dafABNyzsbP0A5IFBAgEGAGSBQQIBRgEoAYugAfq0pUwqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G9gHAPIHBBDp2g_SCAkIgOGAEBABGB-ACgHICwHYEw2IFAHQFQGAFwGyFxwKGggAEhRwdWItMTUzNjMzNDIxOTU2Mjc3MRgA&sigh=UtboLSyKYaQ&template_id=419

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=1607111869&adf=1867724945&pi=t.aa~a.1057262345~rp.1&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280&nras=4&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1882&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=Klb3kcPq8y&p=https%3A//www.redpacketsecurity.com&dtd=40
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 07 Sep 2021 05:15:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/ Frame A730 18 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=1607111869&adf=1867724945&pi=t.aa~a.1057262345~rp.1&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280&nras=4&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1882&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=Klb3kcPq8y&p=https%3A//www.redpacketsecurity.com&dtd=40

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 04:59:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 963
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 04:59:42 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame A730 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 779
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:02:46 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A730 122 KB
37 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0299ce766df424b69a25530d8afe7c2352cb6240c7510fe7be67d8cd53bd3467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1630496346997469"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37796
x-xss-protection: 0
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/ Frame A730 14 KB
6 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210831/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:11:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Sep 2021 05:11:56 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame A730 0
0 22ms
21ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSSkuMUVZL7zfEIU8LRhrym6whQLbY5sqN-jlTI5exFpFp-5aMaps1DFOJ_0zmJquT5PP_PJz6aDDZjKJg4ESI1mCvqMA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=1607111869&adf=1867724945&pi=t.aa~a.1057262345~rp.1&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280&nras=4&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1882&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=Klb3kcPq8y&p=https%3A//www.redpacketsecurity.com&dtd=40
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 119C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
14ms

Document
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlRfAyU6R0vT208i6qLyoz3Ixohl6y6NtPxKMuseMV5npYKlTmad1-A87rM7O4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 07-Sep-2021 06:15:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AE4D 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4150600299&adf=3123284526&pi=t.aa~a.1372487962~rp.4&w=800&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=800x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250&nras=3&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1859&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=3GDqLyftHS&p=https%3A//www.redpacketsecurity.com&dtd=36
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlRfAyU6R0vT208i6qLyoz3Ixohl6y6NtPxKMuseMV5npYKlTmad1-A87rM7O4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4150600299&adf=3123284526&pi=t.aa~a.1372487962~rp.4&w=800&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=800x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250&nras=3&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1859&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=3GDqLyftHS&p=https%3A//www.redpacketsecurity.com&dtd=36

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 07 Sep 2021 05:02:16 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 809
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C0C8 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9270312edb6beeb82f612986cb4dfc2de693a340fb35ce5f182cf3d2d0d635c0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1989 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3147369498&adf=1037197063&pi=t.aa~a.2404515935~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1140x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=1&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600%2C1200x90&nras=7&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=4331&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=cSYQn82Yjl&p=https%3A//www.redpacketsecurity.com&dtd=53
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlRfAyU6R0vT208i6qLyoz3Ixohl6y6NtPxKMuseMV5npYKlTmad1-A87rM7O4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=90&adk=3147369498&adf=1037197063&pi=t.aa~a.2404515935~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1140x90&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=1&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280%2C310x250%2C296x600%2C1200x90&nras=7&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=4331&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=cSYQn82Yjl&p=https%3A//www.redpacketsecurity.com&dtd=53

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 07 Sep 2021 05:02:16 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 809
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame C0C8 0
20 B 28ms
27ms Other
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMWh0NyN7PICFY1O4Aodw-oJCg&gqi=gPU2YdGbLuWM3gO054CACw&layout=/sadbundle/%24csp%253Der3%24/6024863510128231961/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame DF18 356 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6f8bfaef875088ab0791e9118f7884ddfb82296331ba2b32b5598298c941293

Request headers

Origin: null
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H3-29 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame DF18 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 10:50:07 GMT
x-content-type-options: nosniff
age: 66338
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 10:50:07 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ Frame DF18 20 KB
20 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3202c5584350517cab7f1de0d43d54db0979c449df18fe70241e8c35de80919

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 04 Sep 2021 10:52:14 GMT
x-content-type-options: nosniff
age: 239011
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20016
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:21:37 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Sep 2022 10:52:14 GMT

GET
H3-29 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ Frame DF18 19 KB
19 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 07:30:39 GMT
x-content-type-options: nosniff
age: 78306
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19844
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:10 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 07:30:39 GMT

GET
DATA 200
OK truncated
/ Frame DF18 13 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d867f01ddeb0046fff1579890a34e0f0aca6b83f0380181c8d81ca38429bd43c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
DATA 200
OK truncated
/ Frame DF18 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 38817a74140cf776573a0449151634e3b0d493f406326904cd33fdfe93fddb24

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D781 143 B
163 B 6ms
5ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=1607111869&adf=1867724945&pi=t.aa~a.1057262345~rp.1&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280&nras=4&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1882&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=Klb3kcPq8y&p=https%3A//www.redpacketsecurity.com&dtd=40
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlRfAyU6R0vT208i6qLyoz3Ixohl6y6NtPxKMuseMV5npYKlTmad1-A87rM7O4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=250&adk=1607111869&adf=1867724945&pi=t.aa~a.1057262345~rp.1&w=310&fwrn=4&fwrnh=100&lmt=1630944204&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=310x250&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630991744722&bpp=1&bdt=1008&idt=-M&shv=r20210831&mjsv=m202109010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6fd0b34272b883b0-22644364e2ca004b%3AT%3D1630991744%3ART%3D1630991744%3AS%3DALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ&prev_fmts=0x0%2C310x250%2C800x280&nras=4&correlator=8553269379453&frm=20&pv=1&ga_vid=2007483637.1630991744&ga_sid=1630991744&ga_hid=1285917805&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1060&ady=1882&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530671%2C31062297&oid=3&pvsid=1802954669018483&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=Klb3kcPq8y&p=https%3A//www.redpacketsecurity.com&dtd=40

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 07 Sep 2021 05:02:16 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 809
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 248F 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 416fda0d891ea3cebd60d810078b79e53ebb02a772829ac8668b0754217d30b2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame A730 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6938f753622ea289ba8f36829e9507a8b1c5f96a4f3018337540a3544d46255a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 248F 0
20 B 29ms
29ms Other
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJPU0dyN7PICFZJK4AodGp8MGg&gqi=gPU2YafFL9Hm3wONrrLACw&layout=/sadbundle/%24csp%253Der3%24/17482830078537030830/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame CD1E 9 KB
3 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 17:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 17:48:17 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame CD1E 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 20:55:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30003
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 20:55:42 GMT

GET
H3-29 200 f26fdea10cef6ab9d68e407cf7c21487.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/ Frame CD1E 74 KB
19 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/f26fdea10cef6ab9d68e407cf7c21487.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4427a7a29dd9086c912a5c9ae99901585889e2e24f4120a13c69e8c13a49ce88

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 3640
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19283
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
server: sffe
date: Tue, 07 Sep 2021 04:15:05 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 04:15:05 GMT

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame A730 0
20 B 27ms
27ms Other
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJbK0NyN7PICFcDAEQgdRY4ALQ&gqi=gPU2Yc2_LpiY3gOgvIK4AQ&layout=/sadbundle/%24csp%253Der3%24/16382388194385666789/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame DC95 9 KB
3 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 17:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 17:48:17 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame DC95 26 KB
10 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 20:55:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30003
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 20:55:42 GMT

GET
H3-29 200 c6afb71c43a6f510a28d0c5a9b6e8216.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/ Frame DC95 77 KB
20 KB 8ms
8ms Script
application/x-javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/c6afb71c43a6f510a28d0c5a9b6e8216.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d12411c852fcc11ebba43ff3acf0e5eb913439df6684cf56b4b85b0be15cef1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 116078
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20438
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Sun, 05 Sep 2021 21:01:07 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 21:01:07 GMT

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 7C2B 9 KB
3 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 17:48:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41248
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 17:48:17 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 7C2B 26 KB
10 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 20:55:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30003
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 07 Sep 2021 20:55:42 GMT

GET
H3-29 200 c6afb71c43a6f510a28d0c5a9b6e8216.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/ Frame 7C2B 77 KB
20 KB 10ms
7ms Script
application/x-javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/c6afb71c43a6f510a28d0c5a9b6e8216.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d12411c852fcc11ebba43ff3acf0e5eb913439df6684cf56b4b85b0be15cef1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 3575
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20438
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Tue, 07 Sep 2021 04:16:10 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 04:16:10 GMT

GET
H3-29 200 Digital-Patreon-Wordmark_FieryCoralv2-e1609686169209.png
www.redpacketsecurity.com/wp-content/uploads/2021/01/ 5 KB
5 KB 16ms
15ms Image
image/png 2606:4700:3036::ac43:c62e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2021/01/Digital-Patreon-Wordmark_FieryCoralv2-e1609686169209.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:c62e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

55f4abf18c64885e850fb8dd99c63077d849b3df603b2eb30eb3046fe0618e0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

:path: /wp-content/uploads/2021/01/Digital-Patreon-Wordmark_FieryCoralv2-e1609686169209.png
pragma: no-cache
cookie: __cf_bm=fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=; caosLocalGa=GA1.3.2007483637.1630991744; caosLocalGa_gid=GA1.3.227926819.1630991744; _gat=1; __gads=ID=6fd0b34272b883b0-22644364e2ca004b:T=1630991744:RT=1630991744:S=ALNI_MapMu7gchcxfQeiE2zUxJDeQtPrDQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.redpacketsecurity.com
referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.redpacketsecurity.com/pacific-city-bank-hit-by-avos-locker-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 05:15:45 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 54
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4640
last-modified: Sun, 03 Jan 2021 15:02:49 GMT
server: cloudflare
etag: "5ff1dc99-1220"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qpzZ8bQkwPAumBn%2Bwi9W9U6Z6MpjBmLOhG6vkBwkjZsL6uLmI18YDVgHlVZV55hJzu%2BZDJGqXDwJj4JJVKQUDpe4hJxw%2FPKAGlsEy%2F%2BUnarERCYFvwx4EM6N6mGbBUhiRo3yTnZNTY1S2EiEs%2FIfiznpQHNNEBXK"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 68ad760afe50c2ae-FRA

GET
H3-29 200 css
fonts.googleapis.com/ Frame CD1E 5 KB
690 B 18ms
15ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/f26fdea10cef6ab9d68e407cf7c21487.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e698b324b44b78001346a831c0cf96da80f9edf3444ddaef06d01fa86f23cd59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 03:30:18 GMT
server: ESF
date: Tue, 07 Sep 2021 05:15:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 1d8b54700cd75c928712301fafc6e3c9.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/ Frame CD1E 53 KB
53 KB 11ms
8ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/1d8b54700cd75c928712301fafc6e3c9.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ada3dee5caeaa7b6531724b208f952faec6476488bc8479a26faf59a94384607

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 26524
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54597
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
server: sffe
date: Mon, 06 Sep 2021 21:53:41 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 21:53:41 GMT

GET
H3-29 200 3b749e2a3b687be203005f8ecef7f6fd.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/ Frame CD1E 679 B
469 B 9ms
7ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/3b749e2a3b687be203005f8ecef7f6fd.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52cba504db8540c0ce693d325ae20b20730dbe808cd3f57706d38371c7c19932

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 347393
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 434
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
server: sffe
date: Fri, 03 Sep 2021 04:45:52 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 04:45:52 GMT

GET
H3-29 200 db5f570a11c2c19132aaf376e837f669.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/ Frame CD1E 3 KB
2 KB 10ms
7ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/media/db5f570a11c2c19132aaf376e837f669.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6024863510128231961/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f0fb5e7aee1812174996e6d522c9920704a3c9397d1599000fa9a79070e446d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 127494
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1527
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 08:35:09 GMT
server: sffe
date: Sun, 05 Sep 2021 17:50:51 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 17:50:51 GMT

GET
H3-29 200 rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js Show response
pagead2.googlesyndication.com/bg/ Frame DF18 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad694c05f6bd32953ca1d52060ed974be8d02bf28ef5a27237326f8e08f3c7ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14248
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13326
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:18:17 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AE4D
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

16ms
14ms

Document
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlRfAyU6R0vT208i6qLyoz3Ixohl6y6NtPxKMuseMV5npYKlTmad1-A87rM7O4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 07-Sep-2021 06:15:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 css
fonts.googleapis.com/ Frame DC95 6 KB
636 B 20ms
16ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/c6afb71c43a6f510a28d0c5a9b6e8216.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1f2fa7e74884a4b14523d8d82178a964a20da8c45a9f38b9c30fd516eff418b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 03:31:25 GMT
server: ESF
date: Tue, 07 Sep 2021 05:15:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 a6bbc0bf7adcea5559699818d25507fb.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame DC95 2 KB
1 KB 10ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/a6bbc0bf7adcea5559699818d25507fb.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0021fcf6011bbb68d059ae5ebda2cc09c8bee217a8b65868072cd991b8e5e564

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 544379
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1059
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Tue, 31 Aug 2021 22:02:46 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 Aug 2022 22:02:46 GMT

GET
H3-29 200 0c7344eb51817eb88e50c1f5a818189c.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame DC95 3 KB
3 KB 12ms
10ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/0c7344eb51817eb88e50c1f5a818189c.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04977b423ffd765d6bab517ddf7e595bf5cc5ca43754f0f3ff0885c7292fd9df

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 88889
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3034
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Mon, 06 Sep 2021 04:34:16 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 04:34:16 GMT

GET
H3-29 200 68205a7bba4eca78358f122322a6922b.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame DC95 2 KB
1 KB 12ms
10ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/68205a7bba4eca78358f122322a6922b.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32b47a3ee3ee877ea3de7f07c5e523d503c4144599479d967ddb9a32ded8957f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 544379
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1004
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Tue, 31 Aug 2021 22:02:46 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 Aug 2022 22:02:46 GMT

GET
H3-29 200 aa145009e51cbd97688805fc6853e759.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame DC95 1 KB
1 KB 11ms
9ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/aa145009e51cbd97688805fc6853e759.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb0a9e1893bc36c2e40e4f9be137b9b6da63b6cd76df7b024199963d19f214e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 544379
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1087
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Tue, 31 Aug 2021 22:02:46 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 Aug 2022 22:02:46 GMT

GET
H3-29 200 c1241c6ef542ccc3a135381379b799d3.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame DC95 1 KB
1 KB 10ms
8ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/c1241c6ef542ccc3a135381379b799d3.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

549c549bf7c34a36255bb3da74d572eb72700285b8a337877f720719e8c02c03

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 346761
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1241
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Fri, 03 Sep 2021 04:56:24 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 04:56:24 GMT

GET
H3-29 200 e2fdc71e1ed3c1fec3bedf48f31f676d.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame DC95 6 KB
6 KB 13ms
11ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/e2fdc71e1ed3c1fec3bedf48f31f676d.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0dbe0e33fa54bef4741e319d6aaf8e2075f7be15324e5975e6e412a08f5878c7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 152048
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6012
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Sun, 05 Sep 2021 11:01:37 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 11:01:37 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 7C2B 4 KB
591 B 18ms
15ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/c6afb71c43a6f510a28d0c5a9b6e8216.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6f8303bb870db3bc3af5b70fcefacf6dbdb9a79ed0ae08b59aab86b44d506d78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 04:36:38 GMT
server: ESF
date: Tue, 07 Sep 2021 05:15:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Sep 2021 05:15:45 GMT

GET
H3-29 200 a6bbc0bf7adcea5559699818d25507fb.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/ Frame 7C2B 2 KB
1 KB 10ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/a6bbc0bf7adcea5559699818d25507fb.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0021fcf6011bbb68d059ae5ebda2cc09c8bee217a8b65868072cd991b8e5e564

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 127410
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1059
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Sun, 05 Sep 2021 17:52:15 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 17:52:15 GMT

GET
H3-29 200 090c3058d48414054f8570c62f4c2c96.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/ Frame 7C2B 19 KB
19 KB 11ms
9ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/090c3058d48414054f8570c62f4c2c96.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90e37206ec638101401c17bb4eba2bebbf52828095a2669e670778e88399e9a7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 544179
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19504
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Tue, 31 Aug 2021 22:06:06 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 Aug 2022 22:06:06 GMT

GET
H3-29 200 1243eebfe46fdb2a6cb7658b4fd37d0a.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/ Frame 7C2B 766 B
799 B 11ms
9ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/1243eebfe46fdb2a6cb7658b4fd37d0a.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4eb1a83d03b84f8a87f0aacefce3a5124642219ca4a08ceb3ae926b00fdde91

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 127474
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 766
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Sun, 05 Sep 2021 17:51:11 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 17:51:11 GMT

GET
H3-29 200 d0f22751b043d1784be61dc7b41b28f3.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/ Frame 7C2B 1 KB
1 KB 11ms
9ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/d0f22751b043d1784be61dc7b41b28f3.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

655e629b9417fa0b28009b49f5fa20c397c889ad4a83d664e3a3fc110a329041

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 167968
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1190
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Sun, 05 Sep 2021 06:36:17 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 06:36:17 GMT

GET
H3-29 200 ec86897df20292ba6882a87934abac7e.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/ Frame 7C2B 32 KB
32 KB 12ms
10ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/ec86897df20292ba6882a87934abac7e.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8abf96a942db307ad109c07911387cc201ec0907ad3a323f960a383788be0c72

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 115944
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32631
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Sun, 05 Sep 2021 21:03:21 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 21:03:21 GMT

GET
H3-29 200 68205a7bba4eca78358f122322a6922b.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/ Frame 7C2B 2 KB
1 KB 11ms
10ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/media/68205a7bba4eca78358f122322a6922b.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16382388194385666789/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32b47a3ee3ee877ea3de7f07c5e523d503c4144599479d967ddb9a32ded8957f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 128558
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1004
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Sun, 05 Sep 2021 17:33:07 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 17:33:07 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1989
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
14ms

Document
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlRfAyU6R0vT208i6qLyoz3Ixohl6y6NtPxKMuseMV5npYKlTmad1-A87rM7O4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 07-Sep-2021 06:15:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D781
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

42ms
41ms

Document
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlRfAyU6R0vT208i6qLyoz3Ixohl6y6NtPxKMuseMV5npYKlTmad1-A87rM7O4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 07-Sep-2021 06:15:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 07 Sep 2021 05:15:45 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 Sep 2021 05:15:45 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame CD1E 13 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d867f01ddeb0046fff1579890a34e0f0aca6b83f0380181c8d81ca38429bd43c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
DATA 200
OK truncated
/ Frame CD1E 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 38817a74140cf776573a0449151634e3b0d493f406326904cd33fdfe93fddb24

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
DATA 200
OK truncated
/ Frame CD1E 356 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6f8bfaef875088ab0791e9118f7884ddfb82296331ba2b32b5598298c941293

Request headers

Origin: null
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H3-29 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame CD1E 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 10:50:07 GMT
x-content-type-options: nosniff
age: 66338
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 10:50:07 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ Frame CD1E 20 KB
20 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3202c5584350517cab7f1de0d43d54db0979c449df18fe70241e8c35de80919

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 04 Sep 2021 10:52:14 GMT
x-content-type-options: nosniff
age: 239011
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20016
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:21:37 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Sep 2022 10:52:14 GMT

GET
H3-29 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ Frame CD1E 19 KB
19 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400|Montserrat:800|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 07:30:39 GMT
x-content-type-options: nosniff
age: 78306
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19844
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:10 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 07:30:39 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame DC95 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 10:50:07 GMT
x-content-type-options: nosniff
age: 66338
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 10:50:07 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame DC95 16 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 07:54:01 GMT
x-content-type-options: nosniff
age: 336104
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 07:54:01 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame DC95 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 07:45:49 GMT
x-content-type-options: nosniff
age: 336596
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15724
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:50 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 07:45:49 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 7C2B 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 10:50:07 GMT
x-content-type-options: nosniff
age: 66338
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 10:50:07 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 7C2B 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 07:45:49 GMT
x-content-type-options: nosniff
age: 336596
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15724
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:50 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 07:45:49 GMT

GET
H3-29 200 rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js Show response
pagead2.googlesyndication.com/bg/ Frame CD1E 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad694c05f6bd32953ca1d52060ed974be8d02bf28ef5a27237326f8e08f3c7ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14248
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13326
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:18:17 GMT

GET
H3-29 200 rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js Show response
pagead2.googlesyndication.com/bg/ Frame DC95 35 KB
13 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad694c05f6bd32953ca1d52060ed974be8d02bf28ef5a27237326f8e08f3c7ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14248
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13326
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:18:17 GMT

GET
H3-29 200 rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js Show response
pagead2.googlesyndication.com/bg/ Frame 7C2B 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rWlMBfa9MpU8odUgYO2XS-jQK_KO9aJyNzJvjgjzx8o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad694c05f6bd32953ca1d52060ed974be8d02bf28ef5a27237326f8e08f3c7ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:18:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14248
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13326
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 12:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:18:17 GMT

POST
H2 200 api Show response
comments.app/ Frame 99DF 140 B
316 B 53ms
53ms XHR
application/json 104.222.176.201
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.app/api?api_hash=e916ddfb2ddf472cf4

Requested by

Host: tg.dev
URL: https://tg.dev/js/jquery.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.201 , United States, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

9d900e6736915fea0baf3ef1e8f16eacfa17e7a71626d2cd28efed1bd1fc2492

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Pacific%20City%20Bank%20hit%20by%20AVOS%20Locker%20Ransomware%20-%20RedPacket%20Security&limit=5&color=E22F38
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 05:15:54 GMT
content-encoding: gzip
server: nginx/1.20.1
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json; charset=utf-8
cache-control: no-store
content-length: 132

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YTb1gTdY4ZVukqTvDaU2aQAABIQAAAAB&google_push=AYg5qPIZ7m81F6R07wXBSwNLydMSg8RxAInQrEBQqvPDyONTi9P0DtML2bbfLqr2sIF1P19AgFgYEQszCjUWXNiFZO45ylW0ATQ&google_gid=CAESEAMoPxvU4wmIOTPvcRRhjks&google_cver=1

Verdicts & Comments Add Verdict or Comment

95 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.redpacketsecurity.com/	1970-01-19 21:03:11	Name: _gat Value: 1
.www.redpacketsecurity.com/	1970-01-19 21:04:38	Name: caosLocalGa_gid Value: GA1.3.227926819.1630991744
.www.redpacketsecurity.com/	1970-01-19 21:46:23	Name: caosLocalGa Value: GA1.3.2007483637.1630991744
.redpacketsecurity.com/	1970-01-19 21:03:13	Name: __cf_bm Value: fH6dIf.2mSt627kVPURw14LktGJ53m9KMDc16ZhV.f0-1630991744-0-ASitdYFw1ZQQvqsA9osZMGwlHkfjsZUi7DVugt2AZaN0LUTp6WumNkKLtEfdiD1nWDzD7yis2+O3EofkPuom88fbJWjtZ4P2wtC3pCuIbcbd6hNpetVpVLuwyeqVivObzgwJyshX2tBtTXSj+xCmKyM=

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.redpacketsecurity.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2(Line 2) Message: JQMIGRATE: Migrate is installed, version 3.3.2
console-api	log	URL: https://smartarget.online/loader.js?ver=4141&u=1b3d7f524dc3adab2ac978844a1cb21dc61512bf&forceLocation=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&source=cloudflare_exit_popup_smartarget(Line 14) Message: insert app [object Object] 0.23875261926215674
console-api	log	URL: https://smartarget.online/loader.js?ver=4141&u=1b3d7f524dc3adab2ac978844a1cb21dc61512bf&forceLocation=https%3A%2F%2Fwww.redpacketsecurity.com%2Fpacific-city-bank-hit-by-avos-locker-ransomware%2F&source=cloudflare_exit_popup_smartarget(Line 14) Message: insert app [object Object] 0.7398638874365906

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ag.innovid.com
api.smartarget.online
cm.g.doubleclick.net
comments.app
d.agkn.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i1.wp.com
image6.pubmatic.com
m.media-amazon.com
oauth.tg.dev
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
smartarget.online
static.cloudflareinsights.com
tg.dev
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
www.redpacketsecurity.com
cm.g.doubleclick.net
104.222.176.10
104.222.176.201
142.250.185.66
142.250.186.162
18.194.175.178
185.64.189.115
192.0.77.2
2606:4700:3036::ac43:c62e
2606:4700::6810:5f41
2606:4700:e0::ac40:6625
2606:4700:e0::ac40:6725
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2004
2a00:1450:4001:811::2002
2a00:1450:4001:812::2002
2a00:1450:4001:827::2003
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::200a
2a00:1450:4001:830::2004
2a04:4e42:3::272
2a05:d01c:1d8:8101:8678:af0d:fda8:5a84
34.98.67.61
52.18.11.109
69.173.144.138
0021fcf6011bbb68d059ae5ebda2cc09c8bee217a8b65868072cd991b8e5e564
013ebd68f5fc8686a3424406191f0785f3a3d8d8ef2c10012dcd54989ee3ef59
0157d11106d6b70289099fd1ce1f7bea3a9dfbb46cee3994edb07ce765bb92fc
0299ce766df424b69a25530d8afe7c2352cb6240c7510fe7be67d8cd53bd3467
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
036cb212b79b6b41aa94647b00f4f03ba6cc127ebceaa72400663441d1f2b211
04977b423ffd765d6bab517ddf7e595bf5cc5ca43754f0f3ff0885c7292fd9df
04e6fb814fccce3a0aecb83be0bc24665cf3e6a5e993f296471a63708f63e138
07b0cb6ded8444987f7d06649fa10c975acff255555cd21642fa227d968395cc
0949fbffb7d97f42804c4d980950fe0eda340eec542073a6f95bc56c1136bbf2
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cd851e5b33af0fbb354df65506da39807b998e07723f3d08aba5179fa2ed97e
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
0dbe0e33fa54bef4741e319d6aaf8e2075f7be15324e5975e6e412a08f5878c7
0e0781e3016b912e5e6da6e403278f5c4c3b5b9dddc42b08d407376132235d3e
0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
1000abf34bf56e3a757816ca05551e1b79ebd035605f3b7b40bbf864ecb43959
114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1938de748ea61cae8deff150772b8df810269d025395a1a276157978f2ad72ea
1f2fa7e74884a4b14523d8d82178a964a20da8c45a9f38b9c30fd516eff418b1
2092be07bff9503312074b6d5cdbd26849f298240af86811d024a37cfe9e97b6
293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
2b32be0979cb9f2119bd22563ed89560525c15a8edfd6e662a1968314783f689
2ea2602e2120c775d8c861066a613210666aaf67adb13928067f5978f8e1975a
2f78d9baf1bfc9f2b6acde94750d85c1ae6d397b2c617ab3021b4b4d16470004
32b47a3ee3ee877ea3de7f07c5e523d503c4144599479d967ddb9a32ded8957f
331c8dbc087f677d4eca8035d19626c0662a712b95d0d78bbeba05b7c3bbe7dc
38817a74140cf776573a0449151634e3b0d493f406326904cd33fdfe93fddb24
416fda0d891ea3cebd60d810078b79e53ebb02a772829ac8668b0754217d30b2
4427a7a29dd9086c912a5c9ae99901585889e2e24f4120a13c69e8c13a49ce88
452d85f076db5debbe085abcd4a6032be46b2f0ecaa805e77e263e16080832c0
45eb24f5baf6691c73c6e91e475041555a6e0e317ea7139760efc9c163e999f0
47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5
482f450b7fdbac6f9304643f3e731df20bf66c51fb0599fa9a734e5d102a9e2a
4bc64c32b5749ea78f10771ad631ee2cf3379913a98e83637528e1214c3c776b
4c603d9e5f3f7e33112b27c3f621c2350ea97996ef1a53295bfeb33f5a613c10
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f0fb5e7aee1812174996e6d522c9920704a3c9397d1599000fa9a79070e446d
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
50d72b7a44227a156b6714b4208be48c3acf8b773eb1b73f069442b07971a92e
50f36dfa6fece434e88e474d214553f6dc1972a8b05f4cdcc3db65890644bd7a
52cba504db8540c0ce693d325ae20b20730dbe808cd3f57706d38371c7c19932
53b907326f7c21a04f6d39cc32ff471aafec57d887feabfabb53394f378c659f
53c088f65c77c6b7af2804face3e267d4c1bf148177798a30fa3a15aa693c36f
53ebb0215cac65c2f0bbc3c745f7ca8cdaf6c49ef917382aefa019851c6d10fd
53f829ae556bf7011727483015d83a98bcdb4b5796eecb728827c1282c971536
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
549c549bf7c34a36255bb3da74d572eb72700285b8a337877f720719e8c02c03
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
55f4abf18c64885e850fb8dd99c63077d849b3df603b2eb30eb3046fe0618e0d
582cb5958b4d628d836793e7c0b6e5178e379cc7909aa246abf1930358cf09bc
5b84335d42b38d3122349f53b20dd6a5cb0f45d1e45e5683fd572bcdda8c04a2
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5d12411c852fcc11ebba43ff3acf0e5eb913439df6684cf56b4b85b0be15cef1
5d5f23634a7945e1e7fb044c67d1e5cbfb6f21d7af5d75d9ddb1ad239735cd7e
5d643a5bfb1ea3db5f1781bf93afd45476c9a711cd78be36a4a28da05710f720
5dee4fc8039e8b8a1a3c020ad83aaf41346ccd0ce2bd7729ba07de01a30b1303
6287db4afba7afb075b81209ee68696f14cb268cdc8209a29c1e38f0dcf435d2
6342d16a93416b5e826f6d0e0e930ef033efb682851ae46270f3c4f5b4a1c194
655e629b9417fa0b28009b49f5fa20c397c889ad4a83d664e3a3fc110a329041
6716fefe49861853b89562048cf4d1cca696a940abc62c4d0b68eb3f399ac6d7
6938f753622ea289ba8f36829e9507a8b1c5f96a4f3018337540a3544d46255a
6a96720a2a59f14c32d7232298b2eee0f760f476e8656f858c3b5127092d65fe
6d53299eeb9516dbba670ceeb55e8e5ce2186edb71518f6a1bd16553308f17c2
6f8303bb870db3bc3af5b70fcefacf6dbdb9a79ed0ae08b59aab86b44d506d78
730a42a7c6e3a903b95f415359bb560282542bed2f264c95aee21e0e132e70d7
76216b6c25b768e5bee4b758dacfef993b3e87cc2d7fd9bf192bd685d1ae9bfb
7af53d7077c16f6ad9efd63a975749c4835ce6e495c337fa4176f15ed385f80b
7baeeb05ff0ee4e24a08c877dbf87509ff0285842079bd27678e8e0629a03029
7c0982edbe4920ddb69efbd6e9458fd6f1a1aefe05271301fc87801a33390791
7d45256c95c1c245654bf298e27d9c538dc778a2ee050ba4678ac2a07f479869
820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c
8261160588bad883690da277a0e9455441f5b7d11abccbfae7e42b3018ba8c08
83510accc35e1d155a95730d4a7704dd555d74293cfcf681c9ef6a7feefc157b
842258538e379b1dabe5daddd81e90eeb7c69834580f33842bfdbde38d8f8400
84c698cc51f4561833450fc2bf3b99d799569774db6aecbcaa1cb846f5a470b2
84dd2797c3d7bbde2318271c7e87c5caa1e7f65acb7b89c1a60d5e2e2b32047d
8994924c0f3ab4474ee0a7c04417ad84933c4467cc9192fcb60b9774f15f5990
8abf96a942db307ad109c07911387cc201ec0907ad3a323f960a383788be0c72
8c21cdf7be2219908a953d92fba153dcc7175f7ee238856bd9954da18b0e05dd
8c582f22b6db80071eb06a7fe7a046261faa879228afac0c651e5c606d33b1d8
8ca395d4b5b90db22d9acbe97aa5b3514f384cb6659c77880b462a00b9c099a5
90ca8055f760f720c49cf2567cec73385fbef57accc88de14d74a4cef3a75446
90e37206ec638101401c17bb4eba2bebbf52828095a2669e670778e88399e9a7
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
9270312edb6beeb82f612986cb4dfc2de693a340fb35ce5f182cf3d2d0d635c0
97c4a6f1fdcf989c76fed5bf120c2fc18fc902f0db51bcd7a526bf2cef7dd610
99ccf7ad58d3db741bf165f3cfc2bf515d2e35539ee0cb8ccb0056a24558adba
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9d0492bc4ca5962e56afef0a0a1d82b09b620e7004e9931bcced638312ce465c
9d900e6736915fea0baf3ef1e8f16eacfa17e7a71626d2cd28efed1bd1fc2492
9ddc0f6530a2a949a60ecc192689aba25551e0f9f6270b44803134b27708d883
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a3202c5584350517cab7f1de0d43d54db0979c449df18fe70241e8c35de80919
a32f2a17d90e4f6c9a6232baae8005d8fb315ec17f1c918152e6cd40b7905a41
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a6f8bfaef875088ab0791e9118f7884ddfb82296331ba2b32b5598298c941293
a7e340aa92bb4abc075a1d50daa8a0a44fed34c75a52f376b306e9ddf5963ca1
a976db2ba03b446964bf86aaa0e98ae45e70c3a823e848ee78c71f4e8e8e5fde
aa441bf5f2ac8c608371513bad73ea45ad6dc8b7c50e3c6841af81147d0b96ce
abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340
ac2b8f24354dedbeaacadf80e2141a989e5d33ebb3f8e361d936d0fd818c9674
ad694c05f6bd32953ca1d52060ed974be8d02bf28ef5a27237326f8e08f3c7ca
ada3dee5caeaa7b6531724b208f952faec6476488bc8479a26faf59a94384607
af12f7592b4d8f6b8483bd9bab081ecf35abe485d5315fb0ecf30559ac2bd9cd
aff3aeb583ed15c7cee90a37889edf6de8cedde06a4c6b97e1305857ceef497b
b2235f7060e7b1158c85fdd8d850413d28a250daad04b1c812d923ed3087da34
b28d8e93ecf9067ff746e514c79ad5adc53cc00965630bfe0b118cf80f7bf065
b28fee1eac5fa6d375a18ca1bc7a0200a972073b95669028734c3c13e7d4ecf4
b30169a38c7ecd17eefc119177c0c61337b17a8f1abfd337ac37284d1a04a65b
b5c642f4690b2fb0b6fe20a4b6f05d84a7c7d196bd608929456e43ebf1126bfb
b5e930df6a2976d5df996e18b347e091756699ea32716dc53d0e1c0fd814c526
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
b71eda2a49bf8c9d5a31ac22dfdd01a45a0b436a35821f8d249bfc1eb6d1338b
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bd3a2482b7b952b621e16a05c3bb1847829d057fb1384f4c32d1362b8153e967
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
be433bf6927e928db0a7f4e6f4765f69bfdb391d0aa969446b23d2ac1ee7d636
bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7
c4efeeb957e361500bf19ba26282beae1a8e4083c5ccff10dccab2eaa09acd45
cb658d8af264091d320d32e952cb1756ea0145c2f6497b182a39e7ce4e466653
cb83466d2a1cc769eaa5c56e09ba0b7910da355fdb1eb0beb0743d4523a49b77
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
cfb0a9e1893bc36c2e40e4f9be137b9b6da63b6cd76df7b024199963d19f214e
d1a14ce669e88de2f6948a3e342376a781bddb11615d09270217016334999890
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d73efe70be2927ba40fb4617468ffa04712439f55dd935568313ce4a09320418
d867f01ddeb0046fff1579890a34e0f0aca6b83f0380181c8d81ca38429bd43c
d8780c6aefcc4f67ef6f836c6bf5d8a554e3b46c82e555cc9d172ce3e58c746f
da1a4dfe7e542e7df162a6e7a056814b061d04e7caaeba7ffa34a9205873f655
da3a1be18178e12acd55face27ef827c62f224ad4e47c0b529fcac5e3256c92b
dab763234340993765a5ee4b57e7abbc830cc6a61d50db623a7a83b1c15c4c2b
dceda745a0fb58233a95eff6d10796026df6792cb960cdf675eb7b8a6750a2d2
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e2ec7cee57ce5e6ce8f7e87ca4c7b4182859964aca436f1ff87884c7ef3bcc26
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e450af4a7c4974ea3ff324b629876380e0ca9605333a57152a953310c4a4661a
e698b324b44b78001346a831c0cf96da80f9edf3444ddaef06d01fa86f23cd59
e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7
e895e5a8292868e89c3f0ba4076f378731d5515e7aa94c96659e020a47131e44
eb46d82ef6f86859f18e379660e0f45b85c6f69fa97111905f0c125a08506376
ec69865e0075b81b472ece2aae8d022053975db2c4280cd9ab77a1b6179733ca
efee1255c89a8355ddb3daa16dc49c82a74956d8d08bfa9cc9b05ea61798d2e8
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
f4eb1a83d03b84f8a87f0aacefce3a5124642219ca4a08ceb3ae926b00fdde91
f513ed107290a63ee74d2440a0c4b6f66289beba7ee693f498b6d765625bc1f1
f9cf770e94b7e0cc3b6c2eb1bb38016df3e2e359a7dde7c369f48f27df032663
f9f94cc2cf984a2a8df89c1250c04396bc950e577b4143d5539ca88fb46de91b

www.redpacketsecurity.com Open in urlscan Pro 2606:4700:3036::ac43:c62e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

247 Requests

100 %HTTPS

68 %IPv6

21 Domains

26 Subdomains

28 IPs

4 Countries

2494 kBTransfer

5931 kBSize

4 Cookies

22 Outgoing links

Redirected requests

247 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 15 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.redpacketsecurity.com Open in urlscan Pro
2606:4700:3036::ac43:c62e Public Scan

Screenshot
Live screenshot

Full Image

247
Requests

100 %
HTTPS

68 %
IPv6

21
Domains

26
Subdomains

28
IPs

4
Countries

2494 kB
Transfer

5931 kB
Size

4
Cookies

247 HTTP transactions
15 data transactions