www.ledroit.com Open in urlscan Pro
2600:9000:214f:400:1d:9f81:51c0:93a1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/g2Y77vHr89
Effective URL:
https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b9...
Submission: On April 18 via api (April 18th 2022, 9:22:14 pm UTC) from US — Scanned from DE

Summary HTTP 147 Redirects Links 111 Behaviour Indicators

Summary

This website contacted 43 IPs in 7 countries across 26 domains to perform 147 HTTP transactions. The main IP is 2600:9000:214f:400:1d:9f81:51c0:93a1, located in United States and belongs to AMAZON-02, US. The main domain is www.ledroit.com. The Cisco Umbrella rank of the primary domain is 640063.
TLS certificate: Issued by Amazon on March 1st 2022. Valid for: a year.

This is the only time www.ledroit.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1 2	2600:9000:214... 2600:9000:214f:400:1d:9f81:51c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
18	18.64.103.129 18.64.103.129	16509 (AMAZON-02) (AMAZON-02)
3	35.227.246.163 35.227.246.163	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
9	18.64.103.110 18.64.103.110	16509 (AMAZON-02) (AMAZON-02)
1 2	185.33.221.91 185.33.221.91	29990 (ASN-APPNEX) (ASN-APPNEX)
8	99.86.7.29 99.86.7.29	16509 (AMAZON-02) (AMAZON-02)
5	143.204.202.104 143.204.202.104	16509 (AMAZON-02) (AMAZON-02)
11	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
2	65.9.66.173 65.9.66.173	16509 (AMAZON-02) (AMAZON-02)
1	2.20.157.2 2.20.157.2	16625 (AKAMAI-AS) (AKAMAI-AS)
1	143.204.202.20 143.204.202.20	16509 (AMAZON-02) (AMAZON-02)
8	65.9.7.81 65.9.7.81	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2606:4700:20:... 2606:4700:20::681a:a13	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:215... 2600:9000:2156:cc00:11:9cfd:9400:93a1	16509 (AMAZON-02) (AMAZON-02)
1	185.86.137.32 185.86.137.32	201081 (SMARTADSE...) (SMARTADSERVER)
1 1	104.92.74.8 104.92.74.8	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.205.235.133 23.205.235.133	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	185.86.139.114 185.86.139.114	201081 (SMARTADSE...) (SMARTADSERVER)
1 2	2600:1f18:612... 2600:1f18:612b:4264:35be:ace0:b22e:18d9	14618 (AMAZON-AES) (AMAZON-AES)
1 1	8.2.111.142 8.2.111.142	46636 (NATCOWEB) (NATCOWEB)
1	34.254.143.3 34.254.143.3	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
1	35.227.201.248 35.227.201.248	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c06::9c	15169 (GOOGLE) (GOOGLE)
3	2606:4700:20:... 2606:4700:20::681a:b13	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
7	2a00:1450:400... 2a00:1450:4001:82f::200e	15169 (GOOGLE) (GOOGLE)
1	8.39.36.142 8.39.36.142	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2600:1f18:612... 2600:1f18:612b:4216:2301:7ac9:1540:9c55	14618 (AMAZON-AES) (AMAZON-AES)
1	54.173.181.170 54.173.181.170	14618 (AMAZON-AES) (AMAZON-AES)
1	35.227.225.220 35.227.225.220	15169 (GOOGLE) (GOOGLE)
147	43

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:214f:400:1d:9f81:51c0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

www.ledroit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 18.64.103.129 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-64-103-129.txl50.r.cloudfront.net

gcm-production2.omerloclients.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.227.246.163 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 163.246.227.35.bc.googleusercontent.com

rdc.m32.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

news.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 18.64.103.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-64-103-110.txl50.r.cloudfront.net

images.omerlocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.91 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 99.86.7.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-7-29.fra6.r.cloudfront.net

static.freeskreen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
analytics360.omerloclients.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 143.204.202.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-104.fra53.r.cloudfront.net

gcm.omerlocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.66.173 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-173.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.20.157.2 (Milan, Italy)

ASN16625 (AKAMAI-AS, US)
PTR: a2-20-157-2.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.202.20 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-20.fra53.r.cloudfront.net

weather.omerloclients.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 65.9.7.81 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-7-81.fra56.r.cloudfront.net

sb.freeskreen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:20::681a:a13 (United States)

ASN13335 (CLOUDFLARENET, US)

loader.wisepops.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.wisepops.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:cc00:11:9cfd:9400:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.customer.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.137.32 (France)

ASN201081 (SMARTADSERVER, FR)

ww1772.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.92.74.8 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-92-74-8.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.205.235.133 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-235-133.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.86.139.114 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

sync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1f18:612b:4264:35be:ace0:b22e:18d9 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

scm.publishers.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.2.111.142 (United States) 1 redirects

ASN46636 (NATCOWEB, US)

cs.admanmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.254.143.3 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-143-3.eu-west-1.compute.amazonaws.com

loadeu.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.201.248 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 248.201.227.35.bc.googleusercontent.com

geoloc.m32.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c06::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:20::681a:b13 (United States)

ASN13335 (CLOUDFLARENET, US)

activity.wisepops.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
popup.wisepops.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.39.36.142 (United States)

ASN26667 (RUBICONPROJECT, US)

pixel-us-west.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4216:2301:7ac9:1540:9c55 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

pc213-ztwri.ads.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.173.181.170 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-173-181-170.compute-1.amazonaws.com

ads.freeskreen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.225.220 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 220.225.227.35.bc.googleusercontent.com

track.customer.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	omerloclients.com gcm-production2.omerloclients.com — Cisco Umbrella Rank: 602474 analytics360.omerloclients.com — Cisco Umbrella Rank: 655158 weather.omerloclients.com — Cisco Umbrella Rank: 629438	796 KB
19	google.com news.google.com — Cisco Umbrella Rank: 4741 apis.google.com — Cisco Umbrella Rank: 102 www.google.com — Cisco Umbrella Rank: 4 play.google.com — Cisco Umbrella Rank: 31	136 KB
14	omerlocdn.com images.omerlocdn.com — Cisco Umbrella Rank: 453043 gcm.omerlocdn.com — Cisco Umbrella Rank: 518920	710 KB
13	freeskreen.com static.freeskreen.com — Cisco Umbrella Rank: 46673 sb.freeskreen.com — Cisco Umbrella Rank: 36072 ads.freeskreen.com — Cisco Umbrella Rank: 45195	158 KB
12	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 37	20 KB
12	gstatic.com fonts.gstatic.com www.gstatic.com	337 KB
11	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 71	125 KB
6	wisepops.com loader.wisepops.com — Cisco Umbrella Rank: 12858 activity.wisepops.com — Cisco Umbrella Rank: 14119 popup.wisepops.com — Cisco Umbrella Rank: 14204 cdn.wisepops.com — Cisco Umbrella Rank: 30225	118 KB
5	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 193 stats.g.doubleclick.net — Cisco Umbrella Rank: 95	152 KB
5	rubiconproject.com 1 redirects secure-assets.rubiconproject.com — Cisco Umbrella Rank: 1117 eus.rubiconproject.com — Cisco Umbrella Rank: 567 token.rubiconproject.com — Cisco Umbrella Rank: 675 pixel-us-west.rubiconproject.com — Cisco Umbrella Rank: 4599	11 KB
4	m32.media rdc.m32.media — Cisco Umbrella Rank: 25991 geoloc.m32.media — Cisco Umbrella Rank: 27787	34 KB
3	tremorhub.com 1 redirects scm.publishers.tremorhub.com — Cisco Umbrella Rank: 52371 pc213-ztwri.ads.tremorhub.com	968 B
3	smartadserver.com 1 redirects ww1772.smartadserver.com — Cisco Umbrella Rank: 52771 sync.smartadserver.com — Cisco Umbrella Rank: 1463	686 B
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 46 ajax.googleapis.com — Cisco Umbrella Rank: 282	93 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	427 B
2	google.de www.google.de — Cisco Umbrella Rank: 5383	564 B
2	customer.io assets.customer.io — Cisco Umbrella Rank: 19311 track.customer.io — Cisco Umbrella Rank: 14359	3 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 138	114 KB
2	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 302	40 KB
2	adnxs.com 1 redirects secure.adnxs.com — Cisco Umbrella Rank: 438	2 KB
2	ledroit.com 1 redirects www.ledroit.com — Cisco Umbrella Rank: 640063	21 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 436	2 KB
1	exelator.com loadeu.exelator.com — Cisco Umbrella Rank: 7475	324 B
1	admanmedia.com 1 redirects cs.admanmedia.com — Cisco Umbrella Rank: 1260	444 B
1	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 461	132 KB
1	t.co t.co — Cisco Umbrella Rank: 476	642 B
147	26

	Domain	Requested by
18	gcm-production2.omerloclients.com	www.ledroit.com gcm-production2.omerloclients.com
12	www.google-analytics.com	www.googletagmanager.com gcm-production2.omerloclients.com www.ledroit.com
11	www.googletagmanager.com	gcm-production2.omerloclients.com www.ledroit.com www.googletagmanager.com
9	images.omerlocdn.com	www.ledroit.com
9	fonts.gstatic.com	fonts.googleapis.com news.google.com
9	news.google.com	www.ledroit.com news.google.com t.co www.gstatic.com
8	sb.freeskreen.com	static.freeskreen.com www.ledroit.com
7	play.google.com	www.gstatic.com
5	gcm.omerlocdn.com	gcm-production2.omerloclients.com
4	analytics360.omerloclients.com	gcm-production2.omerloclients.com
4	static.freeskreen.com	gcm-production2.omerloclients.com t.co
3	securepubads.g.doubleclick.net	rdc.m32.media securepubads.g.doubleclick.net gcm-production2.omerloclients.com
3	www.gstatic.com	news.google.com www.gstatic.com
3	rdc.m32.media	www.ledroit.com rdc.m32.media www.googletagmanager.com
2	cdn.wisepops.com	loader.wisepops.com www.ledroit.com
2	www.facebook.com	www.ledroit.com
2	www.google.de	www.ledroit.com
2	www.google.com	www.ledroit.com
2	activity.wisepops.com	gcm-production2.omerloclients.com
2	stats.g.doubleclick.net	gcm-production2.omerloclients.com
2	scm.publishers.tremorhub.com	1 redirects www.ledroit.com
2	sync.smartadserver.com	1 redirects www.ledroit.com
2	eus.rubiconproject.com	sb.freeskreen.com eus.rubiconproject.com
2	connect.facebook.net	t.co connect.facebook.net
2	c.amazon-adsystem.com	rdc.m32.media gcm-production2.omerloclients.com
2	secure.adnxs.com	1 redirects www.ledroit.com
2	fonts.googleapis.com	www.ledroit.com cdn.wisepops.com
2	www.ledroit.com	1 redirects t.co
1	track.customer.io
1	ads.freeskreen.com	ajax.googleapis.com
1	pc213-ztwri.ads.tremorhub.com	ajax.googleapis.com
1	pixel-us-west.rubiconproject.com	eus.rubiconproject.com
1	token.rubiconproject.com	eus.rubiconproject.com
1	popup.wisepops.com	gcm-production2.omerloclients.com
1	geoloc.m32.media	gcm-production2.omerloclients.com
1	cdn.jsdelivr.net	gcm-production2.omerloclients.com
1	ajax.googleapis.com	t.co
1	loadeu.exelator.com	www.ledroit.com
1	cs.admanmedia.com	1 redirects
1	secure-assets.rubiconproject.com	1 redirects
1	ww1772.smartadserver.com	sb.freeskreen.com
1	assets.customer.io	t.co
1	loader.wisepops.com	t.co
1	weather.omerloclients.com	gcm-production2.omerloclients.com
1	ads.pubmatic.com	rdc.m32.media
1	apis.google.com	www.ledroit.com
1	t.co
147	47

This site contains links to these domains. Also see Links.

Domain
www.lesoleil.com
www.lenouvelliste.ca
www.lequotidien.com
www.latribune.ca
www.lavoixdelest.ca
www.ledroitfranco.com
www.facebook.com
twitter.com
www.linkedin.com
www.instagram.com
www.monsamedi.com
jeuxdesprit.ca
necrologie.cn2i.ca
zonecarriere.ca
www.omerlo.com

Subject Issuer	Validity	Valid
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
redirect.gc.media Amazon	`2022-03-01` - `2023-03-30`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.m32.media Sectigo RSA Domain Validation Secure Server CA	`2021-12-16` - `2023-01-16`	a year	crt.sh
*.news.google.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.omerlocdn.com Amazon	`2021-10-02` - `2022-10-31`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.freeskreen.com Amazon	`2021-12-19` - `2023-01-16`	a year	crt.sh
*.omerloclients.com Amazon	`2022-01-20` - `2023-02-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-01-26` - `2022-04-26`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-05-28` - `2022-05-27`	a year	crt.sh
*.customer.io Amazon	`2021-12-20` - `2023-01-17`	a year	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-25` - `2023-01-25`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-17` - `2023-04-04`	a year	crt.sh
*.exelator.com DigiCert TLS RSA SHA256 2020 CA1	`2021-06-02` - `2022-06-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.tremorhub.com Amazon	`2022-03-24` - `2023-04-22`	a year	crt.sh
api.customer.io GTS CA 1D4	`2022-03-26` - `2022-06-24`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Frame ID: CFB0B5E7BAFBFF4EBE9D525108BE4119
Requests: 111 HTTP requests in this frame

Frame: https://news.google.com/swg/_/ui/v1/serviceiframe?_=458421&publicationId=ledroit.com
Frame ID: CC504AA44BB5A2F28681045069489FF9
Requests: 12 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Frame ID: 52D8A0167FA999CBD3F739C13173A292
Requests: 4 HTTP requests in this frame

Frame: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Frame ID: 8B7928F6CC6E71E7FE835ABEE6F0791B
Requests: 11 HTTP requests in this frame

Frame: https://sb.freeskreen.com/t.gif?tm=1650316926&p=2974&c=5321&ttm=1650316925013&s=&d=&v=&t=736a16a6-c5ea-4217-9a50-60f5e91d8087&co=SE&pr=SE-AB&ci=Stockholm&dm=null&flc=2022&slc=&e=AdOpened&m=2&x=null
Frame ID: 44577EEA93A34C32109381C6F9FE0F3C
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: CB5B91C5DC21467F4F5FC5CB3D4706AB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Une cyberattaque «sophistiquée» contre Rideau Hall, selon des documents internes | Politique | Actualités | Le Droit - Gatineau, Ottawa

Page URL History Show full URLs

https://t.co/g2Y77vHr89 Page URL
https://www.ledroit.com/actualite/politique/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-d... HTTP 301
https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-docume... Page URL

Detected technologies

Google Sign-in (Social logins) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/platform\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

147
Requests

97 %
HTTPS

48 %
IPv6

26
Domains

47
Subdomains

43
IPs

7
Countries

3006 kB
Transfer

9259 kB
Size

22
Cookies

111 Outgoing links

These are links going to different origins than the main page.

URL: https://www.lesoleil.com/

Search URL Search Domain Scan URL

URL: https://www.lenouvelliste.ca/

Search URL Search Domain Scan URL

URL: https://www.lequotidien.com/

Search URL Search Domain Scan URL

URL: https://www.latribune.ca/

Search URL Search Domain Scan URL

URL: https://www.lavoixdelest.ca/

Search URL Search Domain Scan URL

URL: https://www.ledroitfranco.com/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fdominique-anglade-denonce-le-double-standard-impose-aux-femmes-politiques-e4f5c9c51d74a12ccccc5e8f5fb22670%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fdominique-anglade-denonce-le-double-standard-impose-aux-femmes-politiques-e4f5c9c51d74a12ccccc5e8f5fb22670%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fdominique-anglade-denonce-le-double-standard-impose-aux-femmes-politiques-e4f5c9c51d74a12ccccc5e8f5fb22670%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F16%2Fqs-veut-mettre-fin-aux-listes-dattente-en-sante-mentale-eb407f4217f5becc0eeec63e7c581e70%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F16%2Fqs-veut-mettre-fin-aux-listes-dattente-en-sante-mentale-eb407f4217f5becc0eeec63e7c581e70%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F16%2Fqs-veut-mettre-fin-aux-listes-dattente-en-sante-mentale-eb407f4217f5becc0eeec63e7c581e70%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F16%2Fracisme-systemique-ca-cree-de-la-haine-184eb63a23c4e1ed098c6de979250384%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F16%2Fracisme-systemique-ca-cree-de-la-haine-184eb63a23c4e1ed098c6de979250384%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F16%2Fracisme-systemique-ca-cree-de-la-haine-184eb63a23c4e1ed098c6de979250384%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/follow?screen_name=obosse

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F15%2Fle-dernier-combat-de-la-deputee-dorion-8c3d8cfc991057bf49986793acb233ca%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F15%2Fle-dernier-combat-de-la-deputee-dorion-8c3d8cfc991057bf49986793acb233ca%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F15%2Fle-dernier-combat-de-la-deputee-dorion-8c3d8cfc991057bf49986793acb233ca%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Ftroisieme-lien-reduit-a-quatre-voies-et-65-milliards-pour-un-an-plus-tard-video-c7bca55686cd17ce114192d63b542c55%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Ftroisieme-lien-reduit-a-quatre-voies-et-65-milliards-pour-un-an-plus-tard-video-c7bca55686cd17ce114192d63b542c55%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Ftroisieme-lien-reduit-a-quatre-voies-et-65-milliards-pour-un-an-plus-tard-video-c7bca55686cd17ce114192d63b542c55%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Floi-15-adoptee-sur-la-protection-de-la-jeunesse-linteret-de-lenfant-devra-primer-087287e38dc85e5d2231548c5cd00675%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Floi-15-adoptee-sur-la-protection-de-la-jeunesse-linteret-de-lenfant-devra-primer-087287e38dc85e5d2231548c5cd00675%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Floi-15-adoptee-sur-la-protection-de-la-jeunesse-linteret-de-lenfant-devra-primer-087287e38dc85e5d2231548c5cd00675%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Fles-candidats-a-la-direction-du-parti-conservateur-croiseront-le-fer-les-11-et-25-mai-af04f4dd0d779b55009d269e5ee03e5a%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Fles-candidats-a-la-direction-du-parti-conservateur-croiseront-le-fer-les-11-et-25-mai-af04f4dd0d779b55009d269e5ee03e5a%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Fles-candidats-a-la-direction-du-parti-conservateur-croiseront-le-fer-les-11-et-25-mai-af04f4dd0d779b55009d269e5ee03e5a%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Fle-gouvernement-ford-deposera-son-budget-le-28-avril-3e7ff9f607c3d48d36345c9eb7ddc1f4%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Fle-gouvernement-ford-deposera-son-budget-le-28-avril-3e7ff9f607c3d48d36345c9eb7ddc1f4%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F14%2Fle-gouvernement-ford-deposera-son-budget-le-28-avril-3e7ff9f607c3d48d36345c9eb7ddc1f4%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F13%2Floi-sur-linterdiction-des-hydrocarbures-duhaime-contre-mais-samson-sest-abstenue-9465c7ad53e32b18da99bcd645b0c72f%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F13%2Floi-sur-linterdiction-des-hydrocarbures-duhaime-contre-mais-samson-sest-abstenue-9465c7ad53e32b18da99bcd645b0c72f%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F13%2Floi-sur-linterdiction-des-hydrocarbures-duhaime-contre-mais-samson-sest-abstenue-9465c7ad53e32b18da99bcd645b0c72f%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F13%2Fla-caq-soupconne-les-partis-dopposition-de-comploter-pour-bloquer-le-parlement-8b27c2c4b91bc93678a257e02019fad5%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F13%2Fla-caq-soupconne-les-partis-dopposition-de-comploter-pour-bloquer-le-parlement-8b27c2c4b91bc93678a257e02019fad5%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F13%2Fla-caq-soupconne-les-partis-dopposition-de-comploter-pour-bloquer-le-parlement-8b27c2c4b91bc93678a257e02019fad5%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F12%2Fmanque-de-communication-pour-le-plq-manque-de-jeunes-pour-qs-afb592bd1a87aa2363a64726c120b97e%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F12%2Fmanque-de-communication-pour-le-plq-manque-de-jeunes-pour-qs-afb592bd1a87aa2363a64726c120b97e%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F12%2Fmanque-de-communication-pour-le-plq-manque-de-jeunes-pour-qs-afb592bd1a87aa2363a64726c120b97e%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F12%2Fduhaime-participera-au-debat-des-chefs-on-est-dans-la-cour-des-grands-597e6eeb578f10a85c86174a18eca770%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F12%2Fduhaime-participera-au-debat-des-chefs-on-est-dans-la-cour-des-grands-597e6eeb578f10a85c86174a18eca770%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F12%2Fduhaime-participera-au-debat-des-chefs-on-est-dans-la-cour-des-grands-597e6eeb578f10a85c86174a18eca770%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/follow?screen_name=Thomas8Laberge

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F12%2Fle-chateau-fort-pequiste-de-marie-victorin-tombe-aux-mains-de-la-caq-c6cf4c2620a7b158e2709d30d3bfab2f%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F12%2Fle-chateau-fort-pequiste-de-marie-victorin-tombe-aux-mains-de-la-caq-c6cf4c2620a7b158e2709d30d3bfab2f%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F12%2Fle-chateau-fort-pequiste-de-marie-victorin-tombe-aux-mains-de-la-caq-c6cf4c2620a7b158e2709d30d3bfab2f%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Ffreeland-defend-un-budget-responsable-et-porteur-de-transition-energetique-ca335ec818712b35035ac8d9fbf325af%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Ffreeland-defend-un-budget-responsable-et-porteur-de-transition-energetique-ca335ec818712b35035ac8d9fbf325af%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Ffreeland-defend-un-budget-responsable-et-porteur-de-transition-energetique-ca335ec818712b35035ac8d9fbf325af%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Flegault-on-est-rendu-dans-les-egouts-4fd56bb161582960b73d699fcf72cf77%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Flegault-on-est-rendu-dans-les-egouts-4fd56bb161582960b73d699fcf72cf77%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Flegault-on-est-rendu-dans-les-egouts-4fd56bb161582960b73d699fcf72cf77%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Fvehicules-electriques-annonce-du-premier-ministre-trudeau-lundi-a-victoria-03b7f9f2e7229a9ca8add7c44abd3ec2%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Fvehicules-electriques-annonce-du-premier-ministre-trudeau-lundi-a-victoria-03b7f9f2e7229a9ca8add7c44abd3ec2%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Fvehicules-electriques-annonce-du-premier-ministre-trudeau-lundi-a-victoria-03b7f9f2e7229a9ca8add7c44abd3ec2%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Fmacron-et-melenchon-se-disputent-les-votes-des-expatries-au-quebec-3ae632540cd936111391949a44894098%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Fmacron-et-melenchon-se-disputent-les-votes-des-expatries-au-quebec-3ae632540cd936111391949a44894098%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F11%2Fmacron-et-melenchon-se-disputent-les-votes-des-expatries-au-quebec-3ae632540cd936111391949a44894098%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F10%2Fles-liberaux-federaux-prevoient-se-reunir-en-congres-en-mai-2023-27e60836eed63935ed4f5a180a2ba712%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F10%2Fles-liberaux-federaux-prevoient-se-reunir-en-congres-en-mai-2023-27e60836eed63935ed4f5a180a2ba712%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F10%2Fles-liberaux-federaux-prevoient-se-reunir-en-congres-en-mai-2023-27e60836eed63935ed4f5a180a2ba712%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F10%2Fprojet-de-loi-2-la-reforme-du-droit-de-la-famille-sera-t-elle-abandonnee-6374b79d75df1a2219a846d79cb436e2%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F10%2Fprojet-de-loi-2-la-reforme-du-droit-de-la-famille-sera-t-elle-abandonnee-6374b79d75df1a2219a846d79cb436e2%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F10%2Fprojet-de-loi-2-la-reforme-du-droit-de-la-famille-sera-t-elle-abandonnee-6374b79d75df1a2219a846d79cb436e2%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F03%2Fles-adieux-de-kathleen-wynne-cfa23c9e0752ef8372fb702f311e0734%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F03%2Fles-adieux-de-kathleen-wynne-cfa23c9e0752ef8372fb702f311e0734%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F03%2Fles-adieux-de-kathleen-wynne-cfa23c9e0752ef8372fb702f311e0734%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F09%2Fpierre-poilievre-attire-les-foules-mais-convaincra-t-il-les-membres-du-parti-eee63801b278363aa9bbc7dbe5389e81%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F09%2Fpierre-poilievre-attire-les-foules-mais-convaincra-t-il-les-membres-du-parti-eee63801b278363aa9bbc7dbe5389e81%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F09%2Fpierre-poilievre-attire-les-foules-mais-convaincra-t-il-les-membres-du-parti-eee63801b278363aa9bbc7dbe5389e81%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F10%2Fvoter-ou-ne-pas-voter-ce-qui-motive-les-electeurs-et-ceux-qui-sabstiennent-15aa074b1dbffe4be7a8de6d22be9b06%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F10%2Fvoter-ou-ne-pas-voter-ce-qui-motive-les-electeurs-et-ceux-qui-sabstiennent-15aa074b1dbffe4be7a8de6d22be9b06%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F10%2Fvoter-ou-ne-pas-voter-ce-qui-motive-les-electeurs-et-ceux-qui-sabstiennent-15aa074b1dbffe4be7a8de6d22be9b06%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F09%2Fcharest-veut-etre-aux-communes-rapidement-sil-devient-chef-d019a44791cfd9de430ad40bd1689b24%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F09%2Fcharest-veut-etre-aux-communes-rapidement-sil-devient-chef-d019a44791cfd9de430ad40bd1689b24%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F09%2Fcharest-veut-etre-aux-communes-rapidement-sil-devient-chef-d019a44791cfd9de430ad40bd1689b24%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fle-budget-quasi-unique-de-chrystia-freeland-880f6de77c5c4e18c6cd4c34d9a78376%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fle-budget-quasi-unique-de-chrystia-freeland-880f6de77c5c4e18c6cd4c34d9a78376%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fle-budget-quasi-unique-de-chrystia-freeland-880f6de77c5c4e18c6cd4c34d9a78376%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fbudget-federal-une-victoire-pour-le-monde-municipal-selon-la-fcm-a48f5ae68132d80bbc2cf8baa602d5eb%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fbudget-federal-une-victoire-pour-le-monde-municipal-selon-la-fcm-a48f5ae68132d80bbc2cf8baa602d5eb%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fbudget-federal-une-victoire-pour-le-monde-municipal-selon-la-fcm-a48f5ae68132d80bbc2cf8baa602d5eb%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/follow?screen_name=JulienPaquette

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2F600-000-en-fonds-provinciaux-pour-une-entreprise-basee-a-ottawa-a5158ab75fa9af06ee18d0457318fc35%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2F600-000-en-fonds-provinciaux-pour-une-entreprise-basee-a-ottawa-a5158ab75fa9af06ee18d0457318fc35%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2F600-000-en-fonds-provinciaux-pour-une-entreprise-basee-a-ottawa-a5158ab75fa9af06ee18d0457318fc35%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fmccann-confirme-quelle-ne-se-representera-pas-f8111f3489755e5d32dce82d4e306431%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fmccann-confirme-quelle-ne-se-representera-pas-f8111f3489755e5d32dce82d4e306431%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fmccann-confirme-quelle-ne-se-representera-pas-f8111f3489755e5d32dce82d4e306431%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fbudget-federal-decevant-et-plutot-inadequat-selon-action-climat-outaouais-f6eb56bd594a8fd790de7ee68a0b91a3%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fbudget-federal-decevant-et-plutot-inadequat-selon-action-climat-outaouais-f6eb56bd594a8fd790de7ee68a0b91a3%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fbudget-federal-decevant-et-plutot-inadequat-selon-action-climat-outaouais-f6eb56bd594a8fd790de7ee68a0b91a3%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fle-travail-en-arriere-plan-est-en-cours-dit-mackinnon-76afe9afa3064d7ee8e53bbbcc6f83b1%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dfacebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fle-travail-en-arriere-plan-est-en-cours-dit-mackinnon-76afe9afa3064d7ee8e53bbbcc6f83b1%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dtwitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F08%2Fle-travail-en-arriere-plan-est-en-cours-dit-mackinnon-76afe9afa3064d7ee8e53bbbcc6f83b1%3Futm_campaign%3Dledroit%26utm_medium%3Darticle_share%26utm_source%3Dlinkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/follow?screen_name=DLeBlanc_LD

Search URL Search Domain Scan URL

URL: https://www.facebook.com/LeDroitca

Search URL Search Domain Scan URL

URL: https://twitter.com/LeDroitca

Search URL Search Domain Scan URL

URL: https://www.instagram.com/photoledroit

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/ledroit

Search URL Search Domain Scan URL

URL: http://www.monsamedi.com/faq/
Title: Foire aux questions

Search URL Search Domain Scan URL

URL: https://jeuxdesprit.ca/fr/
Title: Jeux d'esprit

Search URL Search Domain Scan URL

URL: https://necrologie.cn2i.ca/ld
Title: Avis de décès

Search URL Search Domain Scan URL

URL: http://zonecarriere.ca/
Title: ZoneCarriere.ca

Search URL Search Domain Scan URL

URL: https://zonecarriere.ca/lescoops
Title: Nos emplois

Search URL Search Domain Scan URL

URL: https://www.lesoleil.com/7b7b7ece97155b017112828b3ca059c3
Title: Registre des publicités électorales

Search URL Search Domain Scan URL

URL: http://www.omerlo.com/
Title: Omerlo

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/g2Y77vHr89 Page URL
https://www.ledroit.com/actualite/politique/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?utm_source=dlvr.it&utm_medium=twitter HTTP 301
https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31

https://secure.adnxs.com/seg?add=10369601&t=1&_=1650316925995 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D10369601%26t%3D1%26_%3D1650316925995

Request Chain 71

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=123456&endpoint=us-west HTTP 301
https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west

Request Chain 72

https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fsa%3D%5Bsas_uid%5D HTTP 302
https://sync.smartadserver.com/getuid?url=https://sb.freeskreen.com/um?sa=[sas_uid]&cklb=1

Request Chain 73

https://scm.publishers.tremorhub.com/pubsync?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D HTTP 302
https://scm.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D

Request Chain 74

https://cs.admanmedia.com/sync/smaato?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fac%3D{$UID} HTTP 302
https://sb.freeskreen.com/um?ac={$UID}

147 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 g2Y77vHr89
t.co/ 741 B
642 B 161ms
146ms Document
text/html 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/g2Y77vHr89

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 309
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 21:22:02 GMT
expires: Mon, 18 Apr 2022 21:27:02 GMT
server: tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: d40f04c269ab3887c6d037470d2fb780b296178fcdb8f8a2824539d55f874e6f
x-response-time: 139
x-xss-protection: 0

GET
H2

200

Primary Request une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34 Show response
www.ledroit.com/2022/04/17/
Redirect Chain

https://www.ledroit.com/actualite/politique/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?utm_source=dlvr.it&utm_medium=twitter
https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

107 KB
21 KB

636ms
635ms

Document
text/html

2600:9000:214f:400:1d:9f81:51c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Requested by: Host: t.co
URL: https://t.co/g2Y77vHr89
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:400:1d:9f81:51c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 / Express Express
Resource Hash: 795411f11055d7678ddda584e70494c28e506a4de9a9444045741a99c5ba5bea

Request headers

Referer: https://t.co/g2Y77vHr89
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 21:22:03 GMT
server: nginx/1.18.0
vary: Accept-Encoding
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
x-amz-cf-id: -DmEkpWlP4lhj84oOuwTdsjHAyulX1B2w85sBYEQJbK5SclU_U5QAQ==
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
x-fastboot-path: /2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34
x-powered-by: Express Express

Redirect headers

cache-control: max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 21:22:03 GMT
location: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
server: nginx/1.18.0
vary: Accept-Encoding
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
x-amz-cf-id: lm1CQ1u6srvYk8gtHZfK5cEK19SDfSdY8w7i8uk1CNECKaq16psETw==
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
x-fastboot-path: /actualite/politique/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34
x-powered-by: Express Express

GET
H2 200 css
fonts.googleapis.com/ 13 KB
1 KB 39ms
17ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Volkhov:400,400i,700,700i|Work+Sans:400,500,600,700|Open+Sans:400,600,700

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

33409666cfa50a4190ab5ad64c4dbec668dd90226908ab4c898e1a34583d9fae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 18 Apr 2022 21:22:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 18 Apr 2022 21:22:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Apr 2022 21:22:03 GMT

GET
H2 200 vendor-28af8159f07dcc477d43d0424c21cad7.css
gcm-production2.omerloclients.com/assets/ 74 KB
14 KB 107ms
40ms Stylesheet
text/css 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gcm-production2.omerloclients.com/assets/vendor-28af8159f07dcc477d43d0424c21cad7.css
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: dc7a8eb4fbb940aafff5ffd4a09c4e4e2bc84de5738354f1914e8d91e87cad94

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 04:36:05 GMT
content-encoding: gzip
etag: W/"128ec-17d4c885792"
last-modified: Tue, 23 Nov 2021 11:22:23 GMT
server: nginx/1.18.0
age: 12588358
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css; charset=UTF-8
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: 32q4g86OAh1rRfEv2bqi8xjkJuqTVEZ-5P2ylhLP8cbuV8MtHEBzRg==

GET
H2 200 gcm-812b771098a82a5fc69d7c580758d6a7.css
gcm-production2.omerloclients.com/assets/ 122 KB
20 KB 109ms
42ms Stylesheet
text/css 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gcm-production2.omerloclients.com/assets/gcm-812b771098a82a5fc69d7c580758d6a7.css
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: 3d4d62f3b219f0bf8e1a4f667501c6a8e2c9060c6f49bc2dc9e70fb23733674a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 18:06:33 GMT
content-encoding: gzip
etag: W/"1e641-17e45291647"
last-modified: Mon, 10 Jan 2022 18:03:47 GMT
server: nginx/1.18.0
age: 8478930
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css; charset=UTF-8
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: VsMDYkVV-RiBTEdmtFQK2O9WXAmbjDjsjIx09VmbGY9PedghDDaTTA==

GET
H2 200 coop-logo-df9a1385e5da4d9d4501d27d07f56fc3.svg
gcm-production2.omerloclients.com/assets/images/ 5 KB
2 KB 108ms
106ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/coop-logo-df9a1385e5da4d9d4501d27d07f56fc3.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: a9f52ff38b671059aaf2f8f95b7b15a14ec9c5ebbe68163c572d72787d7ffa15

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 19:50:06 GMT
content-encoding: gzip
etag: W/"12d3-17bbc6ffeb2"
last-modified: Mon, 06 Sep 2021 18:47:41 GMT
server: nginx/1.18.0
age: 19359118
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: VQLoIMbKGVQFqHsXmlINQm0lr5oy8ZKMLm2PW1yBLSt5uxrLf1smvg==

GET
H2 200 img-logo-lesoleil-58b9b973b021d2739e18eea6fd81ac59.svg
gcm-production2.omerloclients.com/assets/images/sites/ 6 KB
2 KB 108ms
107ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/sites/img-logo-lesoleil-58b9b973b021d2739e18eea6fd81ac59.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: 572848c8c30c46020959ee57e4e945b9525619ee1496c0250a3164a6976b5101

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 11 Jul 2021 00:47:07 GMT
content-encoding: gzip
etag: W/"1650-17a901a9eea"
last-modified: Sat, 10 Jul 2021 11:08:21 GMT
server: nginx/1.18.0
age: 24352497
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: tR4vnZRUNsPRg_QheaQHPcTFEgGas3uCKixeWwXF6B08IDu1-L898A==

GET
H2 200 img-logo-lenouvelliste-01c7f7010aa5dc051b3c34b5aaea17fc.svg
gcm-production2.omerloclients.com/assets/images/sites/ 7 KB
3 KB 109ms
107ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/sites/img-logo-lenouvelliste-01c7f7010aa5dc051b3c34b5aaea17fc.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: c38398144d1be0acf7b2200b31f6ecdf4f89f2f6550f89a7886c2ce9c17b0287

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 01:02:11 GMT
content-encoding: gzip
etag: W/"1bfe-17acd537ab5"
last-modified: Thu, 22 Jul 2021 08:27:18 GMT
server: nginx/1.18.0
age: 23141992
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: z71A8aMsqF271UmmWbC60MwpfOWv18qGkiCDfUyG4pQ-WjRQ0EA8xw==

GET
H2 200 img-logo-ledroit-b9a581ca6b6f8487ec51bd37d839bad9.svg
gcm-production2.omerloclients.com/assets/images/sites/ 5 KB
2 KB 112ms
110ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/sites/img-logo-ledroit-b9a581ca6b6f8487ec51bd37d839bad9.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: da741b0c80dfaf7527a9e787d8a0a6ab3a1c35b2b6e696979744287f8b34c62c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 14:54:40 GMT
content-encoding: gzip
etag: W/"158d-17c4a3cc3b3"
last-modified: Mon, 04 Oct 2021 07:37:48 GMT
server: nginx/1.18.0
age: 16957643
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: e0N6Kxp_g0A7PkfTf0CJUGWjprFPU9p6KaMJnOoc9bdUMK_MQ_wOZQ==

GET
H2 200 img-logo-lequotidien-c669f875f82835c27a416201322cbd8f.svg
gcm-production2.omerloclients.com/assets/images/sites/ 7 KB
3 KB 109ms
107ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/sites/img-logo-lequotidien-c669f875f82835c27a416201322cbd8f.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: 44ea0066992762110b18880e58f968fa5dc3af9a051c057a5e689bed7d47158d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 30 Aug 2021 04:37:00 GMT
content-encoding: gzip
etag: W/"1bd1-17b7c357f08"
last-modified: Wed, 25 Aug 2021 07:28:05 GMT
server: nginx/1.18.0
age: 20018704
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: fV5R8VEsRDUrxCNAiHVcK2oNlygDXDruEW0qvr4bmNwJjbO5H39_HA==

GET
H2 200 img-logo-latribune-48da3f5a325b8d303ce470ff85ceeb02.svg
gcm-production2.omerloclients.com/assets/images/sites/ 6 KB
3 KB 109ms
108ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/sites/img-logo-latribune-48da3f5a325b8d303ce470ff85ceeb02.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: ec98c39f5c2d07120b2958675d626739610d6f8759a923a08b3392043d30f095

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 18:45:01 GMT
content-encoding: gzip
etag: W/"19f6-17f22146534"
last-modified: Tue, 22 Feb 2022 15:37:16 GMT
server: nginx/1.18.0
age: 4761423
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: ylRTK_48fBVvq6O5NsvrVEGTh9FUDBENYKRpmeg-xxGt08MfooVlgg==

GET
H2 200 img-logo-lavoixdelest-9cc995367a9139c0ee90098a7de975f9.svg
gcm-production2.omerloclients.com/assets/images/sites/ 7 KB
3 KB 110ms
108ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/sites/img-logo-lavoixdelest-9cc995367a9139c0ee90098a7de975f9.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: b369199a64f2c100cfba46ea9b4bdfc807bd7a164307905edfcdd381f06d0526

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 11:14:56 GMT
content-encoding: gzip
etag: W/"1d9f-17ef798d17d"
last-modified: Mon, 14 Feb 2022 09:38:14 GMT
server: nginx/1.18.0
age: 5479628
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: Kyl4ZYfK31gS-hbxdOaZtaZo-utKHUAGSzIK47Dn1AGZbc4wvmO0tQ==

GET
H2 200 img-logo-ledroit-color-8b4280867da4a9f37fe88029fe1d3db5.svg
gcm-production2.omerloclients.com/assets/images/sites/ 5 KB
2 KB 111ms
109ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/sites/img-logo-ledroit-color-8b4280867da4a9f37fe88029fe1d3db5.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: e01e3921f9c95b2a9da10cb7d7078ac7c3c88f8aa3593d1a6065d94099fc36cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sat, 13 Nov 2021 23:21:52 GMT
content-encoding: gzip
etag: W/"1580-17d15d1d07d"
last-modified: Fri, 12 Nov 2021 20:23:31 GMT
server: nginx/1.18.0
age: 13471212
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: F1O3UGwCYgXX5hrGmuRzx6JRd0aQ6TRGUHWcEp5lSiK4s451ZNkSow==

GET
H2 200 img-logo-ledroitfranco-color-3ec9f6d85335dd0c69fa8da889217350.svg
gcm-production2.omerloclients.com/assets/images/sites/ 5 KB
3 KB 110ms
109ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/sites/img-logo-ledroitfranco-color-3ec9f6d85335dd0c69fa8da889217350.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: 5f568a73a759604b2536eda238e24f0ad77106be5c946c3babfd67e83bf67739

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 01:12:17 GMT
content-encoding: gzip
etag: W/"15f0-17c7049aee4"
last-modified: Mon, 11 Oct 2021 16:57:29 GMT
server: nginx/1.18.0
age: 16315787
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: GjKV4ZwWFdPzd_egYTZ0Pu_p2q_IcwspgYAJe3rwkalQnqpVCDj9ew==

GET
H2 200 polyfill-shared-b88b9ba0dd77cb5a179cf3e1dbfec274.js Show response
gcm-production2.omerloclients.com/assets/ 14 KB
6 KB 108ms
44ms Script
application/javascript 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gcm-production2.omerloclients.com/assets/polyfill-shared-b88b9ba0dd77cb5a179cf3e1dbfec274.js
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: e0c5465f459500c3eacbdf79bde16c8ea7d9881422dd11ac7be5f62b61fa2e16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 05:18:56 GMT
content-encoding: gzip
etag: W/"371c-17d46f700c2"
last-modified: Mon, 22 Nov 2021 09:25:32 GMT
server: nginx/1.18.0
age: 12585787
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: x4_uGt4cdY9kqRe3kxy67MhedqQD87kWylopNi0hq9V52IjJ1iAo0A==

GET
H2 200 polyfill-evergreen-5d35460e29df71f4aefc2033b0532cf8.js Show response
gcm-production2.omerloclients.com/assets/ 275 B
665 B 134ms
70ms Script
application/javascript 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gcm-production2.omerloclients.com/assets/polyfill-evergreen-5d35460e29df71f4aefc2033b0532cf8.js
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: e08b0ff7f2bb5dee049a32dab138af86d7eb7a613c98f61cf08eb703ebc5908e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 20:51:02 GMT
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
etag: W/"113-17c0f4332f6"
last-modified: Wed, 22 Sep 2021 20:47:14 GMT
server: nginx/1.18.0
age: 17973061
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
content-length: 275
x-amz-cf-id: f0DPF5ivj3OBODd6J7lXKDU7dqUP5T4DzasYOwcs21IpopNypDJ7hQ==

GET
H2 200 vendor-d06260cb0611cf721d8848baa7d70649.js Show response
gcm-production2.omerloclients.com/assets/ 3 MB
559 KB 133ms
70ms Script
application/javascript 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: b102fc918f837700d56d7582ee5e8d1ab8e5b85d072cc4a245c4e81174a3e99e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 15:24:11 GMT
content-encoding: gzip
etag: W/"33874a-17f8904813b"
last-modified: Mon, 14 Mar 2022 15:20:48 GMT
server: nginx/1.18.0
age: 3045472
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: luzCZcCT7vbxyMypaoTuGRh3CZuKBcOIklMQVJ8WiAh4LTY-WXl66g==

GET
H2 200 gcm-cf94cdba30fe416e11754f25d5939190.js Show response
gcm-production2.omerloclients.com/assets/ 1 MB
141 KB 137ms
74ms Script
application/javascript 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gcm-production2.omerloclients.com/assets/gcm-cf94cdba30fe416e11754f25d5939190.js
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: 25cbc8a8357f893fe7ee7d5d12b33daccd8f3244b86efb92575051cba51f655d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 15:32:37 GMT
content-encoding: gzip
etag: W/"105527-17f89041e84"
last-modified: Mon, 14 Mar 2022 15:20:22 GMT
server: nginx/1.18.0
age: 3044966
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
x-amz-cf-id: sCsq7RnP9N8PvPY1UD4Fwnid0Xk3P6AI1nBRixOWoa6k8-8QMhDajw==

GET
H2 200 madops.js Show response
rdc.m32.media/ 56 KB
16 KB 156ms
116ms Script
application/javascript 35.227.246.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rdc.m32.media/madops.js
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.246.163 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 163.246.227.35.bc.googleusercontent.com
Software: nginx/1.10.3 /
Resource Hash: 48314bca6a877c6ca70c34c4bd60020b3074cc017979239086489a16d1cee26b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:04 GMT
content-encoding: gzip
last-modified: Fri, 15 Apr 2022 18:41:15 GMT
server: nginx/1.10.3
etag: W/"6259bc4b-df7f"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=900, public
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google
expires: Mon, 18 Apr 2022 21:37:04 GMT

GET
H2 200 swg-gaa.js Show response
news.google.com/swg/js/v1/ 65 KB
17 KB 45ms
16ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg-gaa.js

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf604a2452aa95b02d12e3d2873cd1847fdc1508234277f42788e84b93dafe83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 20:48:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2024
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17265
x-xss-protection: 0
last-modified: Wed, 13 Apr 2022 19:24:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/javascript
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Mon, 18 Apr 2022 21:38:19 GMT

GET
H2 200 swg.js Show response
news.google.com/swg/js/v1/ 145 KB
45 KB 38ms
9ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg.js

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

420cf4b339a69a9a3ffafbebd48db71dcdaf2ce3f74cadc2351ebc899e9b5f46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 20:36:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45620
x-xss-protection: 0
last-modified: Wed, 13 Apr 2022 19:24:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/javascript
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Mon, 18 Apr 2022 21:26:27 GMT

GET
H2 200 platform.js Show response
apis.google.com/js/ 52 KB
21 KB 39ms
17ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da1240738eef80e8630a5749b9258e33d7669859ba8a5ed1da81978092ed03af

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20361
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
date: Mon, 18 Apr 2022 21:22:03 GMT
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "2cdff035295781be"
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 18 Apr 2022 21:22:03 GMT

GET
H2 200 bg-container-d7a130296c43dbdfbabcf81949969a84.png
gcm-production2.omerloclients.com/assets/images/ 218 B
578 B 47ms
46ms Image
image/png 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/bg-container-d7a130296c43dbdfbabcf81949969a84.png
Requested by: Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/gcm-812b771098a82a5fc69d7c580758d6a7.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: 157f9a1d6165ed3c8d9a331da4ff096ee0acef49d0e87bbcdcffe69b1c4031d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gcm-production2.omerloclients.com/assets/gcm-812b771098a82a5fc69d7c580758d6a7.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 07:07:21 GMT
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
etag: W/"da-17e05f1be36"
last-modified: Wed, 29 Dec 2021 11:27:16 GMT
server: nginx/1.18.0
age: 9382483
x-powered-by: Express
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
content-length: 218
x-amz-cf-id: 3YPHaG5HzOVhHMxurm-RucP34TWbaUF0Pq-R-z2to_RpQ5pl8xILeg==

GET
H2 200 SlGQmQieoJcKemNecTUEhQ.woff2
fonts.gstatic.com/s/volkhov/v15/ 27 KB
27 KB 195ms
10ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/volkhov/v15/SlGQmQieoJcKemNecTUEhQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Volkhov:400,400i,700,700i|Work+Sans:400,500,600,700|Open+Sans:400,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

772fa5a279ecad537bea7d71690183408a9aff38f71a094a2dff5698c724d9f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.ledroit.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 23:30:38 GMT
x-content-type-options: nosniff
age: 597086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27436
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 19:36:56 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 11 Apr 2023 23:30:38 GMT

GET
H2 200 QGYsz_wNahGAdqQ43Rh_fKDp.woff2
fonts.gstatic.com/s/worksans/v16/ 47 KB
47 KB 202ms
18ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/worksans/v16/QGYsz_wNahGAdqQ43Rh_fKDp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Volkhov:400,400i,700,700i|Work+Sans:400,500,600,700|Open+Sans:400,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

481b2fb6ea4f714f9b58e143ddb63f973e0fc1b14a4d8213517b4451644c9fae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.ledroit.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sat, 16 Apr 2022 13:16:20 GMT
x-content-type-options: nosniff
age: 201944
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48480
x-xss-protection: 0
last-modified: Thu, 03 Feb 2022 00:24:58 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sun, 16 Apr 2023 13:16:20 GMT

GET
H2 200 SlGVmQieoJcKemNeeY4hkHNSbQ.woff2
fonts.gstatic.com/s/volkhov/v15/ 26 KB
27 KB 214ms
31ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/volkhov/v15/SlGVmQieoJcKemNeeY4hkHNSbQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Volkhov:400,400i,700,700i|Work+Sans:400,500,600,700|Open+Sans:400,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6659edd30afbce2323bb2b3443be4e8a5258d1260d0e68fd99df4d828f0ff718

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.ledroit.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 23:39:30 GMT
x-content-type-options: nosniff
age: 596554
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27036
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 19:37:10 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 11 Apr 2023 23:39:30 GMT

GET
H2 200 resize
images.omerlocdn.com/ 38 KB
39 KB 188ms
47ms Image
image/webp 18.64.103.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.omerlocdn.com/resize?url=https%3A%2F%2Fgcm.omerlocdn.com%2Fproduction%2Fglobal%2Ffiles%2Fimage%2F09902be2-1059-47ad-84dc-51a333c88493.jpg&width=1024&type=webp&stripmeta=true
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-110.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: f014ab6831432be7cd3c191b88d6d3b4c1a05ba510620d0f202e02c59a016726

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 16:09:17 GMT
via: 1.1 759fdd9f923ecbc08bad5c12c5d4db9a.cloudfront.net (CloudFront)
server: nginx/1.18.0
age: 18767
x-ratelimit-remaining: 100
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, s-maxage=31536000, max-age=31536000, no-transform
x-ratelimit-reset: 1
x-ratelimit-limit: 101
x-amz-cf-pop: TXL50-P3
content-length: 39166
x-amz-cf-id: d6L_t_J9XSGL5d46dNq8CXfFif5JUMw2jvW2-_EH92VJQQNRaVjgCw==
expires: Tue, 18 Apr 2023 16:09:16 GMT

GET sw.js
www.ledroit.com/ Frame 0
0

GET
H3 200 custom.json Show response
rdc.m32.media/adops/custom_files/ledroit.com/ 3 KB
951 B 125ms
115ms XHR
application/json 35.227.246.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rdc.m32.media/adops/custom_files/ledroit.com/custom.json
Requested by: Host: rdc.m32.media
URL: https://rdc.m32.media/madops.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.246.163 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 163.246.227.35.bc.googleusercontent.com
Software: nginx/1.10.3 /
Resource Hash: 1e01d95c9ba9e43f07e3d172273596cb1bea22ac4684cdafbc3c92d1158e6173

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:04 GMT
content-encoding: gzip
last-modified: Mon, 18 Apr 2022 10:43:41 GMT
server: nginx/1.10.3
etag: W/"625d40dd-abd"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=900
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google
expires: Mon, 18 Apr 2022 21:37:04 GMT

GET
H2 200 swg-button.css
news.google.com/swg/js/v1/ 21 KB
22 KB 9ms
9ms Stylesheet
text/css 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg-button.css

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bde06a0400c168573473e2de967d842eec383f2f755aef4ec017b2f333e7ff85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 20:47:57 GMT
x-content-type-options: nosniff
age: 2047
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21972
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 22:09:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Mon, 18 Apr 2022 21:37:57 GMT

GET
H3 200 loader.svg
news.google.com/swg/js/v1/ 0
1 KB 10ms
7ms Other
image/svg+xml 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/loader.svg

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:10:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 715
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1049
x-xss-protection: 0
last-modified: Mon, 16 Mar 2020 18:14:05 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: image/svg+xml
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Mon, 18 Apr 2022 22:00:09 GMT

GET
H3 200 entitlements Show response
news.google.com/swg/_/api/v1/publication/ledroit.com/ 2 B
60 B 84ms
84ms Fetch
application/json 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/_/api/v1/publication/ledroit.com/entitlements

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: text/plain, application/json
Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-allow-origin: https://www.ledroit.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, POST
content-type: application/json; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce Show response
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?add=10369601&t=1&_=1650316925995
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D10369601%26t%3D1%26_%3D1650316925995

0
1015 B

35ms
34ms

Script
application/javascript

185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D10369601%26t%3D1%26_%3D1650316925995

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

HTTP/1.1

Server

185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 18 Apr 2022 21:22:04 GMT
X-Proxy-Origin: 217.64.151.5; 217.64.151.5; 721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 47a0eeb4-a37d-4441-9daf-263ee09a1f30
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 18 Apr 2022 21:22:04 GMT
X-Proxy-Origin: 217.64.151.5; 217.64.151.5; 721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6a1742e7-ef7d-4d68-bf24-6668b9bf47a0
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D10369601%26t%3D1%26_%3D1650316925995
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK freeskreen.min.js Show response
static.freeskreen.com/publisher/2974/ 5 KB
2 KB 37ms
7ms Script
text/javascript 99.86.7.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/publisher/2974/freeskreen.min.js?_=1650316925996
Requested by: Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-29.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2cf1525cae084928cbf6fab1897a82fecb2826bd521ce14fab5e37626f482b14

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: 1AUTf3Wh6.U6e0sClq_xmaY.le1kvPnq
Content-Encoding: gzip
Last-Modified: Tue, 06 Nov 2018 16:29:15 GMT
Server: AmazonS3
Age: 54209
ETag: "ceb2b54e28d5241b199eed3b269154e7"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
Connection: keep-alive
Date: Mon, 18 Apr 2022 06:18:36 GMT
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
Content-Length: 1646
X-Amz-Cf-Id: gVTkGwxgMnRZ_cjVmLRPqfCii5dKuYaPKyK_IuUog6Y3S0TSJgKgPg==

OPTIONS
H2 200 view
analytics360.omerloclients.com/ Frame 0
0 363ms
284ms Preflight
application/json 99.86.7.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics360.omerloclients.com/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-29.fra6.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.ledroit.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Mon, 18 Apr 2022 21:22:05 GMT
via: 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront)
x-amz-apigw-id: Qy5zlFZkIAMFmqw=
x-amz-cf-id: xBshuJ2IW8QzwiMrKfmAwlm8xSc0Bf7o6e_F7DISbo3ziHKsXk8xKw==
x-amz-cf-pop: FRA6-C1
x-amzn-requestid: 09b8a1f5-8fc7-454b-976d-11e9a4ea80fb
x-cache: Miss from cloudfront

GET
H2 200 banner-bg-aadabdd7c953b85a935465a10d47c51c.jpg
gcm-production2.omerloclients.com/assets/images/paywall/ 20 KB
21 KB 23ms
23ms Image
image/jpeg 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/paywall/banner-bg-aadabdd7c953b85a935465a10d47c51c.jpg
Requested by: Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/gcm-812b771098a82a5fc69d7c580758d6a7.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: 604e7027286c010d4f0b64291b51b80b9d4df493077cd40e72c4da0db8580bbd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gcm-production2.omerloclients.com/assets/gcm-812b771098a82a5fc69d7c580758d6a7.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sat, 08 Jan 2022 20:26:44 GMT
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
etag: W/"5166-17e37836f17"
last-modified: Sat, 08 Jan 2022 02:27:47 GMT
server: nginx/1.18.0
age: 8643320
x-powered-by: Express
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
content-length: 20838
x-amz-cf-id: TMGLyGr6FbJkMmeQkGRKxBnEDYGeRteatqNqlRaep1AG5jevNTg6iw==

GET
H2 200 cf2b5b903b414656c2d16992c6bf0c34.json Show response
gcm.omerlocdn.com/production/ledroit/related-contents/ 8 KB
9 KB 463ms
397ms Fetch
application/json 143.204.202.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://gcm.omerlocdn.com/production/ledroit/related-contents/cf2b5b903b414656c2d16992c6bf0c34.json

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.202.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-202-104.fra53.r.cloudfront.net

Software

nginx/1.18.0 /

Resource Hash

7924a05b1d2de788d78a2d540ba2b198247365fc9b033156ef04f70d35df56c6

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src 'self'
via: 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA53-C1
cross-origin-window-policy: deny
x-cache: Miss from cloudfront
content-length: 8512
x-xss-protection: 1; mode=block
x-request-id: Fucaf-nRhpCgA1hBoAsx
server: nginx/1.18.0
x-frame-options: SAMEORIGIN
date: Mon, 18 Apr 2022 21:22:05 GMT
x-download-options: noopen
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-id: fNoMEk7-sDZKLlqSChhP6ts6N9aimkjkzsHQ-p-QltP1yCj-1q1r8Q==

GET
H2 200 popular-news.json Show response
gcm.omerlocdn.com/production/ledroit/ 68 KB
69 KB 91ms
27ms Fetch
application/json 143.204.202.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://gcm.omerlocdn.com/production/ledroit/popular-news.json?media=web

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.202.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-202-104.fra53.r.cloudfront.net

Software

nginx/1.18.0 /

Resource Hash

89f209ffb037889ec3abf5d932c72a34daf9cf2552b5479ea2ae4a3262a347f2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src 'self'
via: 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 548
cross-origin-window-policy: deny
x-cache: Hit from cloudfront
content-length: 70085
x-xss-protection: 1; mode=block
x-request-id: FucaAAkf7Gj9KIJAFrFC
server: nginx/1.18.0
x-frame-options: SAMEORIGIN
date: Mon, 18 Apr 2022 21:12:56 GMT
x-download-options: noopen
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: WpMqm42KJ9aoASLMb5sD77XnYJqMxufminsah-qIMYYueTj8DXOQww==

GET
H2 200 contents.json Show response
gcm.omerlocdn.com/production/global/ 46 KB
46 KB 142ms
80ms Fetch
application/json 143.204.202.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://gcm.omerlocdn.com/production/global/contents.json?nb=30&organizations=ledroit&templates=sponsored&types=article%2Cdossier

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.202.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-202-104.fra53.r.cloudfront.net

Software

nginx/1.18.0 /

Resource Hash

50c76cbf0b66b6b963b703440c8cc1844d2f28981c76b6d295ee37f688a868ad

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src 'self'
via: 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 3282
cross-origin-window-policy: deny
x-cache: Hit from cloudfront
content-length: 46962
x-xss-protection: 1; mode=block
x-request-id: FucXg4hlBQgVt49BavLR
server: nginx/1.18.0
x-frame-options: SAMEORIGIN
date: Mon, 18 Apr 2022 20:27:22 GMT
x-download-options: noopen
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: zE3FscA3A8PHjvxQAx0UPrHUS8ox0a9iOw6FzlPOzsxIsfIPiglhbg==

GET
H2 200 politique.json Show response
gcm.omerlocdn.com/production/ledroit/site/sections/actualites/ 58 KB
59 KB 320ms
261ms Fetch
application/json 143.204.202.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://gcm.omerlocdn.com/production/ledroit/site/sections/actualites/politique.json

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.202.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-202-104.fra53.r.cloudfront.net

Software

nginx/1.18.0 /

Resource Hash

43b5e2e8ff9b11948c8939acda2926718d5a370d6ff8f573768e59d8889f7365

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src 'self'
via: 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA53-C1
cross-origin-window-policy: deny
x-cache: Miss from cloudfront
content-length: 59509
x-xss-protection: 1; mode=block
x-request-id: Fucaf9-aYWzvF1FBoAsh
server: nginx/1.18.0
x-frame-options: SAMEORIGIN
date: Mon, 18 Apr 2022 21:22:05 GMT
x-download-options: noopen
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=900
etag: 7B7B4EE
x-amz-cf-id: decOkUbCqupQkIIIFOQM5QQ7uNTf7iL9lAVxpO_XnyFDt05sdRFSyQ==

GET
H2 200 pages Show response
gcm.omerlocdn.com/production/ledroit/ 122 KB
122 KB 98ms
41ms Fetch
application/json 143.204.202.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://gcm.omerlocdn.com/production/ledroit/pages

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.202.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-202-104.fra53.r.cloudfront.net

Software

nginx/1.18.0 /

Resource Hash

3dca7a8cc4cd9a222e48df3ba166a4d1de7335809caf7f7828856ff1121dbfdc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src 'self'
via: 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 1719
cross-origin-window-policy: deny
x-cache: Hit from cloudfront
content-length: 124523
x-xss-protection: 1; mode=block
x-request-id: FucY73q0l7bzKR5BhRvh
server: nginx/1.18.0
x-frame-options: SAMEORIGIN
date: Mon, 18 Apr 2022 20:53:25 GMT
x-download-options: noopen
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: BsYUeVa5zfIY7X_dQtOTJB7a5LcUcVqyzbOnSz-cxCKJimo1BF91Sw==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 189 KB
59 KB 96ms
44ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MRPMG73

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c8b8aead96faa0bd30b0919c44f88272c72931eaf0c2f612e0af6c04c1442b74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:04 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60268
x-xss-protection: 0
expires: Mon, 18 Apr 2022 21:22:04 GMT

POST
H2 201 view Show response
analytics360.omerloclients.com/ 8 B
387 B 140ms
139ms Fetch
application/json 99.86.7.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics360.omerloclients.com/view
Requested by: Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-29.fra6.r.cloudfront.net
Software: /
Resource Hash: bebe9f7520f45e551824558d8c8291c429a32f508c9a6a42b9bfa91a062e53de

Request headers

Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
X-Api-Key: 556e98ed302e4c53b6bc3ee69ebdd39f
Content-Type: application/json

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
via: 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amzn-requestid: 76ada9a7-015d-4717-970a-cb044366c769
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-amzn-trace-id: Root=1-625dd67d-352635b31dcbf7a0003f6a55;Sampled=0
x-amz-apigw-id: Qy5zmG7VIAMFflA=
content-length: 8
x-amz-cf-id: iwCpbQFNA6cA6gpd0MSWCsB8yetNwFKsO3FXLNQzd__Vky5K2Nt9zw==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 135 KB
37 KB 75ms
21ms Script
application/javascript 65.9.66.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: rdc.m32.media
URL: https://rdc.m32.media/madops.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-173.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 1909b2a83fd41494d94862c4323944d9d0aa1f1e653f252ea5a73fc5944308b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: STlSjRvyyTgJyl_raxUeHIFBn6F5DqB3
content-encoding: gzip
etag: 4abd427e43cd6822329a2c05539e321f
age: 444
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 0FC6XHPBM8Y2Q084422A
date: Mon, 18 Apr 2022 21:15:08 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 3dd91613764eafe7ad199013ce202442.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: dU53XvlheEnzVnUdEwg79MY6drNuonayqwqzN6k5m8-9kiUiB9Vqxw==

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/158605/3479/ 431 KB
132 KB 160ms
59ms Script
text/javascript 2.20.157.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/158605/3479/pwt.js
Requested by: Host: rdc.m32.media
URL: https://rdc.m32.media/madops.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.157.2 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-157-2.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: b24466ed7a923925e6f28faf042fcd599f471659ab395f296a6fa937e02bfd0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: gzip
last-modified: Thu, 07 Apr 2022 20:23:23 GMT
server: Apache/2.2.15 (CentOS)
etag: "1101864-6bd78-5dc163feb892d"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: public, max-age=25133
accept-ranges: bytes
content-type: text/javascript
content-length: 134614
expires: Tue, 19 Apr 2022 04:20:58 GMT

GET
H/1.1 200
OK current Show response
weather.omerloclients.com/ 8 KB
9 KB 126ms
46ms Fetch
application/json 143.204.202.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://weather.omerloclients.com/current?lang=fr&units=metric&lat=45.48&lon=-75.7
Requested by: Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.202.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-20.fra53.r.cloudfront.net
Software: /
Resource Hash: dbc7819de8456d4d52ac1044fde27d205381975ab1186d4e060c4bdbe76367a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 21:02:41 GMT
Via: 1.1 172e63b20fb363ed969de28ae3937e20.cloudfront.net (CloudFront), 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
Connection: keep-alive
Age: 1163
x-amzn-RequestId: f66c20db-e56b-4ccd-b241-191b95097047
X-Cache: Hit from cloudfront
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Amzn-Trace-Id: Root=1-625dd1f0-5ae119a2413841b903acee84;Sampled=0
X-Amz-Cf-Pop: FRA2-C1, FRA53-C1
x-amz-apigw-id: Qy29rF9xoAMFc6w=
Content-Length: 8558
X-Amz-Cf-Id: zSuKZ-61Gv1FK_JIuYbrydW8hLkmkC9e3UWllE_eTwKJyBrT0kVkTQ==

GET
H3 200 serviceiframe Show response
news.google.com/swg/_/ui/v1/ Frame CC50 24 KB
8 KB 94ms
94ms Document
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/_/ui/v1/serviceiframe?_=458421&publicationId=ledroit.com

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cf92a9d2bfbcee32c0fba48b038afc5b47ce13927de8b0003a1f55147d71dbc1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Kd6ObxQAWgS4Jfx2ukbZPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/SubscribewithgoogleClientUi/cspreport;worker-src 'self' script-src 'nonce-Kd6ObxQAWgS4Jfx2ukbZPA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com;report-uri /_/SubscribewithgoogleClientUi/cspreport require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ledroit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-Kd6ObxQAWgS4Jfx2ukbZPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/SubscribewithgoogleClientUi/cspreport;worker-src 'self' script-src 'nonce-Kd6ObxQAWgS4Jfx2ukbZPA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com;report-uri /_/SubscribewithgoogleClientUi/cspreport require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
content-type: text/html; charset=utf-8
cross-origin-resource-policy: same-site
date: Mon, 18 Apr 2022 21:22:04 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 0

GET
H2 200 script.js Show response
sb.freeskreen.com/publisher/ 74 KB
22 KB 161ms
98ms Script
text/html 65.9.7.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.freeskreen.com/publisher/script.js?pid=2974&ut=&uts=&flc=2022&slc=&windowlocation=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&gdpr=-1&cs=-1
Requested by: Host: static.freeskreen.com
URL: https://static.freeskreen.com/publisher/2974/freeskreen.min.js?_=1650316925996
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-81.fra56.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 49475cdade27e3786301ae21734bb175c2f0c39f95ccfe847e4bfd67f15a978b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: gzip
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA56-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
content-type: text/html;charset=UTF-8
content-length: 21454
x-amz-cf-id: yLjShp3xB8_6YdSzGvaFAzQO3r5lC5eDHHJtIv7UNMOgbHy9PYZI-w==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 103ms
30ms XHR
application/javascript 65.9.66.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-173.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: khsXo6Z3HSo5bHNWbmb1eMp88IHhxPc.
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 54482
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 17 Mar 2022 02:21:48 GMT
server: AmazonS3
date: Mon, 18 Apr 2022 06:14:04 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: V8jTbrTc34jBC6xGwmPRusg1fHCOds7Jofp5k0x-G1S-75m8a9q8Vw==

GET
H3 200 SlGSmQieoJcKemNecTA0h1R3.woff2
fonts.gstatic.com/s/volkhov/v15/ 22 KB
22 KB 68ms
28ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/volkhov/v15/SlGSmQieoJcKemNecTA0h1R3.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Volkhov:400,400i,700,700i|Work+Sans:400,500,600,700|Open+Sans:400,600,700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95056cde8fc60350eece66c30a6b3926915d469ad7f55ab883d8d3ca033f0f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.ledroit.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 03:46:46 GMT
x-content-type-options: nosniff
age: 581719
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22768
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 19:36:57 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 12 Apr 2023 03:46:46 GMT

GET
H2 200 resize
images.omerlocdn.com/ 26 KB
27 KB 576ms
574ms Image
image/webp 18.64.103.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.omerlocdn.com/resize?url=https%3A%2F%2Fgcm.omerlocdn.com%2Fproduction%2Fglobal%2Ffiles%2Fimage%2Fd71add40-e094-40c5-9247-b0d9cd9248b5.jpg&width=1024&type=webp&stripmeta=true
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-110.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 88263f60a48193f8879859651977b828a72f0d25334b1e8ddafb2b38819cf9df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
via: 1.1 759fdd9f923ecbc08bad5c12c5d4db9a.cloudfront.net (CloudFront)
server: nginx/1.18.0
x-amz-cf-pop: TXL50-P3
x-ratelimit-remaining: 99
x-cache: Miss from cloudfront
content-type: image/webp
cache-control: public, s-maxage=31536000, max-age=31536000, no-transform
x-ratelimit-reset: 1
x-ratelimit-limit: 101
content-length: 26976
x-amz-cf-id: PDjrNGSNuAthVzOon4V2mSRUvzRqL2Wr5y1XcGWOBhekSTJZzzrY6g==
expires: Tue, 18 Apr 2023 21:22:05 GMT

GET
H2 200 resize
images.omerlocdn.com/ 15 KB
15 KB 428ms
426ms Image
image/webp 18.64.103.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.omerlocdn.com/resize?url=https%3A%2F%2Fgcm.omerlocdn.com%2Fproduction%2Fglobal%2Ffiles%2Fimage%2Fdf89dde1-370c-4fa7-8fdf-7c1eeef126cf.png&width=1024&type=webp&stripmeta=true
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-110.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: febdd4373f6f38affcc19d9886b479c6786e09116e1adad54fcf017d6baa4bf7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
via: 1.1 759fdd9f923ecbc08bad5c12c5d4db9a.cloudfront.net (CloudFront)
server: nginx/1.18.0
x-amz-cf-pop: TXL50-P3
x-ratelimit-remaining: 99
x-cache: Miss from cloudfront
content-type: image/webp
cache-control: public, s-maxage=31536000, max-age=31536000, no-transform
x-ratelimit-reset: 1
x-ratelimit-limit: 101
content-length: 15096
x-amz-cf-id: YMNPFpxIc5tS2a4tVPTLe3mNM2LlwY0NGMu4rTpCuHws0N63TAu_Ug==
expires: Tue, 18 Apr 2023 21:22:05 GMT

GET
H2 200 resize
images.omerlocdn.com/ 21 KB
22 KB 1230ms
1229ms Image
image/webp 18.64.103.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.omerlocdn.com/resize?url=https%3A%2F%2Fgcm.omerlocdn.com%2Fproduction%2Fglobal%2Ffiles%2Fimage%2F957ae1e7-8905-433d-9c32-f26e9c568eb0.jpg&width=1024&type=webp&stripmeta=true
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-110.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 263da84a32afd389f713d15d164746917e4f90f7a79a74b1c5dd9093fcda9802

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
via: 1.1 759fdd9f923ecbc08bad5c12c5d4db9a.cloudfront.net (CloudFront)
server: nginx/1.18.0
x-amz-cf-pop: TXL50-P3
x-ratelimit-remaining: 98
x-cache: Miss from cloudfront
content-type: image/webp
cache-control: public, s-maxage=31536000, max-age=31536000, no-transform
x-ratelimit-reset: 1
x-ratelimit-limit: 101
content-length: 21726
x-amz-cf-id: wpuIyyXlJTIS_W8LBLi2YYwKKySSsiUL4nQ2XNofac41km3Gh_x8Tg==
expires: Tue, 18 Apr 2023 21:22:05 GMT

GET
H2 200 resize
images.omerlocdn.com/ 59 KB
59 KB 254ms
254ms Image
image/webp 18.64.103.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.omerlocdn.com/resize?url=https%3A%2F%2Fgcm.omerlocdn.com%2Fproduction%2Fglobal%2Ffiles%2Fimage%2F526b99af-e005-45ac-8799-38080c59ff8d.webp&width=1024&type=webp&stripmeta=true
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-110.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: c9b4308223f2a8ec0f26a5dfb7006c1d4ca0b6cf9e64cf7e44a1037be4aea637

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
via: 1.1 759fdd9f923ecbc08bad5c12c5d4db9a.cloudfront.net (CloudFront)
server: nginx/1.18.0
x-amz-cf-pop: TXL50-P3
x-ratelimit-remaining: 100
x-cache: Miss from cloudfront
content-type: image/webp
cache-control: public, s-maxage=31536000, max-age=31536000, no-transform
x-ratelimit-reset: 1
x-ratelimit-limit: 101
content-length: 60082
x-amz-cf-id: F1Ia4J1ovRsNJsL5EPQjcTAG8XRXXntMd1Q6QB2SCYTyQtTCyXXb4A==
expires: Tue, 18 Apr 2023 21:22:05 GMT

POST
H3 204 cspreport
news.google.com/_/SubscribewithgoogleClientUi/ Frame CC50 0
25 B 54ms
53ms Other
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/_/SubscribewithgoogleClientUi/cspreport

Requested by

Host: t.co
URL: https://t.co/g2Y77vHr89

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zoP+lrtgw1V4hIyhKhczXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/SubscribewithgoogleClientUi/cspreport;worker-src 'self', script-src 'nonce-zoP+lrtgw1V4hIyhKhczXA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com;report-uri /_/SubscribewithgoogleClientUi/cspreport, require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/swg/_/ui/v1/serviceiframe?_=458421&publicationId=ledroit.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/csp-report

Response headers

content-security-policy: script-src 'report-sample' 'nonce-zoP+lrtgw1V4hIyhKhczXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/SubscribewithgoogleClientUi/cspreport;worker-src 'self', script-src 'nonce-zoP+lrtgw1V4hIyhKhczXA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com;report-uri /_/SubscribewithgoogleClientUi/cspreport, require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
x-frame-options: SAMEORIGIN
date: Mon, 18 Apr 2022 21:22:05 GMT
strict-transport-security: max-age=31536000
content-type: text/html; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 swg-button.css
news.google.com/swg/js/v1/ Frame CC50 21 KB
21 KB 28ms
28ms Stylesheet
text/css 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg-button.css

Requested by

Host: news.google.com
URL: https://news.google.com/swg/_/ui/v1/serviceiframe?_=458421&publicationId=ledroit.com

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bde06a0400c168573473e2de967d842eec383f2f755aef4ec017b2f333e7ff85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 20:47:57 GMT
x-content-type-options: nosniff
age: 2048
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21972
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 22:09:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Mon, 18 Apr 2022 21:37:57 GMT

GET
H2 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.de.W3i6d0oNs8w.es5.O/am=GAAQ/d=1/excm=_b,_tp,serviceiframeview/ed=1/dg=0/wt=2/esmo=1/rs=ABXT... Frame CC50 164 KB
58 KB 67ms
15ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.de.W3i6d0oNs8w.es5.O/am=GAAQ/d=1/excm=_b,_tp,serviceiframeview/ed=1/dg=0/wt=2/esmo=1/rs=ABXTjI7eMRXQLmwEFi3dWWXPArfFY9WLUQ/m=_b,_tp

Requested by

Host: news.google.com
URL: https://news.google.com/swg/_/ui/v1/serviceiframe?_=458421&publicationId=ledroit.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acbd1e6f646a6e2f384ab59be7ca23636a4dea5d5969e5f1701df58df52dcf08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 20:01:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4834
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 58759
x-xss-protection: 0
last-modified: Sat, 16 Apr 2022 08:49:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/subscribewithgoogle-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/subscribewithgoogle-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/subscribewithgoogle-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Tue, 18 Apr 2023 20:01:31 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 74ms
31ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MRPMG73

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 3894
date: Mon, 18 Apr 2022 20:17:11 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 18 Apr 2022 22:17:11 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
27 KB 50ms
18ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: t.co
URL: https://t.co/g2Y77vHr89

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

086f1c868f8f769ef0039b238b415fc3c46d97e342309dc8c61cefb40868212e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26311
x-xss-protection: 0
pragma: public
x-fb-debug: dG7sh6hU6BM509aotXHFJCwI8RwmTBtsYBcu1PzenhqXpEf5Xieoc12eLParBknbi4Lv1ZxJsGKzaFBL3bJA7Q==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 18 Apr 2022 21:22:05 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 m32pixel.min.js Show response
rdc.m32.media/ 61 KB
17 KB 138ms
121ms Script
application/javascript 35.227.246.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rdc.m32.media/m32pixel.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MRPMG73
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.246.163 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 163.246.227.35.bc.googleusercontent.com
Software: nginx/1.10.3 /
Resource Hash: 069f695140cae015bfd9f54836c257da65969097a565500f49adb1a262ae6719

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: gzip
last-modified: Mon, 04 Apr 2022 18:37:29 GMT
server: nginx/1.10.3
etag: W/"624b3ae9-f449"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=900
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google
expires: Mon, 18 Apr 2022 21:37:05 GMT

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 69ms
45ms Image
image/gif 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-MRPMG73&cv=134&v=3&t=t&pid=520078330&rv=4d0&es=1&e=gtm.init_consent&eid=1&ut=C&tc=72&z=0

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 81ms
58ms Image
image/gif 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-MRPMG73&cv=134&v=3&t=t&pid=520078330&rv=4d0&es=1&e=gtm.init&eid=7&ut=C&tc=72&z=0

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 103ms
80ms Image
image/gif 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-MRPMG73&cv=134&v=3&t=t&pid=520078330&rv=4d0&es=1&e=gtm.js&eid=13&ut=C&tc=72&tr=1paused.1fsl.1ytl.1sdl.1lcl.1lcl.1lcl.1evl.1html.5html.1html.5html&ti=1paused.1fsl.1ytl.1sdl.1lcl.1lcl.1lcl.1evl.1html.1html.1html.1html&z=0

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 58ms
35ms Image
image/gif 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-MRPMG73&cv=134&v=3&t=t&pid=520078330&rv=4d0&es=1&e=*&eid=21&ut=C&tc=72&tr=1ua.1ua&ti=1ua.1ua&z=0

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 81ms
58ms Image
image/gif 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-MRPMG73&cv=134&v=3&t=t&pid=520078330&rv=4d0&es=1&e=*&eid=29&ut=C&tc=72&tr=1html.5html.1html.5html.1ua.1ua.1paused.1html.1html.5html&ti=1html.1html.1html.1html.1ua.1ua.1paused.1html.1html.1html&z=0

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
66 KB 70ms
49ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FDLYVLLX4S&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MRPMG73

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a6cff6a4a25cbdca73f736e3f7a8917cdb7c36c6c28e9de343a5adaf0ed077d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67145
x-xss-protection: 0
expires: Mon, 18 Apr 2022 21:22:05 GMT

GET
H2 200 get-loader.js Show response
loader.wisepops.com/ 69 KB
22 KB 193ms
75ms Script
text/javascript 2606:4700:20::681a:a13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loader.wisepops.com/get-loader.js?v=1&site=zxkhfvBn4y
Requested by: Host: t.co
URL: https://t.co/g2Y77vHr89
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f22f1472391060bbb0102d2a27bcda6c2daa8db0ea2d2d07459365bc83be932

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 18 Apr 2022 19:57:12 GMT
server: cloudflare
age: 5093
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YCIM6mhx8nkbweSXoim%2FUFmjCSO2uDAfpW7p%2BCwjgAbbSRrI0eQrBEV1Vp2Oq2hBXdh4LkKvD%2B75nMvaF0BtruFX1kWPWfuFxu3WFcbMo%2Bf3xFvvoMWCRoo9WyLNChUtQDKJ%2BjMOYQemfOQxq0RHGvc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
x-cloud-trace-context: 5415b53738caefbbbea0f8168717f81d
cache-control: private, max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6fe0742e9e1e59fb-MXP

GET
H2 200 track.js Show response
assets.customer.io/assets/ 5 KB
2 KB 129ms
12ms Script
application/javascript 2600:9000:2156:cc00:11:9cfd:9400:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.customer.io/assets/track.js
Requested by: Host: t.co
URL: https://t.co/g2Y77vHr89
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:cc00:11:9cfd:9400:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 765618d1667ba791f2d492d121d2da42ff7d7e079a4773462a381ac9aceab0c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 04:28:51 GMT
content-encoding: gzip
last-modified: Thu, 02 Sep 2021 23:16:41 GMT
server: AmazonS3
age: 60812
etag: W/"15e89eedddf82c193d5c3574b756f5a7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 6b4954a8411e7b2a232537f8000c5c9c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: -CeYauysEJ_fNRlmqAtQIZ4WO1Hp0QzAfARFuK6h1GM0z5u6rKABmA==

GET
H2 200 804-7232953549254792e1ea721e15556a84.svg
gcm-production2.omerloclients.com/assets/images/weather/ 607 B
991 B 29ms
29ms Image
image/svg+xml 18.64.103.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcm-production2.omerloclients.com/assets/images/weather/804-7232953549254792e1ea721e15556a84.svg
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-129.txl50.r.cloudfront.net
Software: nginx/1.18.0 / Express
Resource Hash: 49766ee4a4567a624033aba57e2901a33aee7b7c397878313c4946dd6063b4a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 10:07:32 GMT
via: 1.1 b93003f1819566aa6af3b0107cb2ec2a.cloudfront.net (CloudFront)
etag: W/"25f-17ec40430c5"
last-modified: Fri, 04 Feb 2022 09:15:16 GMT
server: nginx/1.18.0
age: 6347673
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: TXL50-P3
accept-ranges: bytes
content-length: 607
x-amz-cf-id: EAGgxqJVzrka0GFRo9pdU-ZYIs_V1AHuTADO7W2axD7vxdWqJxHrOA==

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v28/ 44 KB
44 KB 19ms
19ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v28/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Volkhov:400,400i,700,700i|Work+Sans:400,500,600,700|Open+Sans:400,600,700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.ledroit.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 22:45:30 GMT
x-content-type-options: nosniff
age: 513395
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44656
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 22:03:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Apr 2023 22:45:30 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame CC50 15 KB
15 KB 29ms
28ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: news.google.com
URL: https://news.google.com/swg/_/ui/v1/serviceiframe?_=458421&publicationId=ledroit.com

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
Origin: https://news.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 11:18:05 GMT
x-content-type-options: nosniff
age: 554640
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 12 Apr 2023 11:18:05 GMT

GET
H/1.1 200
OK ac Show response
ww1772.smartadserver.com/ 16 B
320 B 129ms
25ms Script
application/javascript 185.86.137.32
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ww1772.smartadserver.com/ac?pgid=662773&insid=7974420&tmstp=3012001590&out=js
Requested by: Host: sb.freeskreen.com
URL: https://sb.freeskreen.com/publisher/script.js?pid=2974&ut=&uts=&flc=2022&slc=&windowlocation=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&gdpr=-1&cs=-1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.32 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: efded6408c7e64cd48c00b10bdd63b79539c5bb13a396b9f3773f71fe2d5a606

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:04 GMT
content-encoding: br
vary: Accept-Encoding
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
transfer-encoding: chunked
content-type: application/javascript; charset=UTF-8

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 52D8
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=123456&endpoint=us-west
https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west

281 B
554 B

98ms
19ms

Document
text/html

23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Requested by: Host: sb.freeskreen.com
URL: https://sb.freeskreen.com/publisher/script.js?pid=2974&ut=&uts=&flc=2022&slc=&windowlocation=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&gdpr=-1&cs=-1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.ledroit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 18 Apr 2022 21:22:05 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 18 Apr 2022 21:22:05 GMT
location: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
server: AkamaiGHost

GET
H/1.1

200
OK

getuid
sync.smartadserver.com/
Redirect Chain

https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fsa%3D%5Bsas_uid%5D
https://sync.smartadserver.com/getuid?url=https://sb.freeskreen.com/um?sa=[sas_uid]&cklb=1

0
75 B

25ms
25ms

Image
text/plain

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.smartadserver.com/getuid?url=https://sb.freeskreen.com/um?sa=[sas_uid]&cklb=1
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: HTTP/1.1
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:04 GMT
content-length: 0

Redirect headers

location: https://sync.smartadserver.com:443/getuid?url=https://sb.freeskreen.com/um?sa=[sas_uid]&cklb=1
pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2

200

verify
scm.publishers.tremorhub.com/pubsync/
Redirect Chain

https://scm.publishers.tremorhub.com/pubsync?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D
https://scm.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D

43 B
182 B

92ms
92ms

Image
image/gif

2600:1f18:612b:4264:35be:ace0:b22e:18d9
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scm.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Server: 2600:1f18:612b:4264:35be:ace0:b22e:18d9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

Redirect headers

location: pubsync/verify?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D
date: Mon, 18 Apr 2022 21:22:05 GMT
server: Apache-Coyote/1.1
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'

GET
H2

200

um
sb.freeskreen.com/
Redirect Chain

https://cs.admanmedia.com/sync/smaato?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fac%3D{$UID}
https://sb.freeskreen.com/um?ac={$UID}

43 B
581 B

58ms
57ms

Image
image/gif

65.9.7.81
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/um?ac={$UID}
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Server: 65.9.7.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-81.fra56.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: alod7_89ItLqYDX_BC-wVwk4RZUBQ82BFg2_oiEgePf1QkEIz4pYUg==
expires: -1

Redirect headers

Location: https://sb.freeskreen.com/um?ac={$UID}
Date: Mon, 18 Apr 2022 21:22:05 GMT
Transfer-Encoding: chunked
Server: nginx
Connection: keep-alive
X-Frame-Options: DENY
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload

GET
H2 204 /
loadeu.exelator.com/load/ 0
324 B 172ms
29ms Image
text/plain 34.254.143.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadeu.exelator.com/load/?p=204&g=1300&j=0
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.143.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-143-3.eu-west-1.compute.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ Frame 8B79 90 KB
91 KB 48ms
19ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Host: t.co
URL: https://t.co/g2Y77vHr89

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 14 Apr 2022 14:56:48 GMT
x-content-type-options: nosniff
age: 368717
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92629
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 14 Apr 2023 14:56:48 GMT

GET
H/1.1 200
OK fsk.css
static.freeskreen.com/css/20210107205009/default/ Frame 8B79 50 KB
29 KB 13ms
13ms Stylesheet
text/css 99.86.7.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/css/20210107205009/default/fsk.css
Requested by: Host: t.co
URL: https://t.co/g2Y77vHr89
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-29.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31ace63fa339896dc045f21da77b1ffdc57160e2db5690b132766b0086d6f58e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: 5DtU9pV9aPv90d5PMlXs6Og9O1cWT0Fu
Content-Encoding: gzip
ETag: "ba07184144408ada0c1691c69221a457"
Age: 64554
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 28958
Last-Modified: Thu, 07 Jan 2021 20:54:53 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1610052891/ctime:1610052892/gid:497/gname:jenkins/md5:ba07184144408ada0c1691c69221a457/mode:33188/mtime:1610052892/uid:498/uname:jenkins
Date: Mon, 18 Apr 2022 03:26:11 GMT
Content-Type: text/css
Via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: _r93FyjNObp8zNZcHVwlXOBHwEjnbjzI5QGgQJWjz7-xwA1T7IjCqQ==

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 4457 43 B
414 B 40ms
40ms Image
image/gif 65.9.7.81
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1650316926&p=2974&c=5321&ttm=1650316925013&s=&d=&v=&t=736a16a6-c5ea-4217-9a50-60f5e91d8087&co=SE&pr=SE-AB&ci=Stockholm&dm=null&flc=2022&slc=&e=AdOpened&m=2&x=null
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-81.fra56.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: YxSKLKwU_WH0niXfHiMz7dMAFSQVN48xjdDJp5EfziRbyvYfaT0WHw==
expires: -1

GET
H3 200 1602700049765366 Show response
connect.facebook.net/signals/config/ 307 KB
87 KB 178ms
156ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1602700049765366?v=2.9.57&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

932c3bd5606d810f7ff508764492b66584d34ad69c6df8d5584b215634c072c7

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: nlt7WEiOWf18GLsUIP9VL+/dsaT/SxmCtjYusp9B7CXXm2Intj4YJ6mcBu/X+CouUE1yneABi3AxggK4ZBQnIg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 18 Apr 2022 21:22:05 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 57ms
23ms XHR
application/json 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20220418

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

88816b4e9d2b1e7455a8edb3b081950d1be6c35f4da7af91a166b9c9a8f1edb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 22867
x-jsd-version: 1.0.1315
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19173-FRA, cache-iad-kiad7000173-IAD
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"66a-wQwi4smevNnXCt7tNKOGzazdc+4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mdzFWlUCYjzg%2BHUh5ur7B4hP7iuarvwnY4JdcM9qwQ8L95JeKZWdnZXVyjoxEDD%2BCq4x%2F8DOcHQJxERtkOI566fHU4N%2BJDhS4r11uKXS4pBn5BFuHDtBOLdhyj9%2FAHpDD1%2BFxEdNOcYJgYRj2eY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6fe0742f5a71cc36-ZRH
access-control-expose-headers: *

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 83 KB
29 KB 45ms
18ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: rdc.m32.media
URL: https://rdc.m32.media/madops.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

sffe /

Resource Hash

6c3664d624873d5ce0348175782a4250165ec1a540b31d84ce1180b172ef14ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28600
x-xss-protection: 0
server: sffe
etag: "1190 / 865 of 1000 / last-modified: 1650280322"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 18 Apr 2022 21:22:05 GMT

GET
H2 200 / Show response
geoloc.m32.media/json/ 210 B
425 B 186ms
96ms XHR
application/json 35.227.201.248
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://geoloc.m32.media/json/

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.227.201.248 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

248.201.227.35.bc.googleusercontent.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

204873007b93504008b6f74dc4ea92798bd1935711f06e4c5755f725132dc332

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: gzip
x-database-date: Mon, 18 Apr 2022 02:00:13 GMT
server: nginx/1.18.0 (Ubuntu)
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.ledroit.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubdomains;
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

GET
H3 200 m=byfTOb,lsjVmc,xUdipf,blwjVc,fKUV3e,aurFic,COQbmf,ws9Tlc,U0aPgd,zG9H6c,LEikZe,NwH0H,OmgaI,gychg,VWuaCc,ZfAoz,PQaYAf,lPKSwe,yDVVkb,KG2eXe,DfBslb Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.de.W3i6d0oNs8w.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.T1JeWXHsKXI.L.B1... Frame CC50 129 KB
43 KB 25ms
9ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.de.W3i6d0oNs8w.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.T1JeWXHsKXI.L.B1.O/am=GAAQ/d=1/exm=_b,_tp/excm=_b,_tp,serviceiframeview/esmo=1/ed=1/wt=2/rs=ABXTjI5ajOG1w-OIFHnXvHHr3YXuWqwY5g/ee=cEt90b:ws9Tlc;rXjWyb:VWuaCc;uY49fb:COQbmf;yxTchf:KUM7Z;qddgKe:xQtZb;iFQyKf:vfuNJf;dIoSBb:SpsfSb;zxnPse:GkRiKb;NSEoX:lazG7b;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;NPKaK:SdcwHb;pXdRYb:MdUzUe;SNUn3:ZwDk9d;LBgRLc:SdcwHb;wR5FRb:O1Gjze/m=byfTOb,lsjVmc,xUdipf,blwjVc,fKUV3e,aurFic,COQbmf,ws9Tlc,U0aPgd,zG9H6c,LEikZe,NwH0H,OmgaI,gychg,VWuaCc,ZfAoz,PQaYAf,lPKSwe,yDVVkb,KG2eXe,DfBslb

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.de.W3i6d0oNs8w.es5.O/am=GAAQ/d=1/excm=_b,_tp,serviceiframeview/ed=1/dg=0/wt=2/esmo=1/rs=ABXTjI7eMRXQLmwEFi3dWWXPArfFY9WLUQ/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

682fa98c6178e57e38027555bd0f7217bdfaaa973135e9c48e5476e505ad3d54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 20:01:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4827
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44451
x-xss-protection: 0
last-modified: Sat, 16 Apr 2022 01:01:26 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/subscribewithgoogle-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/subscribewithgoogle-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/subscribewithgoogle-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Tue, 18 Apr 2023 20:01:38 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
442 B 61ms
19ms XHR
text/plain 2a00:1450:400c:c06::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-86531657-10&cid=442538623.1650316927&jid=1845646836&gjid=930614076&_gid=1604801134.1650316927&_u=YGBAgEABAAAAAE~&z=1877366636

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 18 Apr 2022 21:22:05 GMT
content-type: text/plain
access-control-allow-origin: https://www.ledroit.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 30ms
15ms XHR
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1197411077&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Article&ea=View&el=cf2b5b903b414656c2d16992c6bf0c34&_u=YGDAAEABAAAAAG~&jid=1535785008&gjid=1118725226&cid=442538623.1650316927&tid=UA-86531657-5&_gid=1604801134.1650316927&_r=1&gtm=2wg4d0MRPMG73&z=319949490

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ledroit.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1197411077&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Article&ea=View&el=cf2b5b903b414656c2d16992c6bf0c34&_u=YGBAgEAB~&jid=1845646836&gjid=930614076&cid=442538623.1650316927&tid=UA-86531657-10&_gid=1604801134.1650316927&gtm=2wg4d0MRPMG73&cd3=0&cd5=0&cd6=Jim%20Bronskill&cd7=Actualit%C3%A9s&z=1204869578

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 15:48:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 19996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1197411077&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDAiEABBAAAAG~&jid=&gjid=&cid=442538623.1650316927&tid=UA-86531657-10&_gid=1604801134.1650316927&gtm=2wg4d0MRPMG73&cd3=0&cd5=0&cd6=Jim%20Bronskill&cd7=Actualit%C3%A9s&z=869125714

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 15:48:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 19996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
7ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1197411077&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACEABBAAAAG~&jid=&gjid=&cid=442538623.1650316927&tid=UA-86531657-5&_gid=1604801134.1650316927&gtm=2wg4d0MRPMG73&z=585763799

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 15:48:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 19996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
8ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1197411077&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Article&ea=LoadContentItems&el=cf2b5b903b414656c2d16992c6bf0c34&_u=YGDAiEABBAAAAG~&jid=&gjid=&cid=442538623.1650316927&tid=UA-86531657-10&_gid=1604801134.1650316927&gtm=2wg4d0MRPMG73&cd3=0&cd5=0&cd6=Jim%20Bronskill&cd7=Actualit%C3%A9s&z=1504486178

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 15:48:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 19996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
8ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1197411077&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Article&ea=LoadContentItems&el=cf2b5b903b414656c2d16992c6bf0c34&_u=YGDACEABBAAAAG~&jid=&gjid=&cid=442538623.1650316927&tid=UA-86531657-5&_gid=1604801134.1650316927&gtm=2wg4d0MRPMG73&z=42094881

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 15:48:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 19996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
9ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1197411077&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=10&el=%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34&_u=YGDAiEABBAAAAG~&jid=&gjid=&cid=442538623.1650316927&tid=UA-86531657-10&_gid=1604801134.1650316927&gtm=2wg4d0MRPMG73&cd3=0&cd5=0&cd6=Jim%20Bronskill&cd7=Actualit%C3%A9s&z=1315739126

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 15:48:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 19996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
9ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1197411077&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Paywall%20Hit&ea=%0A%20%20%20%20%20%20%20%20%20%20Ce%20contenu%20vous%20est%20offert%20gratuitement%2C%20il%20vous%20reste%202%20contenus%20%C3%A0%20consulter%20ce%20mois-ci.%0A%20%20%20%20%20%20&el=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes&_u=YGDAiEABBAAAAG~&jid=&gjid=&cid=442538623.1650316927&tid=UA-86531657-10&_gid=1604801134.1650316927&gtm=2wg4d0MRPMG73&cd3=0&cd5=0&cd6=Jim%20Bronskill&cd7=Actualit%C3%A9s&z=520697189

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 15:48:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 19996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 13ms
13ms Ping
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-FDLYVLLX4S&gtm=2oe4d0&_p=1197411077&sr=1600x1200&_z=ccd.MAB&ul=en-us&cid=442538623.1650316927&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sid=1650316926&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FDLYVLLX4S&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ledroit.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.de.W3i6d0oNs8w.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.T1JeWXHsKXI.L.B1... Frame CC50 17 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.de.W3i6d0oNs8w.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.T1JeWXHsKXI.L.B1.O/am=GAAQ/d=1/exm=COQbmf,DfBslb,KG2eXe,LEikZe,NwH0H,OmgaI,PQaYAf,U0aPgd,VWuaCc,ZfAoz,_b,_tp,aurFic,blwjVc,byfTOb,fKUV3e,gychg,lPKSwe,lsjVmc,ws9Tlc,xUdipf,yDVVkb,zG9H6c/excm=_b,_tp,serviceiframeview/esmo=1/ed=1/wt=2/rs=ABXTjI5ajOG1w-OIFHnXvHHr3YXuWqwY5g/ee=cEt90b:ws9Tlc;rXjWyb:VWuaCc;uY49fb:COQbmf;yxTchf:KUM7Z;qddgKe:xQtZb;iFQyKf:vfuNJf;dIoSBb:SpsfSb;zxnPse:GkRiKb;NSEoX:lazG7b;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;NPKaK:SdcwHb;pXdRYb:MdUzUe;SNUn3:ZwDk9d;LBgRLc:SdcwHb;wR5FRb:O1Gjze/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eca1bc3243acd0c5db6b26ce5b4c96ec8c7140798cb615ce337526c35f52cf0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 20:01:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4827
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7258
x-xss-protection: 0
last-modified: Sat, 16 Apr 2022 01:01:26 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/subscribewithgoogle-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/subscribewithgoogle-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/subscribewithgoogle-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Tue, 18 Apr 2023 20:01:38 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 52D8 32 KB
10 KB 22ms
22ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: d4d11466f8a21a8c3c96dfaf304aa45107dd8d95687a8da3cb23f49c3d138fb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 21:22:05 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=36060
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9541
Expires: Tue, 19 Apr 2022 07:23:05 GMT

GET
H/1.1 200
OK player-hb.js Show response
static.freeskreen.com/scm/player/20211014b/ Frame 8B79 265 KB
68 KB 8ms
8ms Script
text/javascript 99.86.7.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/scm/player/20211014b/player-hb.js
Requested by: Host: t.co
URL: https://t.co/g2Y77vHr89
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-29.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4af5765b7587881ef567c23d0aa9fcdbeff09e3354473ed56eca490f4df5ca30

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: 1a20JKKbfSum1GD_kgL27p_j3szFYaZQ
Content-Encoding: gzip
ETag: "409ad7e8925e1ea5584c81bef309f239"
Age: 35272
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 69058
Last-Modified: Thu, 14 Oct 2021 20:54:36 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1634244865/ctime:1634244872/gid:20/gname:staff/md5:409ad7e8925e1ea5584c81bef309f239/mode:33188/mtime:1634244865/uid:501/uname:mickael
Date: Mon, 18 Apr 2022 11:34:42 GMT
Content-Type: text/javascript
Via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: cyM1EDtmlFA6z-xAo1v7Zyfl6CfUzvZlkik6XxCiKEIHdiP3AEEVFQ==

OPTIONS
H2 200 /
activity.wisepops.com/ Frame 0
0 189ms
138ms Preflight 2606:4700:20::681a:b13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://activity.wisepops.com/?v=1.1.0&site=zxkhfvBn4y&session=f590e63e-ee52-4210-b547-07974b2e8b9a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:b13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ledroit.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
cf-cache-status: DYNAMIC
cf-ray: 6fe07432ca4d83b4-MXP
content-length: 0
date: Mon, 18 Apr 2022 21:22:06 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N03zqP5SchXWsMBPcHWgvZ0b6VLSa4VPi7%2FWsVhSSgJCcEqQY%2FYtae%2BuUWa51YudG3hYPGxNIrNbqKhUm6FV6KXOgwsF83J16X1MNVljBhYSXkiELfO89AA2VgfUI2GYWtfyC4NzukYU5ScY3YADNSILnw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 200 my-wisepop Show response
popup.wisepops.com/ 328 B
854 B 235ms
186ms XHR
application/json 2606:4700:20::681a:b13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://popup.wisepops.com/my-wisepop
Requested by: Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:b13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7ec95ac3e93299f9b63e7d41f3c8245c194749d09634da8da9a5dff5a37ad9b

Request headers

Accept: application/json
Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, POST, GET
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2Ba0zNqap8Y6WBEfK8dhKh5eNOti4kOSqrf0iuwTBBZzgEwT3B%2BDOw11MGYRCW45iiDjmjRRY7FqGEC6YPuFnzR5fEqmUWM3SLdBO84U7n4TjFMm9hvc2iQXZ5yA2coCxkiA8Cfcixcc6Izseynhkw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cloud-trace-context: 4d715bbde35b7fc921db4fc3ddd0deb4
cache-control: no-store
cf-ray: 6fe07432bc4359f5-MXP
access-control-allow-headers: *

POST
H2 200 / Show response
activity.wisepops.com/ 0
273 B 193ms
193ms XHR
text/plain 2606:4700:20::681a:b13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://activity.wisepops.com/?v=1.1.0&site=zxkhfvBn4y&session=f590e63e-ee52-4210-b547-07974b2e8b9a
Requested by: Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:b13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wjt1pw%2BieZbG01d50GKV1zey%2FqISm4v54YmsndnwPTU5Z%2FozgyY%2BaKZpA2jiXldnPLOUOvcgLsXtuxOKSuWLLvrhgUH51fufwfqD52dv7FexVmLIHtfwvV%2FUsU2o8hUK%2FKMuKo4lacLNJkC5xgKePs2c4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 6fe07433ac6a83b4-MXP
content-length: 0

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 44ms
20ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-86531657-10&cid=442538623.1650316927&jid=1845646836&_u=YGBAgEABAAAAAE~&z=739917801

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 43ms
18ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-86531657-10&cid=442538623.1650316927&jid=1845646836&_u=YGBAgEABAAAAAE~&z=739917801

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 40ms
19ms XHR
text/plain 2a00:1450:400c:c06::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-86531657-5&cid=442538623.1650316927&jid=1535785008&gjid=1118725226&_gid=1604801134.1650316927&_u=YGDAAEABAAAAAG~&z=666076029

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 18 Apr 2022 21:22:05 GMT
content-type: text/plain
access-control-allow-origin: https://www.ledroit.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_2022041401.js Show response
securepubads.g.doubleclick.net/gpt/ 362 KB
123 KB 22ms
7ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js?cb=31067133

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

sffe /

Resource Hash

108a5ee6306c726271c490dceca48e5fb5a148ea41fcb9fe55cd5d348f16eb57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 18:35:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9974
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125916
x-xss-protection: 0
last-modified: Thu, 14 Apr 2022 08:34:33 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 18 Apr 2023 18:35:51 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 102 B
121 B 31ms
17ms XHR
application/json 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.ledroit.com

Requested by

Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

106a5fee54e420dfe1bc21af763a35245bd950cb4b54237cfb7234a22baf1d3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 96
x-xss-protection: 0
expires: Mon, 18 Apr 2022 21:22:05 GMT

GET
H2 200 resize
images.omerlocdn.com/ 20 KB
21 KB 47ms
41ms Image
image/webp 18.64.103.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.omerlocdn.com/resize?url=https%3A%2F%2Fgcm.omerlocdn.com%2Fproduction%2Fglobal%2Ffiles%2Fimage%2F4a2e66ad-3464-4229-81a7-905dd497ac05.webp&width=1024&type=webp&stripmeta=true
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-110.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 8df4ae884667dbc5f42da9f26e950324fcb2741cf39f7ae0b7c0307bd42875fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 16:09:18 GMT
via: 1.1 759fdd9f923ecbc08bad5c12c5d4db9a.cloudfront.net (CloudFront)
server: nginx/1.18.0
age: 18767
x-ratelimit-remaining: 99
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: public, s-maxage=31536000, max-age=31536000, no-transform
x-ratelimit-reset: 1
x-ratelimit-limit: 101
x-amz-cf-pop: TXL50-P3
content-length: 20832
x-amz-cf-id: 3q3uH64CBM9sDnKIdCRs2N81fqXVL2To3W49m11EB_w9tcl3wiYgEw==
expires: Tue, 18 Apr 2023 16:09:17 GMT

GET
H2 200 resize
images.omerlocdn.com/ 25 KB
25 KB 556ms
550ms Image
image/webp 18.64.103.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.omerlocdn.com/resize?url=https%3A%2F%2Fgcm.omerlocdn.com%2Fproduction%2Fglobal%2Ffiles%2Fimage%2Fca18a3c2-190e-462d-81bc-0395398c6f3b.JPG&width=1024&type=webp&stripmeta=true
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-110.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 567b0706694fecbdaa38e928e8f2ead7e8b926d4529b0b6b3d76020d7b5b9eb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
via: 1.1 759fdd9f923ecbc08bad5c12c5d4db9a.cloudfront.net (CloudFront)
server: nginx/1.18.0
x-amz-cf-pop: TXL50-P3
x-ratelimit-remaining: 100
x-cache: Miss from cloudfront
content-type: image/webp
cache-control: public, s-maxage=31536000, max-age=31536000, no-transform
x-ratelimit-reset: 1
x-ratelimit-limit: 101
content-length: 25596
x-amz-cf-id: qql_OIZE1ufEyKFsNbBddlHdTkk8psIhv7hrcrXkGbebOtgaHyGmfw==
expires: Tue, 18 Apr 2023 21:22:05 GMT

GET
H2 200 resize
images.omerlocdn.com/ 109 KB
110 KB 506ms
500ms Image
image/webp 18.64.103.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.omerlocdn.com/resize?url=https%3A%2F%2Fgcm.omerlocdn.com%2Fproduction%2Fglobal%2Ffiles%2Fimage%2F104d16c5-4dd7-4b9f-a520-fd21453673d6.jpg&width=1024&type=webp&stripmeta=true
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-110.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: e1e1e187dfc1750e5ee176eb1cc966770c10e6b4f111dd81da4660266c65ff6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
via: 1.1 759fdd9f923ecbc08bad5c12c5d4db9a.cloudfront.net (CloudFront)
server: nginx/1.18.0
x-amz-cf-pop: TXL50-P3
x-ratelimit-remaining: 100
x-cache: Miss from cloudfront
content-type: image/webp
cache-control: public, s-maxage=31536000, max-age=31536000, no-transform
x-ratelimit-reset: 1
x-ratelimit-limit: 101
content-length: 112120
x-amz-cf-id: 5BkPfnhq40ij2doRNor3x21gWwQcZ2sLEA3Jy1JVYvwaqSXCxUcfOA==
expires: Tue, 18 Apr 2023 21:22:05 GMT

GET
H2 200 resize
images.omerlocdn.com/ 87 KB
88 KB 552ms
547ms Image
image/webp 18.64.103.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.omerlocdn.com/resize?url=https%3A%2F%2Fgcm.omerlocdn.com%2Fproduction%2Fglobal%2Ffiles%2Fimage%2F36efba20-f047-4c7c-a380-ba749ef3e7c5.png&width=1024&type=webp&stripmeta=true
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-110.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 01af2f901fe389b33674610a844908c226c0a3c15c7e4b37b36fd6a9e44d2ea5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
via: 1.1 759fdd9f923ecbc08bad5c12c5d4db9a.cloudfront.net (CloudFront)
server: nginx/1.18.0
x-amz-cf-pop: TXL50-P3
x-ratelimit-remaining: 100
x-cache: Miss from cloudfront
content-type: image/webp
cache-control: public, s-maxage=31536000, max-age=31536000, no-transform
x-ratelimit-reset: 1
x-ratelimit-limit: 101
content-length: 89204
x-amz-cf-id: 5CPHIe7TCVwNn99iqXBxP7tB-H1mSMiZdpqlbkhvTefXcbFVJwk2ag==
expires: Tue, 18 Apr 2023 21:22:05 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
410 B 23ms
7ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1602700049765366&ev=PageView&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&rl=https%3A%2F%2Ft.co%2F&if=false&ts=1650316927623&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=30&fbp=fb.1.1650316927622.984170917&it=1650316926966&coo=false&rqm=GET

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Mon, 18 Apr 2022 21:22:05 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 52D8 284 B
536 B 44ms
9ms Image
image/jpg 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/jpg

POST
H2 200 log Show response
play.google.com/ Frame CC50 131 B
672 B 65ms
17ms XHR
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://news.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 18 Apr 2022 21:22:05 GMT

POST
H3 200 batchexecute Show response
news.google.com/_/SubscribewithgoogleClientUi/data/ Frame CC50 246 B
225 B 30ms
30ms XHR
application/json 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/_/SubscribewithgoogleClientUi/data/batchexecute?rpcids=SlvRf&source-path=%2Fswg%2F_%2Fui%2Fv1%2Fserviceiframe&f.sid=-2534278952756564947&bl=boq_subscribewithgoogleclientserver_20220417.12_p0&hl=de&soc-app=673&soc-platform=1&soc-device=1&_reqid=76928&rt=c

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

69f6a66458a3d080371802d78bf6c897e455b78986ed9832df55b7124dccf43b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Same-Domain: 1
Referer: https://news.google.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 18 Apr 2022 21:22:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: same-site
content-disposition: attachment; filename="response.bin"; filename*=UTF-8''response.bin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 40ms
22ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-86531657-5&cid=442538623.1650316927&jid=1535785008&_u=YGDAAEABAAAAAG~&z=1953393186

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 48ms
29ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-86531657-5&cid=442538623.1650316927&jid=1535785008&_u=YGDAAEABAAAAAG~&z=1953393186

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 2B9FAA34215E8F662454539B7C2FD14C.cache.js Show response
static.freeskreen.com/gwt/20210107205009/advertisement/freeskreen_splitbox_client/ Frame 8B79 98 KB
34 KB 7ms
7ms Script
application/javascript 99.86.7.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/gwt/20210107205009/advertisement/freeskreen_splitbox_client/2B9FAA34215E8F662454539B7C2FD14C.cache.js
Requested by: Host: t.co
URL: https://t.co/g2Y77vHr89
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-29.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7a41da1f7e70ad9aa4d7772e6cb239e50ecf944808eb73e6de07cdb92c2552c6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: 3PIgB876VbZVlHUwnXSJVJ7NAqTCm2v1
Content-Encoding: gzip
ETag: "4444d8b2df068cd8be696adeacc34754"
Age: 65273
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 34116
Last-Modified: Thu, 07 Jan 2021 20:53:52 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1610052721/ctime:1610052830/gid:497/gname:jenkins/md5:4444d8b2df068cd8be696adeacc34754/mode:33188/mtime:1610052721/uid:498/uname:jenkins
Date: Mon, 18 Apr 2022 03:15:33 GMT
Content-Type: application/javascript
Via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: BvqfvGErhLYvX4lPo9hdWN7OtahwsvGaoc3tqZzH-yAig3uKS3cBCw==

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 8B79 43 B
414 B 32ms
31ms Image
image/gif 65.9.7.81
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1650316927&p=2974&c=3420&s=undefined&d=&v=&t=fd158d1b-87f0-44ff-8f49-16d99fe2b813&co=SE&pr=AB&ci=Stockholm&dm=null&flc=2022&slc=&ttm=1650316925009&gdpr=1&gdpr_consent=-1&e=AdOpened&m=2&x=null
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-81.fra56.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:05 GMT
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: UjRQzFnXSsniRT3YLugyCLNrqvC3sGrBxQavAmlH5sFOFd-fMu3Ttg==
expires: -1

GET
H/1.1 204
No Content sync.php
pixel-us-west.rubiconproject.com/exchange/ Frame 52D8 0
239 B 751ms
158ms Image
image/gif 8.39.36.142
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-us-west.rubiconproject.com/exchange/sync.php?p=123456
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.39.36.142 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0963d041a95f271fbba7f411adc03573
Content-Type: image/gif

POST
H3 200 log Show response
play.google.com/ Frame CC50 131 B
155 B 30ms
15ms XHR
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://news.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 18 Apr 2022 21:22:06 GMT

OPTIONS
H3 200 log
play.google.com/ Frame 0
0 27ms
13ms Preflight
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://news.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://news.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Mon, 18 Apr 2022 21:22:06 GMT
expires: Mon, 18 Apr 2022 21:22:06 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame CC50 131 B
155 B 30ms
17ms XHR
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://news.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 18 Apr 2022 21:22:06 GMT

OPTIONS
H3 200 log
play.google.com/ Frame 0
0 27ms
14ms Preflight
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://news.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://news.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Mon, 18 Apr 2022 21:22:06 GMT
expires: Mon, 18 Apr 2022 21:22:06 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame CC50 131 B
155 B 23ms
16ms XHR
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://news.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 18 Apr 2022 21:22:06 GMT

OPTIONS
H3 200 log
play.google.com/ Frame 0
0 33ms
21ms Preflight
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://news.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://news.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Mon, 18 Apr 2022 21:22:06 GMT
expires: Mon, 18 Apr 2022 21:22:06 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H2 200 329008.js Show response
cdn.wisepops.com/shared/wisepops/0158364426a9c9b94a9f7d8d10271410/ 254 KB
78 KB 91ms
83ms Script
text/javascript 2606:4700:20::681a:a13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.wisepops.com/shared/wisepops/0158364426a9c9b94a9f7d8d10271410/329008.js?v=1646768586000
Requested by: Host: loader.wisepops.com
URL: https://loader.wisepops.com/get-loader.js?v=1&site=zxkhfvBn4y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0b487bb53410bcbaf20f0e9e366dc262aed602644a6098059bebbc9595d8a71

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-goog-hash: crc32c=BAQVyA==, md5=o1f5hJHeB92TldgWa4HeOQ==
date: Mon, 18 Apr 2022 21:22:06 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 89420
x-guploader-uploadid: ADPycdt5JyHBPJfGzXsobvLiqC6qxXtGxAFMeRmnMf41GGBgtUhVEeSTW8Equon-xSk3EZKhzFW7d6ZCp8MO-6Gkz8kw0bPihrLs
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/javascript
last-modified: Fri, 18 Feb 2022 19:36:59 GMT
server: cloudflare
etag: W/"a357f98491de07dd9395d8166b81de39"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=44RjDu3uglDHlzz78bZArW4P4djzea7%2FEOALQErXBXup7MAsrLYtn0iUI9FQa8pYe0RQsfCI3%2FqNrsnGYjk9DVE2OYHY5rZA1tKqNRgcBfcGI8CvbItaQihlV%2Bz4Nv52tsGN47QTcGDA7ExSros%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1645213019891893
cache-control: public, max-age=31536000
x-goog-stored-content-length: 260582
cf-ray: 6fe074340ef259fb-MXP
expires: Sun, 17 Apr 2022 21:31:46 GMT

GET
H2 200 tag Show response
pc213-ztwri.ads.tremorhub.com/ad/ Frame 8B79 55 B
501 B 344ms
104ms XHR
application/json 2600:1f18:612b:4216:2301:7ac9:1540:9c55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pc213-ztwri.ads.tremorhub.com/ad/tag?adCode=pc213-lubk9&playerWidth=544&playerHeight=305&playerPosition=3&srcPageUrl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&gdpr=1&gdpr_consent=&custom=3420&c2=fr-ca&floor=USD:5&us_privacy=&fmt=json
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4216:2301:7ac9:1540:9c55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 920a5468ed2b12fb2a5684be51a7a5b2f8ae3310946b9e6fb544aa9ac9bb0819

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:06 GMT
content-encoding: gzip
server: Apache-Coyote/1.1
vary: accept-encoding
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
access-control-allow-origin: https://www.ledroit.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-tremorvideo-status: NO_AD
content-type: application/json;charset=UTF-8

GET
H2 204 bid Show response
ads.freeskreen.com/ Frame 8B79 0
197 B 325ms
109ms XHR
text/plain 54.173.181.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.freeskreen.com/bid?pid=2974&tid=fd158d1b-87f0-44ff-8f49-16d99fe2b813&w=544&h=305&u=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&ip=217.64.151.5&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F100.0.4896.75%20Safari%2F537.36&g_co=SE&g_p=AB&g_ci=Stockholm&g_d=null&s_1=2022&s_2=&cid=3420&sid=undefined&vid=298&did=98767&pf=500&ttm=1650316925009&eu_c=-1&eu_g=1&eu_ggl=0
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.173.181.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-173-181-170.compute-1.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/xml, text/xml, */*; q=0.01
Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:06 GMT
server: Apache-Coyote/1.1
access-control-allow-methods: GET
access-control-allow-origin: https://www.ledroit.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
expires: -1

GET
H3 200 css
fonts.googleapis.com/ 9 KB
775 B 33ms
17ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,700%7CWork+Sans:300,400,700

Requested by

Host: cdn.wisepops.com
URL: https://cdn.wisepops.com/shared/wisepops/0158364426a9c9b94a9f7d8d10271410/329008.js?v=1646768586000

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

93131b105987358ae2f530b0a88d495e0e41d705c3a63c9801f233f0f834e034

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 18 Apr 2022 21:22:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 18 Apr 2022 21:22:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Apr 2022 21:22:06 GMT

GET
H2 200 3ac0da4e3eabe591643580a5dfdaca8b.gif
cdn.wisepops.com/shared/images/wisepops/c.50505/ 16 KB
16 KB 69ms
68ms Image
image/webp 2606:4700:20::681a:a13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.wisepops.com/shared/images/wisepops/c.50505/3ac0da4e3eabe591643580a5dfdaca8b.gif
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c77b75ec5c0e7d1889bebcd798ed518aa75ae9d01849eb5a94d3c9d42a84b676

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-goog-hash: crc32c=GD/cXg==, md5=OsDaTj6r5ZFkNYCl39rKiw==
date: Mon, 18 Apr 2022 21:22:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 403532
cf-polished: origFmt=gif, origSize=24369
x-guploader-uploadid: ADPycdsSfm3Y-fsN-HvarnQ0DJ67fGJuju3GtBrB-LDS1Ev5OsYfiE_3cO26jqnC9ELt0xwJkmlcvg0pUPD3DOEsdSzok411heX1
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="3ac0da4e3eabe591643580a5dfdaca8b.webp"
content-type: image/webp
content-length: 16158
last-modified: Wed, 19 Jan 2022 19:38:49 GMT
server: cloudflare
etag: "3ac0da4e3eabe591643580a5dfdaca8b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=INikjttGavFcAjr2wiFd2eMWQQKZfeat4M%2B0t5b7STLvKbh7PARsuO4KYbNK0jJi1iCSgHVw9gVStlc9ZAon6MaAVenVOvS5FPYZeMKGlVFM5b%2FXKmPYzoVS95uY8WQ8LKG5BektTya9URgpl%2FE%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1642621129044668
expires: Thu, 14 Apr 2022 06:16:34 GMT
cache-control: public, max-age=31536000
x-goog-stored-content-length: 24369
accept-ranges: bytes
cf-ray: 6fe07435ab5c59fb-MXP
cf-bgj: imgq:85,h2pri

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 15ms
15ms Image
image/gif 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-MRPMG73&cv=134&v=3&t=t&pid=520078330&rv=4d0&e=*&eid=21&u=C&ut=C&tc=72&tr=1ua.5ua.5ua&epr=1G.2G&cl=g.301.9&ti=1ua.1ua.1ua&z=0

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:06 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 8B79 43 B
414 B 56ms
56ms Image
image/gif 65.9.7.81
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1650316928&p=2974&c=3420&s=undefined&d=98767&v=298&t=fd158d1b-87f0-44ff-8f49-16d99fe2b813&co=SE&pr=AB&ci=Stockholm&dm=null&flc=2022&slc=&ttm=1650316925009&gdpr=1&gdpr_consent=-1&e=VastRequest&m=1&x=https%3A%2F%2Fads.freeskreen.com%2Fbid%3Fpid%3D2974%26tid%3Dfd158d1b-87f0-44ff-8f49-16d99fe2b813%26w%3D544%26h%3D305%26u%3Dhttps%253A%252F%252Fwww.ledroit.com%252F2022%252F04%252F17%252Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%253Fnor%253Dtrue%26ip%3D217.64.151.5%26ua%3DMozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64)%2520AppleWebKit%252F537.36%2520(KHTML%252C%2520like%2520Gecko)%2520Chrome%252F100.0.4896.75%2520Safari%252F537.36%26g_co%3DSE%26g_p%3DAB%26g_ci%3DStockholm%26g_d%3Dnull%26s_1%3D2022%26s_2%3D%26cid%3D3420%26sid%3Dundefined%26vid%3D298%26did%3D98767%26pf%3D500%26ttm%3D1650316925009%26eu_c%3D-1%26eu_g%3D1%26eu_ggl%3D0
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-81.fra56.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:06 GMT
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: 8HLminXBrpJD2GWIavxcbXllqkCtCyYxUm2YHTJH6Jl1hFF_4p6gYw==
expires: -1

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 8B79 43 B
413 B 33ms
33ms Image
image/gif 65.9.7.81
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1650316928&p=2974&c=3420&s=undefined&d=98767&v=298&t=fd158d1b-87f0-44ff-8f49-16d99fe2b813&co=SE&pr=AB&ci=Stockholm&dm=null&flc=2022&slc=&ttm=1650316925009&gdpr=1&gdpr_consent=-1&e=VastEmpty&m=1&x=
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-81.fra56.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:06 GMT
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: LAu36kEeYAuCyfdGxXU3LvhtPMJqdoqjS_4Lxw9HgnqddlRsIPP0iQ==
expires: -1

POST
H3 200 / Show response
www.facebook.com/tr/ Frame CB5B 0
17 B 19ms
7ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.ledroit.com
Referer: https://www.ledroit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.ledroit.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Mon, 18 Apr 2022 21:22:06 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,700%7CWork+Sans:300,400,700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.ledroit.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 16:37:56 GMT
x-content-type-options: nosniff
age: 535450
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Apr 2023 16:37:56 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,700%7CWork+Sans:300,400,700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.ledroit.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 18:59:49 GMT
x-content-type-options: nosniff
age: 526937
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 12 Apr 2023 18:59:49 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 12ms
12ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,700%7CWork+Sans:300,400,700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.ledroit.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 20:07:55 GMT
x-content-type-options: nosniff
age: 522851
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 12 Apr 2023 20:07:55 GMT

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 8B79 43 B
412 B 60ms
59ms Image
image/gif 65.9.7.81
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1650316928&p=2974&c=3420&s=undefined&d=323534&v=9316&t=fd158d1b-87f0-44ff-8f49-16d99fe2b813&co=SE&pr=AB&ci=Stockholm&dm=null&flc=2022&slc=&ttm=1650316925009&gdpr=1&gdpr_consent=-1&e=VastRequest&m=1&x=https%3A%2F%2Fpc213-ztwri.ads.tremorhub.com%2Fad%2Ftag%3FadCode%3Dpc213-lubk9%26playerWidth%3D544%26playerHeight%3D305%26playerPosition%3D3%26srcPageUrl%3Dhttps%253A%252F%252Fwww.ledroit.com%252F2022%252F04%252F17%252Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%253Fnor%253Dtrue%26gdpr%3D1%26gdpr_consent%3D%26custom%3D3420%26c2%3Dfr-ca%26floor%3DUSD%3A5%26us_privacy%3D%26fmt%3Djson
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-81.fra56.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:06 GMT
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: NDzfqgbI4JvLbAvrXeO5eMdRTZiIkwc6siuortWWAd2l00231q9n4A==
expires: -1

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 8B79 43 B
413 B 34ms
34ms Image
image/gif 65.9.7.81
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1650316928&p=2974&c=3420&s=undefined&d=&v=&t=fd158d1b-87f0-44ff-8f49-16d99fe2b813&co=SE&pr=AB&ci=Stockholm&dm=null&flc=2022&slc=&ttm=1650316925009&gdpr=1&gdpr_consent=-1&e=VideoError&m=1&x=ErrorNoPlayableAd
Requested by: Host: www.ledroit.com
URL: https://www.ledroit.com/2022/04/17/une-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34?nor=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-81.fra56.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:06 GMT
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
server: Apache/2.4.29 (Ubuntu)
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
x-amz-cf-id: LoLF8LoWLaXFuz6ta3jcujLo7ojNdUzldfGhkVx1EulVCRglbKjrNQ==
expires: -1

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 18ms
18ms Image
image/gif 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-MRPMG73&cv=134&v=3&t=t&pid=520078330&rv=4d0&es=1&e=gtm.formSubmit&eid=65&u=C&ut=C&tc=72&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:06 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 page.gif
track.customer.io/events/ 35 B
210 B 154ms
111ms Image
image/gif 35.227.225.220
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.customer.io/events/page.gif?name=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&data%5Bnor%5D=true&data%5Bwidth%5D=1600&data%5Bheight%5D=1200&data%5Breferrer%5D=https%3A%2F%2Ft.co%2F&c=&s=4207d514-a3c4-84b0-2f83-3a66f6e3dec3&site_id=b1dbf47836a3fae04e51&timestamp=1650316928522
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.225.220 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 220.225.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 21:22:06 GMT
via: 1.1 google
access-control-allow-origin: *
content-type: image/gif
status: 200 OK
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-transfer-encoding: binary
content-disposition: attachment
alt-svc: clear
content-length: 35

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 23ms
22ms Image
image/gif 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-MRPMG73&cv=134&v=3&t=t&pid=520078330&rv=4d0&es=1&e=gtm.load&eid=71&u=C&ut=C&tc=72&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:07 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 view5
analytics360.omerloclients.com/ Frame 0
0 277ms
276ms Preflight
application/json 99.86.7.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics360.omerloclients.com/view5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-29.fra6.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.ledroit.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Mon, 18 Apr 2022 21:22:09 GMT
via: 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront)
x-amz-apigw-id: Qy50UED-IAMFxUw=
x-amz-cf-id: eL65vrKM60_1ii-bSrmZTI11vITf1fjX8H3c7YlZ9iyerlwkpbh_Mw==
x-amz-cf-pop: FRA6-C1
x-amzn-requestid: f701cbaa-b41e-4cd5-9284-41f6384b4a42
x-cache: Miss from cloudfront

POST
H2 201 view5 Show response
analytics360.omerloclients.com/ 8 B
386 B 314ms
314ms Fetch
application/json 99.86.7.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics360.omerloclients.com/view5
Requested by: Host: gcm-production2.omerloclients.com
URL: https://gcm-production2.omerloclients.com/assets/vendor-d06260cb0611cf721d8848baa7d70649.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-29.fra6.r.cloudfront.net
Software: /
Resource Hash: bebe9f7520f45e551824558d8c8291c429a32f508c9a6a42b9bfa91a062e53de

Request headers

Referer: https://www.ledroit.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
X-Api-Key: 556e98ed302e4c53b6bc3ee69ebdd39f
Content-Type: application/json

Response headers

date: Mon, 18 Apr 2022 21:22:10 GMT
via: 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amzn-requestid: 3f0c2e65-77bb-469f-9878-da8118a43e48
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-amzn-trace-id: Root=1-625dd682-47b711e33d8bb8d970cb149c;Sampled=0
x-amz-apigw-id: Qy50XGCZoAMFiSg=
content-length: 8
x-amz-cf-id: p0Zq54raeUAoOiulcVCWfVvFgALWCisNIKkPNmJVgxhehAs2Ls0WIQ==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
7ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1197411077&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Article&ea=View5&el=cf2b5b903b414656c2d16992c6bf0c34&_u=aGDAiEABBAAAAG~&jid=&gjid=&cid=442538623.1650316927&tid=UA-86531657-10&_gid=1604801134.1650316927&gtm=2wg4d0MRPMG73&cd3=0&cd5=0&cd6=Jim%20Bronskill&cd7=Actualit%C3%A9s&z=1995377777

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 15:48:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 20000
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
8ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1197411077&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.ledroit.com%2F2022%2F04%2F17%2Fune-cyberattaque-sophistiquee-contre-rideau-hall-selon-des-documents-internes-cf2b5b903b414656c2d16992c6bf0c34%3Fnor%3Dtrue&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Une%20cyberattaque%20%C2%ABsophistiqu%C3%A9e%C2%BB%20contre%20Rideau%20Hall%2C%20selon%20des%20documents%20internes%20%7C%20Politique%20%7C%20Actualit%C3%A9s%20%7C%20Le%20Droit%20-%20Gatineau%2C%20Ottawa&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Article&ea=View5&el=cf2b5b903b414656c2d16992c6bf0c34&_u=aGDACEABBAAAAG~&jid=&gjid=&cid=442538623.1650316927&tid=UA-86531657-5&_gid=1604801134.1650316927&gtm=2wg4d0MRPMG73&z=1050734248

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 15:48:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 20000
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 19ms
19ms Image
image/gif 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-MRPMG73&cv=134&v=3&t=t&pid=520078330&rv=4d0&es=1&e=*&eid=77&u=C&ut=C&tc=72&tr=1ua.1ua.5ua.5ua&ti=1ua.1ua.1ua.1ua&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ledroit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 21:22:10 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.ledroit.com
URL: https://www.ledroit.com/sw.js

Verdicts & Comments Add Verdict or Comment

143 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

22 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.ledroit.com/2022/04/17	1969-12-31 23:59:59	Name: wisepops_activity_session Value: %7B%22id%22%3A%22f590e63e-ee52-4210-b547-07974b2e8b9a%22%2C%22start%22%3A1650316927551%7D
.t.co/	1970-01-20 11:55:31	Name: muc Value: 3e185997-26f6-4eea-b3ad-25f3c500ade4
.google.com/	1970-01-20 06:48:48	Name: NID Value: 511=BVrm1JHa7GZ5ALYjRhFXk3NhxxTSmz0xsjL0_664ulgkz7UuNV7iqzRzq-L1_fMsLs1OV6To43kxuUDVbTxFIVY1u8UY9liV2RvfLE_XYWPn_6CokVjR3pXK2FKh81rLNqwg08zNh_y7OaqltEUFKUV6RhTfFvqAAU3Szs7-j2A
.adnxs.com/	1970-01-20 04:34:52	Name: uuid2 Value: 1674428712557424797
www.ledroit.com/	1969-12-31 23:59:59	Name: OmerloAnalytics.anonymousId Value: 1603ae40-8933-4389-b4c3-08053d4c5846
www.ledroit.com/	1970-01-20 02:42:43	Name: PaywallGuestConsumption Value: %7B%22allowed%22%3A3%2C%22paidContentConsumedCount%22%3A1%2C%22period%22%3A%22month%22%7D
.adnxs.com/	1970-01-20 04:34:52	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2In4p1DLT!]tbP6j2F-XstGt!@E0h%)8/j
.freeskreen.com/	1970-01-20 02:35:21	Name: a Value: MzQyMD0xfHw7NTMyMT0xfHw7
.ledroit.com/	1970-01-20 02:26:43	Name: _gid Value: GA1.2.1604801134.1650316927
.ledroit.com/	1970-01-20 02:25:16	Name: _dc_gtm_UA-86531657-10 Value: 1
.ledroit.com/	1970-01-20 02:25:16	Name: _gat_UA-86531657-5 Value: 1
.ledroit.com/	1970-01-20 19:56:28	Name: _ga_FDLYVLLX4S Value: GS1.1.1650316926.1.0.1650316926.0
.admanmedia.com/	1970-01-20 11:10:52	Name: admtr Value: 4b03b1626909a52335afafbfa4fc95f6f3c9d15a
www.ledroit.com/	1970-01-20 02:25:17	Name: m32_pubgeo Value: JTdCJTIyaXAlMjIlM0ElMjIyMTcuNjQuMTUxLjUlMjIlMkMlMjJjb3VudHJ5X2NvZGUlMjIlM0ElMjJTRSUyMiUyQyUyMmNvdW50cnlfbmFtZSUyMiUzQSUyMlNjaHdlZGVuJTIyJTJDJTIycmVnaW9uX2NvZGUlMjIlM0ElMjIlMjIlMkMlMjJyZWdpb25fbmFtZSUyMiUzQSUyMiUyMiUyQyUyMmNpdHklMjIlM0ElMjIlMjIlMkMlMjJ0aW1lX3pvbmUlMjIlM0ElMjJFdXJvcGUlMkZTdG9ja2hvbG0lMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTU5LjMyNDclMkMlMjJsb25naXR1ZGUlMjIlM0ExOC4wNTYlMkMlMjJtZXRyb19jb2RlJTIyJTNBMCUyQyUyMnBvc3RhbF9jb2RlJTIyJTNBJTIyJTIyJTdE
.ledroit.com/	1970-01-20 19:56:28	Name: wisepops Value: %7B%22csd%22%3A1%2C%22popups%22%3A%7B%7D%2C%22sub%22%3A0%2C%22ucrn%22%3A87%2C%22cid%22%3A%2250505%22%2C%22v%22%3A4%2C%22bandit%22%3A%7B%22recos%22%3A%7B%7D%7D%7D
.ledroit.com/	1970-01-20 19:56:28	Name: wisepops_visits Value: %5B%222022-04-18T21%3A22%3A06.811Z%22%5D
.ledroit.com/	1969-12-31 23:59:59	Name: wisepops_session Value: %7B%22arrivalOnSite%22%3A%222022-04-18T21%3A22%3A06.811Z%22%2C%22mtime%22%3A1650316927546%2C%22pageviews%22%3A1%2C%22popups%22%3A%7B%7D%2C%22bars%22%3A%7B%7D%2C%22countdowns%22%3A%7B%7D%2C%22src%22%3A%22https%3A%2F%2Ft.co%2F%22%2C%22utm%22%3A%7B%7D%2C%22testIp%22%3Anull%7D
.freeskreen.com/	1970-01-20 02:35:21	Name: scmtid Value: c2NtaWQ9Z2hqZWNqZ2JkYWZnYjlqbWtLMVFjeWh8MTY1MDMxNjkyNDk3NiZhY2lkPSU3QiUyNFVJRCU3RHwxNjUwMzE2OTI1ODE1
.ledroit.com/	1970-01-20 04:34:52	Name: _fbp Value: fb.1.1650316927622.984170917
.facebook.com/	1970-01-20 04:34:52	Name: fr Value: 0GDUkHUlv1ZAMSFqh..BiXdZ9...1.0.BiXdZ9.
.ledroit.com/	1970-01-20 11:10:52	Name: _cioanonid Value: 4207d514-a3c4-84b0-2f83-3a66f6e3dec3
.ledroit.com/	1970-01-20 19:56:28	Name: _ga Value: GA1.2.442538623.1650316927

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

activity.wisepops.com
ads.freeskreen.com
ads.pubmatic.com
ajax.googleapis.com
analytics360.omerloclients.com
apis.google.com
assets.customer.io
c.amazon-adsystem.com
cdn.jsdelivr.net
cdn.wisepops.com
connect.facebook.net
cs.admanmedia.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
gcm-production2.omerloclients.com
gcm.omerlocdn.com
geoloc.m32.media
images.omerlocdn.com
loader.wisepops.com
loadeu.exelator.com
news.google.com
pc213-ztwri.ads.tremorhub.com
pixel-us-west.rubiconproject.com
play.google.com
popup.wisepops.com
rdc.m32.media
sb.freeskreen.com
scm.publishers.tremorhub.com
secure-assets.rubiconproject.com
secure.adnxs.com
securepubads.g.doubleclick.net
static.freeskreen.com
stats.g.doubleclick.net
sync.smartadserver.com
t.co
token.rubiconproject.com
track.customer.io
weather.omerloclients.com
ww1772.smartadserver.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.ledroit.com
www.ledroit.com
104.244.42.5
104.92.74.8
142.250.186.66
143.204.202.104
143.204.202.20
18.64.103.110
18.64.103.129
185.33.221.91
185.86.137.32
185.86.139.114
2.20.157.2
23.205.235.133
2600:1f18:612b:4216:2301:7ac9:1540:9c55
2600:1f18:612b:4264:35be:ace0:b22e:18d9
2600:9000:214f:400:1d:9f81:51c0:93a1
2600:9000:2156:cc00:11:9cfd:9400:93a1
2606:4700:20::681a:a13
2606:4700:20::681a:b13
2606:4700::6810:5714
2a00:1450:4001:808::200e
2a00:1450:4001:810::2008
2a00:1450:4001:811::200e
2a00:1450:4001:812::2003
2a00:1450:4001:813::2003
2a00:1450:4001:813::200a
2a00:1450:4001:813::200e
2a00:1450:4001:827::2004
2a00:1450:4001:82f::200a
2a00:1450:4001:82f::200e
2a00:1450:4001:830::2003
2a00:1450:400c:c06::9c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
34.254.143.3
35.227.201.248
35.227.225.220
35.227.246.163
54.173.181.170
65.9.66.173
65.9.7.81
69.173.144.139
8.2.111.142
8.39.36.142
99.86.7.29
01af2f901fe389b33674610a844908c226c0a3c15c7e4b37b36fd6a9e44d2ea5
069f695140cae015bfd9f54836c257da65969097a565500f49adb1a262ae6719
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
086f1c868f8f769ef0039b238b415fc3c46d97e342309dc8c61cefb40868212e
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
106a5fee54e420dfe1bc21af763a35245bd950cb4b54237cfb7234a22baf1d3e
108a5ee6306c726271c490dceca48e5fb5a148ea41fcb9fe55cd5d348f16eb57
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
157f9a1d6165ed3c8d9a331da4ff096ee0acef49d0e87bbcdcffe69b1c4031d8
1909b2a83fd41494d94862c4323944d9d0aa1f1e653f252ea5a73fc5944308b0
1e01d95c9ba9e43f07e3d172273596cb1bea22ac4684cdafbc3c92d1158e6173
204873007b93504008b6f74dc4ea92798bd1935711f06e4c5755f725132dc332
25cbc8a8357f893fe7ee7d5d12b33daccd8f3244b86efb92575051cba51f655d
263da84a32afd389f713d15d164746917e4f90f7a79a74b1c5dd9093fcda9802
2cf1525cae084928cbf6fab1897a82fecb2826bd521ce14fab5e37626f482b14
31ace63fa339896dc045f21da77b1ffdc57160e2db5690b132766b0086d6f58e
33409666cfa50a4190ab5ad64c4dbec668dd90226908ab4c898e1a34583d9fae
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
3d4d62f3b219f0bf8e1a4f667501c6a8e2c9060c6f49bc2dc9e70fb23733674a
3dca7a8cc4cd9a222e48df3ba166a4d1de7335809caf7f7828856ff1121dbfdc
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3eca1bc3243acd0c5db6b26ce5b4c96ec8c7140798cb615ce337526c35f52cf0
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
420cf4b339a69a9a3ffafbebd48db71dcdaf2ce3f74cadc2351ebc899e9b5f46
43b5e2e8ff9b11948c8939acda2926718d5a370d6ff8f573768e59d8889f7365
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44ea0066992762110b18880e58f968fa5dc3af9a051c057a5e689bed7d47158d
481b2fb6ea4f714f9b58e143ddb63f973e0fc1b14a4d8213517b4451644c9fae
48314bca6a877c6ca70c34c4bd60020b3074cc017979239086489a16d1cee26b
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
49475cdade27e3786301ae21734bb175c2f0c39f95ccfe847e4bfd67f15a978b
49766ee4a4567a624033aba57e2901a33aee7b7c397878313c4946dd6063b4a8
4af5765b7587881ef567c23d0aa9fcdbeff09e3354473ed56eca490f4df5ca30
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
50c76cbf0b66b6b963b703440c8cc1844d2f28981c76b6d295ee37f688a868ad
567b0706694fecbdaa38e928e8f2ead7e8b926d4529b0b6b3d76020d7b5b9eb3
572848c8c30c46020959ee57e4e945b9525619ee1496c0250a3164a6976b5101
5f568a73a759604b2536eda238e24f0ad77106be5c946c3babfd67e83bf67739
604e7027286c010d4f0b64291b51b80b9d4df493077cd40e72c4da0db8580bbd
6659edd30afbce2323bb2b3443be4e8a5258d1260d0e68fd99df4d828f0ff718
682fa98c6178e57e38027555bd0f7217bdfaaa973135e9c48e5476e505ad3d54
69f6a66458a3d080371802d78bf6c897e455b78986ed9832df55b7124dccf43b
6c3664d624873d5ce0348175782a4250165ec1a540b31d84ce1180b172ef14ef
765618d1667ba791f2d492d121d2da42ff7d7e079a4773462a381ac9aceab0c5
772fa5a279ecad537bea7d71690183408a9aff38f71a094a2dff5698c724d9f8
7924a05b1d2de788d78a2d540ba2b198247365fc9b033156ef04f70d35df56c6
795411f11055d7678ddda584e70494c28e506a4de9a9444045741a99c5ba5bea
7a41da1f7e70ad9aa4d7772e6cb239e50ecf944808eb73e6de07cdb92c2552c6
7f22f1472391060bbb0102d2a27bcda6c2daa8db0ea2d2d07459365bc83be932
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
88263f60a48193f8879859651977b828a72f0d25334b1e8ddafb2b38819cf9df
88816b4e9d2b1e7455a8edb3b081950d1be6c35f4da7af91a166b9c9a8f1edb3
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
89f209ffb037889ec3abf5d932c72a34daf9cf2552b5479ea2ae4a3262a347f2
8df4ae884667dbc5f42da9f26e950324fcb2741cf39f7ae0b7c0307bd42875fe
920a5468ed2b12fb2a5684be51a7a5b2f8ae3310946b9e6fb544aa9ac9bb0819
93131b105987358ae2f530b0a88d495e0e41d705c3a63c9801f233f0f834e034
932c3bd5606d810f7ff508764492b66584d34ad69c6df8d5584b215634c072c7
95056cde8fc60350eece66c30a6b3926915d469ad7f55ab883d8d3ca033f0f39
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a6cff6a4a25cbdca73f736e3f7a8917cdb7c36c6c28e9de343a5adaf0ed077d4
a9f52ff38b671059aaf2f8f95b7b15a14ec9c5ebbe68163c572d72787d7ffa15
acbd1e6f646a6e2f384ab59be7ca23636a4dea5d5969e5f1701df58df52dcf08
b102fc918f837700d56d7582ee5e8d1ab8e5b85d072cc4a245c4e81174a3e99e
b24466ed7a923925e6f28faf042fcd599f471659ab395f296a6fa937e02bfd0f
b369199a64f2c100cfba46ea9b4bdfc807bd7a164307905edfcdd381f06d0526
bde06a0400c168573473e2de967d842eec383f2f755aef4ec017b2f333e7ff85
bebe9f7520f45e551824558d8c8291c429a32f508c9a6a42b9bfa91a062e53de
bf604a2452aa95b02d12e3d2873cd1847fdc1508234277f42788e84b93dafe83
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c38398144d1be0acf7b2200b31f6ecdf4f89f2f6550f89a7886c2ce9c17b0287
c77b75ec5c0e7d1889bebcd798ed518aa75ae9d01849eb5a94d3c9d42a84b676
c8b8aead96faa0bd30b0919c44f88272c72931eaf0c2f612e0af6c04c1442b74
c9b4308223f2a8ec0f26a5dfb7006c1d4ca0b6cf9e64cf7e44a1037be4aea637
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cf92a9d2bfbcee32c0fba48b038afc5b47ce13927de8b0003a1f55147d71dbc1
d0b487bb53410bcbaf20f0e9e366dc262aed602644a6098059bebbc9595d8a71
d4d11466f8a21a8c3c96dfaf304aa45107dd8d95687a8da3cb23f49c3d138fb1
d7ec95ac3e93299f9b63e7d41f3c8245c194749d09634da8da9a5dff5a37ad9b
da1240738eef80e8630a5749b9258e33d7669859ba8a5ed1da81978092ed03af
da741b0c80dfaf7527a9e787d8a0a6ab3a1c35b2b6e696979744287f8b34c62c
dbc7819de8456d4d52ac1044fde27d205381975ab1186d4e060c4bdbe76367a8
dc7a8eb4fbb940aafff5ffd4a09c4e4e2bc84de5738354f1914e8d91e87cad94
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e01e3921f9c95b2a9da10cb7d7078ac7c3c88f8aa3593d1a6065d94099fc36cb
e08b0ff7f2bb5dee049a32dab138af86d7eb7a613c98f61cf08eb703ebc5908e
e0c5465f459500c3eacbdf79bde16c8ea7d9881422dd11ac7be5f62b61fa2e16
e1e1e187dfc1750e5ee176eb1cc966770c10e6b4f111dd81da4660266c65ff6b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec98c39f5c2d07120b2958675d626739610d6f8759a923a08b3392043d30f095
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efded6408c7e64cd48c00b10bdd63b79539c5bb13a396b9f3773f71fe2d5a606
f014ab6831432be7cd3c191b88d6d3b4c1a05ba510620d0f202e02c59a016726
febdd4373f6f38affcc19d9886b479c6786e09116e1adad54fcf017d6baa4bf7

www.ledroit.com Open in urlscan Pro 2600:9000:214f:400:1d:9f81:51c0:93a1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

147 Requests

97 %HTTPS

48 %IPv6

26 Domains

47 Subdomains

43 IPs

7 Countries

3006 kBTransfer

9259 kBSize

22 Cookies

111 Outgoing links

Page URL History

Redirected requests

147 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.ledroit.com Open in urlscan Pro
2600:9000:214f:400:1d:9f81:51c0:93a1 Public Scan

Screenshot
Live screenshot

Full Image

147
Requests

97 %
HTTPS

48 %
IPv6

26
Domains

47
Subdomains

43
IPs

7
Countries

3006 kB
Transfer

9259 kB
Size

22
Cookies

147 HTTP transactions
0 data transactions