www.ghacks.net Open in urlscan Pro
2606:4700:20::681a:1fa Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.baesystems.zip/
Effective URL:
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Submission: On June 23 via api (June 23rd 2023, 2:36:18 am UTC) from US — Scanned from US

Summary HTTP 186 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 53 IPs in 6 countries across 64 domains to perform 186 HTTP transactions. The main IP is 2606:4700:20::681a:1fa, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.ghacks.net. The Cisco Umbrella rank of the primary domain is 248840.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 25th 2023. Valid for: a year.

This is the only time www.ghacks.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.217.13.115 172.217.13.115	15169 (GOOGLE) (GOOGLE)
1 32	2606:4700:20:... 2606:4700:20::681a:1fa	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:402... 2607:f8b0:4020:806::200a	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:402... 2607:f8b0:4020:807::2003	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:200... 2a04:4e42:200::282	54113 (FASTLY) (FASTLY)
3	2607:f8b0:402... 2607:f8b0:4020:805::2002	15169 (GOOGLE) (GOOGLE)
5	151.101.193.91 151.101.193.91	54113 (FASTLY) (FASTLY)
10	139.45.240.92 139.45.240.92	57304 (RUBY-AS) (RUBY-AS)
3	2600:9000:24f... 2600:9000:24f3:7200:5:b7cc:d3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3033::ac43:9fa2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	2607:f8b0:402... 2607:f8b0:4020:806::2008	15169 (GOOGLE) (GOOGLE)
1	13.32.195.219 13.32.195.219	16509 (AMAZON-02) (AMAZON-02)
3	18.67.67.228 18.67.67.228	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:20:... 2606:4700:20::681a:78b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80e::200a	15169 (GOOGLE) (GOOGLE)
3	130.211.23.194 130.211.23.194	15169 (GOOGLE) (GOOGLE)
2	2606:4700:20:... 2606:4700:20::681a:246	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.217.13.102 172.217.13.102	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2600:9000:207... 2600:9000:2073:2a00:d:2044:5c40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:10:... 2606:4700:10::ac43:266a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	18.160.1.134 18.160.1.134	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:c0b::9d	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:402... 2607:f8b0:4020:807::2004	15169 (GOOGLE) (GOOGLE)
2 16	52.46.128.147 52.46.128.147	16509 (AMAZON-02) (AMAZON-02)
4 4	199.127.204.171 199.127.204.171	26120 (RHYTHMONE) (RHYTHMONE)
2 2	2620:112:f002... 2620:112:f002:bbbb::21	6336 (TURN-US-ASN) (TURN-US-ASN)
1	3.224.253.54 3.224.253.54	14618 (AMAZON-AES) (AMAZON-AES)
2 10	192.40.39.223 192.40.39.223	27381 (CASALE-MEDIA) (CASALE-MEDIA)
3	72.247.71.192 72.247.71.192	16625 (AKAMAI-AS) (AKAMAI-AS)
4	104.102.111.7 104.102.111.7	16625 (AKAMAI-AS) (AKAMAI-AS)
2 6	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	216.22.16.4 216.22.16.4	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
2 3	52.223.22.214 52.223.22.214	16509 (AMAZON-02) (AMAZON-02)
2 2	68.67.160.114 68.67.160.114	29990 (ASN-APPNEX) (ASN-APPNEX)
1 20	54.87.127.173 54.87.127.173	14618 (AMAZON-AES) (AMAZON-AES)
5 5	35.211.178.172 35.211.178.172	19527 (GOOGLE-2) (GOOGLE-2)
1 1	35.211.118.13 35.211.118.13	15169 (GOOGLE) (GOOGLE)
4 5	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
10 10	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
3 3	64.202.112.95 64.202.112.95	23352 (SERVERCEN...) (SERVERCENTRAL)
1	2620:1ec:c11:... 2620:1ec:c11::200	() ()
1 1	52.202.56.4 52.202.56.4	14618 (AMAZON-AES) (AMAZON-AES)
2 5	2600:1f18:4e9... 2600:1f18:4e9:5a02:d35b:426d:ec00:d12d	14618 (AMAZON-AES) (AMAZON-AES)
2 2	3.228.34.13 3.228.34.13	14618 (AMAZON-AES) (AMAZON-AES)
2 2	2603:c020:400... 2603:c020:400d:3000:7130:bb0b:d7e:bee2	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
1 2	38.91.45.7 38.91.45.7	398989 (DEEPINTENT) (DEEPINTENT)
2 2	50.31.142.95 50.31.142.95	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1 1	23.192.51.216 23.192.51.216	() ()
2 2	54.81.62.10 54.81.62.10	14618 (AMAZON-AES) (AMAZON-AES)
2 2	198.148.27.139 198.148.27.139	() ()
17 21	172.217.13.130 172.217.13.130	15169 (GOOGLE) (GOOGLE)
2 2	216.200.232.253 216.200.232.253	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1	174.137.133.32 174.137.133.32	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
2 3	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
2 2	68.67.161.208 68.67.161.208	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.167.164.39 185.167.164.39	198622 (ADFORM) (ADFORM)
1 1	141.226.224.48 141.226.224.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1 1	202.241.208.54 202.241.208.54	4694 (IDCF IDC ...) (IDCF IDC Frontier Inc.)
1 1	80.77.87.161 80.77.87.161	46636 (NATCOWEB) (NATCOWEB)
2 2	185.184.8.90 185.184.8.90	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
1 1	23.1.200.83 23.1.200.83	16625 (AKAMAI-AS) (AKAMAI-AS)
2	8.28.7.81 8.28.7.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	54.236.237.143 54.236.237.143	() ()
12	8.28.7.83 8.28.7.83	() ()
1 1	34.150.170.96 34.150.170.96	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
7 12	8.43.72.98 8.43.72.98	() ()
1 1	8.43.72.97 8.43.72.97	() ()
1	2620:1ec:21::14 2620:1ec:21::14	() ()
1	67.220.224.144 67.220.224.144	() ()
3	8.28.7.84 8.28.7.84	() ()
1 1	199.38.167.131 199.38.167.131	() ()
6 6	52.73.94.167 52.73.94.167	() ()
1 1	23.105.14.105 23.105.14.105	() ()
1	44.206.150.230 44.206.150.230	() ()
1	52.54.245.27 52.54.245.27	() ()
1	52.212.37.98 52.212.37.98	() ()
1 1	3.225.218.10 3.225.218.10	() ()
2 2	2606:ae80:147... 2606:ae80:1471:16::730	() ()
2 2	2604:9e00:1:1... 2604:9e00:1:129::2:a01	() ()
1 1	174.137.133.49 174.137.133.49	() ()
2	116.202.32.62 116.202.32.62	() ()
1	2606:4700:303... 2606:4700:3033::6815:325a	() ()
186	53

1 172.217.13.115 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: yul02s04-in-f19.1e100.net

www.baesystems.zip	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 2606:4700:20::681a:1fa (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.ghacks.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:806::200a (Montreal, Canada)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:807::2003 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::282 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4020:805::2002 (Montreal, Canada)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.193.91 (United States)

ASN54113 (FASTLY, US)

spn-v1.revampcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 139.45.240.92 (Russian Federation)

ASN57304 (RUBY-AS, RU)

notix.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:24f3:7200:5:b7cc:d3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

sdk.privacy-center.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::ac43:9fa2 (United States)

ASN13335 (CLOUDFLARENET, US)

sdk.mrf.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:806::2008 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.195.219 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-195-219.iad66.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.67.67.228 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-67-228.iad89.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:78b (United States)

ASN13335 (CLOUDFLARENET, US)

btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80e::200a (Flushing, United States)

ASN15169 (GOOGLE, US)

readaloud.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 130.211.23.194 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 194.23.211.130.bc.googleusercontent.com

api.btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:246 (United States)

ASN13335 (CLOUDFLARENET, US)

ad-delivery.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.13.102 (United States)

ASN15169 (GOOGLE, US)
PTR: yul02s04-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2073:2a00:d:2044:5c40:93a1 (United States)

ASN16509 (AMAZON-02, US)

api.privacy-center.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:266a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.160.1.134 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-1-134.iad12.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c0b::9d (Ashburn, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:807::2004 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 52.46.128.147 (Ashburn, United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 199.127.204.171 (United States) 4 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:112:f002:bbbb::21 (United States) 2 redirects

ASN6336 (TURN-US-ASN, US)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.224.253.54 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-253-54.compute-1.amazonaws.com

rtb.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 192.40.39.223 (Canada) 2 redirects

ASN27381 (CASALE-MEDIA, CA)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 72.247.71.192 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-71-192.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.102.111.7 (Billerica, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-102-111-7.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.98.64.218 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.22.16.4 (Manassas, United States) 2 redirects

ASN30633 (LEASEWEB-USA-WDC, US)

ssbsync-us.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.223.22.214 (Seattle, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.114 (New York, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 54.87.127.173 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-87-127-173.compute-1.amazonaws.com

usersync.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.211.178.172 (North Charleston, United States) 5 redirects

ASN19527 (GOOGLE-2, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.211.118.13 (North Charleston, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 13.118.211.35.bc.googleusercontent.com

r.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.111.113.62 (Kansas City, United States) 4 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 15.197.193.217 (Seattle, United States) 10 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 64.202.112.95 (Chicago, United States) 3 redirects

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (None, )

ASN- ()

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.202.56.4 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-56-4.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:1f18:4e9:5a02:d35b:426d:ec00:d12d (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.228.34.13 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-228-34-13.compute-1.amazonaws.com

sync.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2603:c020:400d:3000:7130:bb0b:d7e:bee2 (Ashburn, United States) 2 redirects

ASN31898 (ORACLE-BMC-31898, US)

sync.technoratimedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 38.91.45.7 (United States) 1 redirects

ASN398989 (DEEPINTENT, US)

match.deepintent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.31.142.95 (Itasca, United States) 2 redirects

ASN22075 (AS-OUTBRAIN, US)
PTR: chi.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.192.51.216 (None, ) 1 redirects

ASN- ()

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.81.62.10 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-62-10.compute-1.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.148.27.139 (None, ) 2 redirects

ASN- ()

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 172.217.13.130 (United States) 17 redirects

ASN15169 (GOOGLE, US)
PTR: yul02s05-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.200.232.253 (Frederick, United States) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 174.137.133.32 (United States)

ASN27257 (WEBAIR-INTERNET, US)

sync.adkernel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.130.49 (United States) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.161.208 (New York, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.167.164.39 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.224.48 (United States) 1 redirects

ASN200478 (TABOOLA-AS, IL)

sync.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 202.241.208.54 (Japan) 1 redirects

ASN4694 (IDCF IDC Frontier Inc., JP)

tg.socdm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.77.87.161 (Clifton, United States) 1 redirects

ASN46636 (NATCOWEB, US)

cs.admanmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.90 (Amsterdam, Netherlands) 2 redirects

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net

creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.1.200.83 (Edison, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-1-200-83.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 8.28.7.81 (United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.236.237.143 (None, ) 1 redirects

ASN- ()

thrtle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 8.28.7.83 (None, )

ASN- ()

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.150.170.96 (Washington, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 96.170.150.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 8.43.72.98 (None, ) 7 redirects

ASN- ()

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.43.72.97 (None, ) 1 redirects

ASN- ()

pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (None, )

ASN- ()

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.220.224.144 (None, )

ASN- ()

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 8.28.7.84 (None, )

ASN- ()

simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.38.167.131 (None, ) 1 redirects

ASN- ()

p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.73.94.167 (None, ) 6 redirects

ASN- ()

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.105.14.105 (None, ) 1 redirects

ASN- ()

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.206.150.230 (None, )

ASN- ()

crb.kargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.54.245.27 (None, )

ASN- ()

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.37.98 (None, )

ASN- ()

synchroscript.deliveryengine.adswizz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.225.218.10 (None, ) 1 redirects

ASN- ()

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:ae80:1471:16::730 (None, ) 2 redirects

ASN- ()

pubmatic-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2604:9e00:1:129::2:a01 (None, ) 2 redirects

ASN- ()

rtb2-useast.marketiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 174.137.133.49 (None, ) 1 redirects

ASN- ()

dsp.adkernel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 116.202.32.62 (None, )

ASN- ()

events.newsroom.bi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6815:325a (None, )

ASN- ()

flowcards.mrf.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	ghacks.net 1 redirects www.ghacks.net — Cisco Umbrella Rank: 248840	280 KB
26	doubleclick.net 17 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 219 ad.doubleclick.net — Cisco Umbrella Rank: 184 stats.g.doubleclick.net — Cisco Umbrella Rank: 124 cm.g.doubleclick.net — Cisco Umbrella Rank: 244	160 KB
23	amazon-adsystem.com 2 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 357 aax.amazon-adsystem.com — Cisco Umbrella Rank: 444 s.amazon-adsystem.com — Cisco Umbrella Rank: 337 aax-eu.amazon-adsystem.com	76 KB
21	gumgum.com 1 redirects rtb.gumgum.com — Cisco Umbrella Rank: 1673 usersync.gumgum.com — Cisco Umbrella Rank: 2018	7 KB
20	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 547 image6.pubmatic.com — Cisco Umbrella Rank: 822 image2.pubmatic.com simage2.pubmatic.com simage4.pubmatic.com image4.pubmatic.com	36 KB
18	rubiconproject.com 9 redirects eus.rubiconproject.com — Cisco Umbrella Rank: 639 secure-assets.rubiconproject.com — Cisco Umbrella Rank: 1134 token.rubiconproject.com pixel.rubiconproject.com pixel-us-east.rubiconproject.com	30 KB
10	adsrvr.org 10 redirects match.adsrvr.org — Cisco Umbrella Rank: 375	5 KB
10	casalemedia.com 2 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 486 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 621 dsum.casalemedia.com	9 KB
10	notix.io notix.io — Cisco Umbrella Rank: 11863	27 KB
7	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 60	21 KB
6	bidr.io 6 redirects match.prod.bidr.io	3 KB
6	yahoo.com 3 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 468 ups.analytics.yahoo.com	3 KB
6	bidswitch.net 6 redirects x.bidswitch.net — Cisco Umbrella Rank: 361 r.bidswitch.net — Cisco Umbrella Rank: 8174	3 KB
6	openx.net 2 redirects u.openx.net — Cisco Umbrella Rank: 740 us-u.openx.net — Cisco Umbrella Rank: 492	2 KB
5	tapad.com 4 redirects pixel.tapad.com — Cisco Umbrella Rank: 513	1 KB
5	privacy-center.org sdk.privacy-center.org — Cisco Umbrella Rank: 6076 api.privacy-center.org — Cisco Umbrella Rank: 8934	139 KB
5	revampcdn.com spn-v1.revampcdn.com — Cisco Umbrella Rank: 209679	119 KB
4	adnxs.com 4 redirects secure.adnxs.com — Cisco Umbrella Rank: 476 ib.adnxs.com — Cisco Umbrella Rank: 249	4 KB
4	btloader.com btloader.com — Cisco Umbrella Rank: 1086 api.btloader.com — Cisco Umbrella Rank: 1196	7 KB
3	everesttech.net 2 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 778	907 B
3	outbrain.com 3 redirects sync.outbrain.com — Cisco Umbrella Rank: 763	1023 B
3	3lift.com 2 redirects eb2.3lift.com — Cisco Umbrella Rank: 421	1 KB
3	smartadserver.com 3 redirects ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 8210 ssbsync.smartadserver.com rtb-csync.smartadserver.com	926 B
3	1rx.io 3 redirects sync.1rx.io — Cisco Umbrella Rank: 618	2 KB
3	googleapis.com imasdk.googleapis.com — Cisco Umbrella Rank: 495 readaloud.googleapis.com — Cisco Umbrella Rank: 5630	124 KB
2	newsroom.bi events.newsroom.bi	1 KB
2	marketiq.com 2 redirects rtb2-useast.marketiq.com	766 B
2	dotomi.com 2 redirects pubmatic-match.dotomi.com	743 B
2	thrtle.com 1 redirects thrtle.com	682 B
2	creativecdn.com 2 redirects creativecdn.com — Cisco Umbrella Rank: 498	701 B
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 635	1 KB
2	adkernel.com 1 redirects sync.adkernel.com — Cisco Umbrella Rank: 1375 dsp.adkernel.com	570 B
2	mathtag.com 2 redirects sync.mathtag.com — Cisco Umbrella Rank: 566	1 KB
2	contextweb.com 2 redirects bh.contextweb.com	2 KB
2	360yield.com 2 redirects ad.360yield.com — Cisco Umbrella Rank: 662	647 B
2	zemanta.com 2 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 560	1 KB
2	deepintent.com 1 redirects match.deepintent.com — Cisco Umbrella Rank: 1163	594 B
2	technoratimedia.com 2 redirects sync.technoratimedia.com — Cisco Umbrella Rank: 1587	4 KB
2	ipredictive.com 2 redirects sync.ipredictive.com — Cisco Umbrella Rank: 1069	1019 B
2	turn.com 2 redirects ad.turn.com — Cisco Umbrella Rank: 1039	952 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 101	257 B
2	ad-delivery.net ad-delivery.net — Cisco Umbrella Rank: 1167	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 176	115 KB
2	mrf.io sdk.mrf.io — Cisco Umbrella Rank: 11825 flowcards.mrf.io	31 KB
1	adswizz.com synchroscript.deliveryengine.adswizz.com	397 B
1	bfmio.com sync.bfmio.com	425 B
1	kargo.com crb.kargo.com	504 B
1	rfihub.com 1 redirects p.rfihub.com	792 B
1	linkedin.com px.ads.linkedin.com	515 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 976	656 B
1	admanmedia.com 1 redirects cs.admanmedia.com — Cisco Umbrella Rank: 1103	660 B
1	socdm.com 1 redirects tg.socdm.com — Cisco Umbrella Rank: 1091	831 B
1	taboola.com 1 redirects sync.taboola.com — Cisco Umbrella Rank: 1088	311 B
1	bluekai.com 1 redirects stags.bluekai.com	684 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 792	879 B
1	bing.com c.bing.com	667 B
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1281	600 B
1	google.com www.google.com — Cisco Umbrella Rank: 3	408 B
1	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 839	25 KB
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 2021	45 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 82	51 KB
1	polyfill.io polyfill.io — Cisco Umbrella Rank: 1711	681 B
1	gstatic.com www.gstatic.com	159 KB
1	baesystems.zip 1 redirects www.baesystems.zip	183 B
186	64

	Domain	Requested by
32	www.ghacks.net	1 redirects www.ghacks.net
21	cm.g.doubleclick.net	17 redirects u.openx.net rtb.gumgum.com
20	usersync.gumgum.com	1 redirects rtb.gumgum.com ads.pubmatic.com
16	s.amazon-adsystem.com	2 redirects c.amazon-adsystem.com s.amazon-adsystem.com rtb.gumgum.com u.openx.net ssum-sec.casalemedia.com ads.pubmatic.com
10	match.adsrvr.org	10 redirects
10	notix.io	www.ghacks.net www.datadoghq-browser-agent.com notix.io
7	www.google-analytics.com	www.googletagmanager.com www.datadoghq-browser-agent.com www.ghacks.net
6	match.prod.bidr.io	6 redirects
6	pixel.rubiconproject.com	3 redirects
6	token.rubiconproject.com	4 redirects s.amazon-adsystem.com eus.rubiconproject.com
6	simage2.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
6	image2.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
5	dsum-sec.casalemedia.com	1 redirects ssum-sec.casalemedia.com
5	pr-bh.ybp.yahoo.com	2 redirects u.openx.net ssum-sec.casalemedia.com
5	pixel.tapad.com	4 redirects s.amazon-adsystem.com
5	x.bidswitch.net	5 redirects
5	spn-v1.revampcdn.com	www.ghacks.net spn-v1.revampcdn.com
4	us-u.openx.net	1 redirects u.openx.net
4	eus.rubiconproject.com	s.amazon-adsystem.com rtb.gumgum.com eus.rubiconproject.com
4	ssum-sec.casalemedia.com	1 redirects s.amazon-adsystem.com ssum-sec.casalemedia.com rtb.gumgum.com
3	sync-tm.everesttech.net	2 redirects ads.pubmatic.com
3	sync.outbrain.com	3 redirects
3	eb2.3lift.com	2 redirects s.amazon-adsystem.com
3	ads.pubmatic.com	s.amazon-adsystem.com rtb.gumgum.com
3	sync.1rx.io	3 redirects
3	aax.amazon-adsystem.com	www.datadoghq-browser-agent.com
3	api.btloader.com	www.datadoghq-browser-agent.com
3	c.amazon-adsystem.com	spn-v1.revampcdn.com www.datadoghq-browser-agent.com
3	sdk.privacy-center.org	www.ghacks.net sdk.privacy-center.org
3	securepubads.g.doubleclick.net	www.ghacks.net securepubads.g.doubleclick.net www.datadoghq-browser-agent.com
2	events.newsroom.bi	www.datadoghq-browser-agent.com
2	rtb2-useast.marketiq.com	2 redirects
2	pubmatic-match.dotomi.com	2 redirects
2	simage4.pubmatic.com	ads.pubmatic.com
2	thrtle.com	1 redirects s.amazon-adsystem.com
2	image6.pubmatic.com	ads.pubmatic.com
2	creativecdn.com	2 redirects
2	c1.adform.net	2 redirects
2	ib.adnxs.com	2 redirects
2	sync.mathtag.com	2 redirects
2	bh.contextweb.com	2 redirects
2	ad.360yield.com	2 redirects
2	b1sync.zemanta.com	2 redirects
2	match.deepintent.com	1 redirects rtb.gumgum.com
2	sync.technoratimedia.com	2 redirects
2	sync.ipredictive.com	2 redirects
2	secure.adnxs.com	2 redirects
2	u.openx.net	1 redirects s.amazon-adsystem.com
2	ad.turn.com	2 redirects
2	api.privacy-center.org	www.datadoghq-browser-agent.com
2	www.facebook.com	www.ghacks.net
2	ad-delivery.net	www.ghacks.net
2	readaloud.googleapis.com	www.gstatic.com
2	connect.facebook.net	www.ghacks.net connect.facebook.net
1	flowcards.mrf.io	www.datadoghq-browser-agent.com
1	dsp.adkernel.com	1 redirects
1	image4.pubmatic.com
1	ups.analytics.yahoo.com	1 redirects
1	synchroscript.deliveryengine.adswizz.com
1	sync.bfmio.com
1	crb.kargo.com
1	rtb-csync.smartadserver.com	1 redirects
1	p.rfihub.com	1 redirects
1	aax-eu.amazon-adsystem.com
1	px.ads.linkedin.com
1	pixel-us-east.rubiconproject.com	1 redirects
1	um.simpli.fi	1 redirects
1	secure-assets.rubiconproject.com	1 redirects
1	cs.admanmedia.com	1 redirects
1	tg.socdm.com	1 redirects
1	sync.taboola.com	1 redirects
1	dsum.casalemedia.com	ssum-sec.casalemedia.com
1	sync.adkernel.com	rtb.gumgum.com
1	ssbsync.smartadserver.com	1 redirects
1	stags.bluekai.com	1 redirects
1	sync.srv.stackadapt.com	1 redirects
1	c.bing.com	rtb.gumgum.com
1	r.bidswitch.net	1 redirects
1	ssbsync-us.smartadserver.com	1 redirects
1	rtb.gumgum.com	s.amazon-adsystem.com
1	sync.targeting.unrulymedia.com	1 redirects
1	www.google.com	www.ghacks.net
1	stats.g.doubleclick.net	www.datadoghq-browser-agent.com
1	cdn.id5-sync.com	www.ghacks.net
1	ad.doubleclick.net	www.ghacks.net
1	btloader.com	spn-v1.revampcdn.com
1	www.datadoghq-browser-agent.com	spn-v1.revampcdn.com
1	www.googletagmanager.com	www.ghacks.net
1	sdk.mrf.io	www.ghacks.net
1	polyfill.io	www.ghacks.net
1	www.gstatic.com	www.ghacks.net
1	imasdk.googleapis.com	www.ghacks.net
1	www.baesystems.zip	1 redirects
186	93

This site contains links to these domains. Also see Links.

Domain
deals.ghacks.net
domains.google
isc.sans.edu
blog.google
www.facebook.com
twitter.com
martinbrinkmann.substack.com
webextension.org
hello.softonic.com
eepurl.com
en.softonic.com

Subject Issuer	Validity	Valid
ghacks.net Cloudflare Inc ECC CA-3	`2023-05-25` - `2024-05-23`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
polyfill.io GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-10` - `2024-01-11`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.revampcdn.com R3	`2023-06-02` - `2023-08-31`	3 months	crt.sh
notix.io R3	`2023-04-14` - `2023-07-13`	3 months	crt.sh
*.privacy-center.org Amazon RSA 2048 M02	`2023-03-25` - `2024-04-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-02-28` - `2024-02-27`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-04-01` - `2023-06-30`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-14` - `2024-01-16`	a year	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
api.btloader.com GTS CA 1D4	`2023-06-13` - `2023-09-11`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
api.privacy-center.org Amazon RSA 2048 M02	`2023-06-13` - `2024-07-11`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
s.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-03` - `2024-02-19`	a year	crt.sh
gumgum.com Amazon RSA 2048 M02	`2023-06-07` - `2024-07-06`	a year	crt.sh
casalemedia.com Go Daddy Secure Certificate Authority - G2	`2022-12-13` - `2024-01-13`	a year	crt.sh
*.pubmatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-25` - `2024-01-24`	a year	crt.sh
*.rubiconproject.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-03-07` - `2024-04-03`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.deepintent.com Go Daddy Secure Certificate Authority - G2	`2022-11-30` - `2024-01-01`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-04-04` - `2023-09-27`	6 months	crt.sh
*.ad-server.k8s.ggops.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-09`	a year	crt.sh
*.adkernel.com AlphaSSL CA - SHA256 - G4	`2023-01-03` - `2024-02-04`	a year	crt.sh
*.everesttech.net GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-11-07` - `2023-12-09`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2023-04-13` - `2024-05-11`	a year	crt.sh
aax-eu.amazon-adsystem.com Amazon RSA 2048 M01	`2023-06-21` - `2024-03-02`	8 months	crt.sh
*.app.kargo.com Amazon RSA 2048 M02	`2023-02-21` - `2024-01-18`	a year	crt.sh
*.bfmio.com Amazon RSA 2048 M02	`2023-03-17` - `2024-04-14`	a year	crt.sh
*.deliveryengine.adswizz.com Amazon RSA 2048 M02	`2023-02-09` - `2024-02-13`	a year	crt.sh
ssl03.cert.cl03.k8s.mrf.io R3	`2023-05-18` - `2023-08-16`	3 months	crt.sh

This page contains 30 frames:

Primary Page: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Frame ID: 6AD4BC372ED77E5685DA538E8A58F794
Requests: 98 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: FBC3EE35F60F926EF24C591BBE9D4934
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t
Frame ID: C19F5410B59653B6DA0E5EF63251CCCE
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Frame ID: 2FD8C2670C3D479B72A610F0C72CC2EA
Requests: 2 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Frame ID: C3157ADFC0C99E283F7D36316BB5FC3C
Requests: 15 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Frame ID: 556D6E79AF0A66886729CCCDE87341A8
Requests: 10 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Frame ID: F6D10047FF6E3436619D2B92BF329BE6
Requests: 12 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: 0B2F764B5F287773518EE533A005BA36
Requests: 12 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Frame ID: FA32A905FA0CA2D435F6E71BD09B8EBE
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4002225585452661977&gdpr=0&gdpr_consent=
Frame ID: 27A29246FBC8959D40D57F8338E53BAE
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3927527952426166214561
Frame ID: 5B78CA1F63028A933897E85D6ED3D170
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=mmh&i=a0856495-051b-4700-b552-e42be4745fc4&gdpr=&gdpr_consent=
Frame ID: 81E016615995363EA2954C328A99F3E5
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=&gdpr_consent=&ccpa=
Frame ID: 2FA9FA344A4F737D83B6CDB7763EA8A7
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=atm&i=ZJUFGgATwZwDugBS&gdpr=&gdpr_consent=&_test=ZJUFGgATwZwDugBS
Frame ID: 2E86378C09409D40D6FF93DDF27E5DD7
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81MDZkN2NjZC1kNzJlLTQzNmUtOTg1YS0zYzE2YWExZjlmZmM=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv&google_tc=
Frame ID: 99D2FC1E26EFD7C6804EC372A0CEB4BB
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Frame ID: 51C3D23D547AAD3628D13CE71FA4EC4B
Requests: 12 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=ttd&i=7b45d823-797c-407a-919e-fb1a2f32ebf2
Frame ID: 75F690731211F3D75BA2E0C966FC4C3D
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s0AAHSSWRgAAAAA
Frame ID: FC61AFA0E59E8E8CC43A57F274A96ACB
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=aad&i=cdeddcb7-abea-41d3-a235-dbc2f2b8f778
Frame ID: 5EB5A8ADFED8A175D6712C4C2180EEE8
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Frame ID: 2B518423B2D039FAF2F0BF4A15FB0BD8
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=rth&i=v6oecdCPtA1mG0MxQnCr&pi=gumgum&tc=1
Frame ID: B1BA4BED9A7A41037A79905A50D638AF
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: 0E0185D69FBF18BBB5E659C503AC2B4F
Requests: 4 HTTP requests in this frame

Frame: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Frame ID: 8BAFC0E481BC388D2FEA437A7F14D5E2
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDF257B517-7ADD-448F-830A-1881685394C1
Frame ID: 916ABB34FE7ACE042A235079C0F242A9
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978477415877548149
Frame ID: 4F6CFC30E64FF0ABBE009BF816B3DF49
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F257B517-7ADD-448F-830A-1881685394C1&redir=true&gdpr=0&gdpr_consent=
Frame ID: 7EACE4BB977D4BB084721FF0307765E5
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0856495-051b-4700-b552-e42be4745fc4&gdpr=0&gdpr_consent=
Frame ID: 62FCA178B4B4F3968E7744D6EC157C21
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACXW07JKgoAACM5RSQGmg&gdpr=0&gdpr_consent=
Frame ID: 87242C7A4C63B9EAFDEB4AA1B0884716
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_65ee040f9e244c04b7bff
Frame ID: 666B6FD6F1B6EC69AF927797C4557954
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=pbm&i=F257B517-7ADD-448F-830A-1881685394C1
Frame ID: 5386FD68772AC0F823482F1B28DBE64B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Google's .zip Top Level domain is already used in phishing attacks - gHacks Tech News

Page URL History Show full URLs

https://www.baesystems.zip/ HTTP 302
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks// HTTP 301
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Didomi (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

sdk\.privacy-center\.org/.*/loader\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

/prebid\.js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

186
Requests

77 %
HTTPS

31 %
IPv6

64
Domains

93
Subdomains

53
IPs

6
Countries

1458 kB
Transfer

4538 kB
Size

122
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://deals.ghacks.net/
Title: Deals

Search URL Search Domain Scan URL

URL: https://domains.google/tld/zip/
Title: released

Search URL Search Domain Scan URL

URL: https://isc.sans.edu/diary/The+zip+gTLD+Risks+and+Opportunities/29838
Title: SANS Internet Storm Center

Search URL Search Domain Scan URL

URL: https://blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/
Title: but it took

Search URL Search Domain Scan URL

URL: https://www.facebook.com/therealmartinbrinkmann
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/martibrinkm
Title: Twitter

Search URL Search Domain Scan URL

URL: https://martinbrinkmann.substack.com/
Title: Substack

Search URL Search Domain Scan URL

URL: https://webextension.org/listing/block-site.html
Title: https://webextension.org/listing/block-site.html

Search URL Search Domain Scan URL

URL: https://hello.softonic.com/privacy-policy/
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ghacksnet

Search URL Search Domain Scan URL

URL: https://twitter.com/ghacks

Search URL Search Domain Scan URL

URL: http://eepurl.com/dp_1rj
Title: Ghacks Newsletter Sign up

Search URL Search Domain Scan URL

URL: https://en.softonic.com/articles/three-features-apple-should-add-now-to-apple-vision-pro
Title: Improving the User Experience: Three Essential Features for Apple Vision Pro

Search URL Search Domain Scan URL

URL: https://en.softonic.com/articles/reddit-gets-hot-with-the-recent-protest-mode-on-the-platform
Title: The Heat is On: Reddit’s Protest Mode Sparks Intense Online Discussions

Search URL Search Domain Scan URL

URL: https://en.softonic.com/articles/if-you-are-an-amazon-prime-member-we-have-bad-news-for-you-they-are-cheating-you
Title: Are You an Amazon Prime Member? Discover the Dark Secret They Don’t Want You to Know

Search URL Search Domain Scan URL

URL: https://en.softonic.com/articles/nasa-has-turned-a-galaxy-into-dj-listen-to-the-nebula-session
Title: Out of This World Beats: NASA Turns a Galaxy into a DJ, Bringing You the Nebula Session

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.baesystems.zip/ HTTP 302
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks// HTTP 301
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 98

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t

Request Chain 101

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D HTTP 302
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1687487770128 HTTP 302
https://ad.turn.com/r/cs?pid=45&rndcb=5474820486 HTTP 302
https://sync.1rx.io/usersync/turn/7290125297624499648?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-63af46ad-9403-4b02-8413-5a1c0959cf9d-005?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-63af46ad-9403-4b02-8413-5a1c0959cf9d-005 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-63af46ad-9403-4b02-8413-5a1c0959cf9d-005

Request Chain 103

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID HTTP 302
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Request Chain 106

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Request Chain 107

https://ssbsync-us.smartadserver.com/api/sync?callerId=2 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4002225585452661977&gdpr=0&gdpr_consent=

Request Chain 108

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3927527952426166214561

Request Chain 109

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dapn%26i%3D%24UID HTTP 302
https://usersync.gumgum.com/usersync?b=apn&i=1739900112503368577

Request Chain 110

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://r.bidswitch.net/sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=503c2303-1534-4098-b63f-c1bd8262953e HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=3205&partner_device_id=503c2303-1534-4098-b63f-c1bd8262953e&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%26ssp%3Dgumgum2%26bsw_param%3D503c2303-1534-4098-b63f-c1bd8262953e HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%252Chttps%25253A%25252F%25252Fx.bidswitch.net%25252Fsync%25253Fdsp_id%25253D393%252526user_id%25253D0%252526ssp%25253Dgumgum2%252526bsw_param%25253D503c2303-1534-4098-b63f-c1bd8262953e%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%2Chttps%253A%252F%252Fx.bidswitch.net%252Fsync%253Fdsp_id%253D393%2526user_id%253D0%2526ssp%253Dgumgum2%2526bsw_param%253D503c2303-1534-4098-b63f-c1bd8262953e%2C HTTP 302
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=gumgum2&bsw_param=503c2303-1534-4098-b63f-c1bd8262953e HTTP 302
https://usersync.gumgum.com/usersync?b=bsw&i=503c2303-1534-4098-b63f-c1bd8262953e&gdpr=&gdpr_consent=&us_privacy=

Request Chain 111

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28r_35w56fXvt4sqV4qJTdl3aCIzztknmG1u8Ctztvdg9MdgCzfV_DROP1lYFFaEdb%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28r_35w56fXvt4sqV4qJTdl3aCIzztknmG1u8Ctztvdg9MdgCzfV_DROP1lYFFaEdb%29 HTTP 302
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&obuid=ENC(r_35w56fXvt4sqV4qJTdl3aCIzztknmG1u8Ctztvdg9MdgCzfV_DROP1lYFFaEdb) HTTP 302
https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D

Request Chain 112

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
https://usersync.gumgum.com/usersync?b=opx&i=8ea94d70-ea6a-0c65-2103-45fab4632c43

Request Chain 113

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=&gdpr_consent= HTTP 302
https://usersync.gumgum.com/usersync?b=sta&i=0-35d1521b-f6b0-5fb7-7d95-65b5470920a1$ip$38.132.118.67

Request Chain 114

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=&gdpr_consent= HTTP 302
https://usersync.gumgum.com/usersync?b=oth&i=y-JbW51stE2pew3Uejmj1trF233cIrEJJVm97c~A

Request Chain 115

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
https://usersync.gumgum.com/usersync?b=vnt&i=5bf92233-d79f-4542-a466-a3e35ba1da1f

Request Chain 116

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D HTTP 307
https://usersync.gumgum.com/usersync?b=snc&i=E38C30D9BA97405BB79CACF9A2C6426C

Request Chain 118

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__ HTTP 302
https://stags.bluekai.com/site/23178?id=s7kuEnhvI7wdGswMrdsJ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTJHVZTO23VIVXGQ5SJG53WIR3TO5GXEZDTJI HTTP 302
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTJHVZTO23VIVXGQ5SJG53WIR3TO5GXEZDTJI HTTP 302
https://usersync.gumgum.com/usersync?b=zem&i=s7kuEnhvI7wdGswMrdsJ

Request Chain 119

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
https://usersync.gumgum.com/usersync?b=idi&i=9f467434-44d2-4849-830c-d907f0ee0ce2

Request Chain 120

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
https://usersync.gumgum.com/usersync?b=pln&i=gxKKHkVNd6xy&ev=1&pid=558355

Request Chain 121

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=&gdpr_consent= HTTP 302
https://usersync.gumgum.com/usersync?b=sad&i=4002225585452661977

Request Chain 126

https://match.adsrvr.org/track/cmf/openx?oxid=7994e900-c27f-3433-4678-55177c332d05&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/openx?oxid=7994e900-c27f-3433-4678-55177c332d05&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=7994e900-c27f-3433-4678-55177c332d05&gdpr=0&gdpr_consent=

Request Chain 127

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTVmYjNhY2EtMGIwOC02YTk3LTUzOTgtMGZhZWI2ZDFlMzY1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTVmYjNhY2EtMGIwOC02YTk3LTUzOTgtMGZhZWI2ZDFlMzY1&google_tc=

Request Chain 128

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc= HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPceqjnfL9XSWeRBuSOvK5A&google_cver=1

Request Chain 129

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
https://usersync.gumgum.com/usersync?b=mmh&i=a0856495-051b-4700-b552-e42be4745fc4&gdpr=&gdpr_consent=

Request Chain 131

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=&_test=ZJUFGgATwZwDugBS HTTP 302
https://usersync.gumgum.com/usersync?b=atm&i=ZJUFGgATwZwDugBS&gdpr=&gdpr_consent=&_test=ZJUFGgATwZwDugBS

Request Chain 132

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81MDZkN2NjZC1kNzJlLTQzNmUtOTg1YS0zYzE2YWExZjlmZmM=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81MDZkN2NjZC1kNzJlLTQzNmUtOTg1YS0zYzE2YWExZjlmZmM=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv&google_tc=

Request Chain 134

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJUFGsWwGwEDkgDk9JCJHgAA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm=&google_sc=&google_hm=ZJUFGsWwGwEDkgDk9JCJHgAA&google_tc= HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECPYshnhw3zk7QRg3S5CGcw&google_cver=1

Request Chain 135

https://match.adsrvr.org/track/cmf/casale HTTP 302
https://match.adsrvr.org/track/cmb/casale HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&expiration=1690079771&gdpr=0&gdpr_consent=

Request Chain 136

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJUFGsWwGwEDkgDk9JCJHgAAAB8AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm=&google_hm=ZJUFGsWwGwEDkgDk9JCJHgAAAB8AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=&google_tc= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEAOkSRufFYkYGw1YDIY98VU&google_cver=1

Request Chain 137

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdsum.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D190%26external_user_id%3D%24UID HTTP 302
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2437852161117978659

Request Chain 139

https://c1.adform.net/serving/cookie/match?party=29 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=29 HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=8178002886123411338&expiration=1688697371

Request Chain 140

https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=ZJUFGsWwGwEDkgDk9JCJHgAA%26031&gpp=&gpp_sid= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f610ffa-737c-4848-a9e6-83dff33b6fdd-tuctb8e8a9b

Request Chain 143

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent= HTTP 302
https://usersync.gumgum.com/usersync?b=ttd&i=7b45d823-797c-407a-919e-fb1a2f32ebf2

Request Chain 144

https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s0AAHSSWRgAAAAA

Request Chain 145

https://cs.admanmedia.com/sync/gumgum?puid=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=&gdpr_consent=&ccpa= HTTP 302
https://usersync.gumgum.com/usersync?b=aad&i=cdeddcb7-abea-41d3-a235-dbc2f2b8f778

Request Chain 147

https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
https://usersync.gumgum.com/usersync?b=rth&i=v6oecdCPtA1mG0MxQnCr&pi=gumgum&tc=1

Request Chain 148

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
https://eus.rubiconproject.com/usync.html?p=gumgum

Request Chain 153

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8le1F3rdRI-DChiBaFOUwQ%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8le1F3rdRI-DChiBaFOUwQ%3D%3D&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Request Chain 154

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=F257B517-7ADD-448F-830A-1881685394C1 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=F257B517-7ADD-448F-830A-1881685394C1 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%252C%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%2C%2C

Request Chain 156

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent= HTTP 302
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F257B517-7ADD-448F-830A-1881685394C1&vxii_pid=12&vxii_pid1=10067&vxii_rcid=aa130dac-a4ca-432e-b171-f278267bf022

Request Chain 157

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjI1N0I1MTctN0FERC00NDhGLTgzMEEtMTg4MTY4NTM5NEMx&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjI1N0I1MTctN0FERC00NDhGLTgzMEEtMTg4MTY4NTM5NEMx&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 158

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEMzyFSASx939jsi03lt485I&google_cver=1

Request Chain 159

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:1C571F13044E47339E4121854C4234AF

Request Chain 160

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7290125297624499648&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 161

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=7b45d823-797c-407a-919e-fb1a2f32ebf2&gdpr=0&gdpr_consent=

Request Chain 167

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=LJ7YNEA0-K-1YFZ HTTP 302
https://usersync.gumgum.com/usersync?b=mag&i=LJ7YNEA0-K-1YFZ

Request Chain 168

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=LJ7YNEHC-21-EQWI HTTP 302
https://s.amazon-adsystem.com/ecm3?id=LJ7YNEHC-21-EQWI&ex=d-rubiconproject.com&status=ok

Request Chain 169

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/vNTzQAxqFBsM_G-Zm2XVfQ?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-m3vr_JBE2oKIwpmBBC_Fd4_25j5tHAFQKqgn6A--~A

Request Chain 170

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=mxPtqkoSQk6_O3RA0AjsPA&rk=usync-na HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=mxPtqkoSQk6_O3RA0AjsPA

Request Chain 171

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEP4EEpWDIIE_ntrsiP4seiU&google_cver=1

Request Chain 172

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo3WU5FQTAtSy0xWUZa HTTP 302
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDyuBfJuL4sYeoEPApyRkwA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo3WU5FSEMtMjEtRVFXSQ==&google_push=

Request Chain 173

https://token.rubiconproject.com/token?pid=36584 HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ7YNEA0-K-1YFZ

Request Chain 174

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=7b45d823-797c-407a-919e-fb1a2f32ebf2&gdpr=0&gdpr_consent=&expires=30

Request Chain 175

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NmM3ZTMwZDgyZDk4Mjg5ZmZiYzY4NzRhODQyMjUxYjA3MzAyN2E2Nw

Request Chain 179

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978477415877548149

Request Chain 181

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0856495-051b-4700-b552-e42be4745fc4&gdpr=0&gdpr_consent=

Request Chain 182

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent= HTTP 303
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDWFcwN0pLZ29BQUNNNVJTUUdtZw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AACXW07JKgoAACM5RSQGmg&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsyn%252Csas%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=syn%2Csas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AACXW07JKgoAACM5RSQGmg&pid=558502&do=add&gdpr=0 HTTP 303
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AACXW07JKgoAACM5RSQGmg&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3&gdpr=0 HTTP 307
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=3 HTTP 303
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AACXW07JKgoAACM5RSQGmg&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4%26userid%3DSMART_USER_ID&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=4002225585452661977&gdpr=0&gdpr_consent= HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACXW07JKgoAACM5RSQGmg&gdpr=0&gdpr_consent=

Request Chain 183

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent= HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_65ee040f9e244c04b7bff

Request Chain 189

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F257B517-7ADD-448F-830A-1881685394C1&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-MYIr0gtE2uUuBN6uea.6UIKGaKeH15A-~A&gdpr=0

Request Chain 191

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent= HTTP 302
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=af9cf83e3a5062d&is_secure=true&networkId=17100&version=1&nuid=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAB8cKqck5xvANDgdymAAAAAAA&expiration=1687574174&nuid=F257B517-7ADD-448F-830A-1881685394C1&is_secure=true&gdpr_consent=&gdpr=0

Request Chain 192

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=5bf92233-d79f-4542-a466-a3e35ba1da1f&gdpr=0&gdpr_consent=

Request Chain 193

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://rtb2-useast.marketiq.com/sync?exchange=685&ssp=pubmatic&bsw_param=503c2303-1534-4098-b63f-c1bd8262953e HTTP 302
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.marketiq.com%2Fsync%3Fexchange%3D685%26ssp%3Dpubmatic%26bsw_param%3D503c2303-1534-4098-b63f-c1bd8262953e HTTP 302
https://rtb2-useast.marketiq.com/sync?adkuid=A6020429032800635758&exchange=685&ssp=pubmatic&bsw_param=503c2303-1534-4098-b63f-c1bd8262953e HTTP 302
https://x.bidswitch.net/sync?dsp_id=458&user_id=A6020429032800635758&expires=5&ssp=pubmatic&bsw_param=503c2303-1534-4098-b63f-c1bd8262953e HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=503c2303-1534-4098-b63f-c1bd8262953e&gdpr=&gdpr_consent=&gdpr_pd=

186 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Redirect Chain

https://www.baesystems.zip/
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks//
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

127 KB
28 KB

1191ms
1159ms

Document
text/html

2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac8cd48b7a9d1e1e1e9bb3939b1f76cfaf430ab142be8d36593b0a4b8204e6ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0
cf-cache-status: DYNAMIC
cf-ray: 7db957642b9edb2d-MIA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 23 Jun 2023 02:36:06 GMT
expires: Fri, 23 Jun 2023 02:36:05 GMT
link: <https://www.ghacks.net/wp-json/>; rel="https://api.w.org/", <https://www.ghacks.net/wp-json/wp/v2/posts/194771>; rel="alternate"; type="application/json", <https://www.ghacks.net/?p=194771>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zc9qWcbgUd1AUgN0K9dDDFjIXHnomAwO4VbeUVv7TrabRF5qHBUMVKOavDdJnzB2csjoWeVJjEVrchnbuf6elqVww%2BQ2Xcswy%2FGv11UmhE2Mua8vlSAccam31y9YMVuK3XjO76wolBjImIUp"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff nosniff
x-xss-protection: 1; mode=block 1; mode=block

Redirect headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 7db9575eaecedb2d-MIA
content-type: text/html; charset=UTF-8
date: Fri, 23 Jun 2023 02:36:05 GMT
expires: Fri, 23 Jun 2023 03:36:05 GMT
location: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zhxl2%2BUT4lguxFpxmMVSD5k%2B6U5XpaSKZpNgPYxeHbHPlkAJvsAJaf8FxFvoSffEoeJd1Uwf60HDL9Y9c80PDVHi9WtUf%2BwxXsQbVC5kZjWRJZmsKmGt%2B0AcPwNjf1FDY%2B1DbLe87qw%2F10hK"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff nosniff
x-redirect-by: WordPress
x-xss-protection: 1; mode=block 1; mode=block

GET
H2 200 style.min.css
www.ghacks.net/wp-includes/css/dist/block-library/ 79 KB
11 KB 73ms
66ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/css/dist/block-library/style.min.css?ver=5.8.7

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2316976
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 17 Jan 2022 06:40:42 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cyNsY%2BYwC%2Fuza77iIjjpT8prWpMQ0Vvr%2Fl%2FnfL32YwsH2euzmEjWJRD3YadMtL1oUcIgAxOPQH%2Frqak2AC8TiZWOVyLZMgLFSVjdbBLqR3CPXBhBIqGfPy9pyHtvHVFNTiaoWJzMa%2BK3dveW"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bcdf6db2d-MIA
expires: Sun, 26 May 2024 06:59:50 GMT

GET
H2 200 slick.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/ghacks-post-slider/assets/css/ 1 KB
781 B 55ms
49ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/ghacks-post-slider/assets/css/slick.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9615d053779f17698d32327e1fe8296c8fb45353770837879e4795f9c28cad38

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 126807
cf-polished: origSize=1474
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JkhvoH7jVP3z5Jqg4AA5pjfXvAudG2PHhKmdLjk8m083uPi2KsEB9OdxIitQGqNJojOj5ZWGj8ZQg2OwsVQshwubpiqpVf6ZI2dk90TBTnqtrDF18QBKHvAhCtqbZeBZUU%2B8W0ZXHX9Drfyh"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bcdfadb2d-MIA
expires: Thu, 20 Jun 2024 15:22:39 GMT

GET
H2 200 recent-post-style.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/ghacks-post-slider/assets/css/ 7 KB
2 KB 60ms
54ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/ghacks-post-slider/assets/css/recent-post-style.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2464528204e216b4f6b2e8f52b577c86621d2297d0f0b69e848abe643aa6896c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1190115
cf-polished: origSize=6976
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L42%2Bscyo6AYPHun7xEwI4C%2F0vc2%2FXAgbdtDnfdndpcrbs77rK8bkogKl%2F1pMFyTIJPmB4s5GrXylpPJ4BYPoaTF1NXgecJu0UXjz0fHkEXDF1u8WJQmav1PqJmed5skg%2FUlbNkpBcgsUwSkz"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bcdfedb2d-MIA
expires: Sat, 08 Jun 2024 08:00:51 GMT

GET
H2 200 swiper.min.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/my-custom-functionality-master/assets/css/ 13 KB
4 KB 52ms
47ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/my-custom-functionality-master/assets/css/swiper.min.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11ec9bb8e81592df9f2c0e18c6dae852561b7ed0dca2d47d5dc50edc8d2a90a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 126807
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vDq9PJBu2mSxpfLomtGwW86QWqMg5ozyii7yk6hl46ONs0Pa3WpstlDpSOCVkXM18bMh05h%2BDASUNyKV4nXgq7EAjw8Q%2FyXW0vIcNt7hiFc%2FB0NsdtFdr0pwSGhB%2Fl5S%2FMZbM9j1rFmPMcM%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bce02db2d-MIA
expires: Thu, 20 Jun 2024 15:22:39 GMT

GET
H2 200 notix-public.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/notix-web-push-notifications/public/css/ 1 KB
784 B 49ms
43ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/notix-web-push-notifications/public/css/notix-public.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6738331b4ac9f5a9c6c2cad8fa28ea9a6834d28bdc5ebcb545ec7a4acd6795e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1190115
cf-polished: origSize=1107
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tUFlSAAtQopRYXCPxfkZVa9SnvwWzeMR64ate7vEIKm91R1F0sp98uLCHj0ol0Azd2BDThIlLVSdXPc0JAkx9j1ZFTb%2BC4sXmgnKwTAxfo6iC2bz%2BbEgPZZj3Jqghq%2FD2m8TJ8FkCCph1wYY"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bce03db2d-MIA
expires: Sat, 08 Jun 2024 08:00:51 GMT

GET
H2 200 dashicons.min.css
www.ghacks.net/wp-content/cache/min/1/wp-includes/css/ 58 KB
35 KB 60ms
55ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-includes/css/dashicons.min.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8276d99808a3a111dcb2dc61c895388c21341d48be9c3f87d905787a49c2b832

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1190115
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NJRPg%2Bey6lfxRIeUja7vtAp0%2BhWQVOgp4aLolkZZqPo2LzRwNg1bcN15P9Iv%2F5nWHCcD%2FGwERzm7ZZMGndHm1atd6HKQeAgyq1PlvsM0BhL5g3t75mGZPLk84DroDzgm9gUQvilxo404KIQC"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bce06db2d-MIA
expires: Sat, 08 Jun 2024 08:00:51 GMT

GET
H2 200 style.css
www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/ 242 B
497 B 53ms
48ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/style.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e808c4a589bbe7ad73f3e66b99f651c32d1a10079973e9db31bd2cce64855c16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 122621
cf-polished: origSize=245
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v%2BydZGVYUl1hEgg5hAngJivf74%2FQMglQocjMOzquc0fy2qRPp4bWh9mXtQUpvTp1zhZn1kNP7999RabcDXhzC3XJmwztzl2AOD31IswcFrNkFyRVDNgLVLNRXpUmjiTkcJo5Hv%2BkssTQocp2"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bce07db2d-MIA
expires: Thu, 20 Jun 2024 16:32:25 GMT

GET
H2 200 single.css
www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/ 23 KB
5 KB 66ms
61ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/single.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7378fe642cc87c3a1343b20efdd53f4e560319daf19f95c4312163a3b788585c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1190115
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l1Rdv%2B0VFEIj%2FNyyQchZENdSweftdBjN6CX2KWCg8FhA7S9cbqQxwVBU8BB5Cw7iXm%2FPFkqowhSGUab8ej%2BhE3UsxirrFiYeYY%2B9%2FJvx3lAmEAvVjUheliNk1x1RFf38pI8JtSHsBbTExUjr"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bce09db2d-MIA
expires: Sat, 08 Jun 2024 08:00:51 GMT

GET
H2 200 tablepress-combined.min.css
www.ghacks.net/wp-content/cache/min/1/wp-content/ 5 KB
2 KB 57ms
52ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/tablepress-combined.min.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3664be3a8c387d48a6ba88f70f557117597213f1d377d6b54810de6a6abe20c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 126807
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J5DQ9ofK2WzDsajC5xiQQILBneX8%2BUok1EG1DBtclN3asMamcwYjOCsjvxKvGIr3H8lgMMZoqNPk7C6NRIOPFgw7nw2hMn2uiKsuk4hSJu35dZtPNL5QYiq7Jx43R5iCBcVvEgjKMy%2BEu48g"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bce0bdb2d-MIA
expires: Thu, 20 Jun 2024 15:22:39 GMT

GET
H2 200 tablepress-responsive.min.css
www.ghacks.net/wp-content/plugins/tablepress-responsive-tables/css/ 9 KB
2 KB 68ms
63ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/tablepress-responsive-tables/css/tablepress-responsive.min.css?ver=1.8

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228582
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 30 Sep 2021 13:17:37 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IjE9s3cNNsMCQIwvop7EqCpSMM%2F4DK%2BVBQRq%2F6M37KF%2FG5jnqQjjHkGhAJeNI8ycuuLgMeqx2X7WptWxOPkfO0qPONGJ7JZKyVRBdRKeOAAr6MVca6xBlRriKL1sWzJBLZ9USyJJA76%2FTDDS"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bce0fdb2d-MIA
expires: Tue, 05 Dec 2023 16:53:04 GMT

GET
H2 200 jquery.rating.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/all-in-one-schemaorg-rich-snippets/css/ 876 B
662 B 89ms
84ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/all-in-one-schemaorg-rich-snippets/css/jquery.rating.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8aa3471bd234c6963a168e8501f9aeb622c42ffe00fba96072a487f71a00029b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1190115
cf-polished: origSize=894
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=reAK1oqqx%2FYjIW0X%2BbL%2FkoYSkqqxXDsAy9H4ZdPiLS5gdm2lIYWt70QHnHdw%2Fj9QhBTTqKhR%2FwUcoiHcu8iTt5N9wwwI16ZnTjRP2dUlS%2FNTLk5sQAPop5XfQPgaPivu5LM%2FO%2Fl9ZYInDFn%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c0e8fdb2d-MIA
expires: Sat, 08 Jun 2024 08:00:51 GMT

GET
H2 200 style.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/all-in-one-schemaorg-rich-snippets/css/ 2 KB
885 B 93ms
89ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/all-in-one-schemaorg-rich-snippets/css/style.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b477c9694f19d0c1f986ba24a394caaf31be4d2b06e4df9b30be12f9cb1e76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 122104
cf-polished: origSize=1671
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OFuMXYqjvrJMROg8MQ4Gz5b8Hc0hupzjnZMdoJgneBbXxiN4Q70PBL7%2FW8KAh26e%2B7g7AOZ61J%2FnPXCi4KkMfSQRNuGdC5TmLHC1G9GbdPcKE%2BTOyjgcog5v1Qt6my7pBrHPkV%2Bba2odZYAJ"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c0e92db2d-MIA
expires: Thu, 20 Jun 2024 16:41:02 GMT

GET
H2 200 jquery.min.js Show response
www.ghacks.net/wp-includes/js/jquery/ 87 KB
32 KB 100ms
96ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2316976
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 17 Jan 2022 06:40:43 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GpUBA6vUoW%2Fa7qfXrtxzBOKC%2BdoKkhOOSzKTUEya9Uk47%2FothCUjZZKc52l%2FDqtTTT1xbwu%2FtPiyRGdzVnfF2Da%2BSIQ6FhCE4BMRtclugHTf0DF%2BgTLQlCY2BI5fcwpz9hfic%2F0Ow3P0fNft"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c0e94db2d-MIA
expires: Sun, 26 May 2024 06:59:50 GMT

GET
H2 200 jquery-migrate.min.js Show response
www.ghacks.net/wp-includes/js/jquery/ 11 KB
5 KB 43ms
42ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 13074251
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 25 Feb 2021 15:04:44 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b%2BE0llgEjBnZ2qa2uj%2ByapYfj2uU3PleHglgbeqqvyrLbw0WsA5My6jENLmPxk%2B0Jbmfl7P3nQ%2FsKBEbhmgL34XxlylR23tUz9mjAgEB9TDclytXxWQPF4Rxx1fnebGO%2BjWGtGEG6F63Klbu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576cd857db2d-MIA
expires: Mon, 22 Jan 2024 18:51:55 GMT

GET
H2 200 notix-public.js Show response
www.ghacks.net/wp-content/plugins/notix-web-push-notifications/public/js/ 37 B
369 B 202ms
47ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/notix-web-push-notifications/public/js/notix-public.js?ver=1.1.1

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1e8df27eefed0250a8e2785a341a5d35d838d8136f4ffde3168c57e9137aa2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228581
cf-polished: origSize=838
content-length: 37
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Mon, 17 Jan 2022 06:50:03 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7eEMJZkCZ%2FUD1xzQncbQhidI2mAMbLmcCspwhzM2PJzRd0lDiq1m0%2FNMZS7MViXkqhoRxzeAR95lUBE%2FO3stp1Yq2632T1bzBLmFp09%2BVh6CG6TfLAD14IJ%2Btq6zMBHhZy5zhIx%2BHxRkl1nO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 7db9576e7c09db2d-MIA
expires: Tue, 05 Dec 2023 16:53:05 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 361 KB
121 KB 420ms
107ms Script
text/javascript 2607:f8b0:4020:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js?ver=1

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed3307c62c0d78bf73af142b4c660e3257374d97385b2f50b28b1003a5c00513

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 123120
x-xss-protection: 0
expires: Fri, 23 Jun 2023 02:36:07 GMT

GET
H2 200 api.js Show response
www.gstatic.com/readaloud/player/web/api/js/ 464 KB
159 KB 488ms
0ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/readaloud/player/web/api/js/api.js?ver=1

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3e051a82490a96f88cc2342630f59cac4c7c4bcab275ee30f9cbecd8e8a62b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:20:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/speakr
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 162572
x-xss-protection: 0
last-modified: Tue, 20 Jun 2023 14:28:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="speakr"
vary: Accept-Encoding
report-to: {"group":"speakr","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/speakr"}]}
content-type: text/javascript
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Fri, 23 Jun 2023 03:10:29 GMT

GET
H2 200 jquery.rating.min.js Show response
www.ghacks.net/wp-content/plugins/all-in-one-schemaorg-rich-snippets/js/ 29 KB
11 KB 276ms
121ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/all-in-one-schemaorg-rich-snippets/js/jquery.rating.min.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

554f3ff96cba4f2f33ff2c37c48282006ab24a85cf9ca0ac8b22b0a06126c1d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 13074009
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 17 Jan 2022 06:50:41 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IAi0K9660bCUySTgEcn1Ydtto%2F5M3g%2BbrTUiXV3m%2FWCOc7Iiq2H97l9e4bYnERfK1zPN7TqVvmAqXu364ETKQUDOgBGDI9rccWu5bVvJ50%2BPokH44FxbBFWkyMxBwBEPlG5TyoXmbXihVUkQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576e7c0bdb2d-MIA
expires: Mon, 22 Jan 2024 18:55:57 GMT

GET
H2 200 polyfill.min.js Show response
polyfill.io/v2/ 100 B
681 B 616ms
23ms Script
text/javascript 2a04:4e42:200::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v2/polyfill.min.js?features=fetch

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 23 Jun 2023 02:36:07 GMT
age: 1444054
detected-user-agent: Chrome Mobile/114.0.0
useragent_normaliser: chrome/114.0.0
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=4
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 113
referrer-policy: origin-when-cross-origin
last-modified: Wed, 03 May 2023 00:17:37 GMT
fastly_service_version: 195
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
normalized-user-agent: chrome/114.0.0
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 77 KB
26 KB 1099ms
169ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08184568b41f4a1b579301887aaa8f60958c9aefa33617c09b0fe10d521fd00a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26416
x-xss-protection: 0
server: cafe
etag: 20 / 19531 / m202306150101 / config-hash: 11591319961802778394
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 23 Jun 2023 02:36:07 GMT

GET
H3 200 prebid.js Show response
spn-v1.revampcdn.com/prebid/ 223 KB
64 KB 276ms
121ms Script
application/javascript 151.101.193.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/prebid/prebid.js
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 151.101.193.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 70d9311702ac457eb90a7133063593c379191d9d9ca1d3c9549d78481283be6f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1138.0
date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: br
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
age: 92520
x-cache: HIT, HIT
x-envoy-upstream-service-time: 47
x-region: NY
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 65207
x-request-id: ebe7c965-b8ac-4e77-983f-31ec01d5ddbf
x-served-by: cache-ams21069-AMS, cache-mia-kmia1760090-MIA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-platform-id: Windows 10
server: istio-envoy
x-timer: S1687487767.826464,VS0,VE2
etag: W/"2ee0925227babc3bbd91d16ceed0b888"
x-browser-name: Chrome
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=172500, public, s-maxage=172800, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
accept-ranges: bytes
x-country-code: US
x-cache-hits: 164, 1

GET
H2 200 ghacks.js Show response
spn-v1.revampcdn.com/publishers/ 250 KB
53 KB 304ms
164ms Script
application/javascript 151.101.193.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 124e61a3b158acb4ab3d8b81c92f3d11d3444ae08413e03e23aa4c14ea4d308a

Request headers

Referer: https://www.ghacks.net/
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1140.0
date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: br
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
age: 3596
x-cache: HIT, MISS
x-envoy-upstream-service-time: 350
x-region: NY
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 53454
x-request-id: 85845830-d70a-45e5-8fba-548261bb8b43
x-served-by: cache-ams21024-AMS, cache-mia-kmia1760087-MIA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-platform-id: Windows 10
server: istio-envoy
x-publisher-id: ghacks
x-timer: S1687487767.506040,VS0,VE118
etag: W/"3e8e50d8958c079a0b33cf131d941b9c"
x-browser-name: Chrome
vary: Accept-Encoding,x-device-platform
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=172500, public, s-maxage=172800, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
accept-ranges: bytes
x-country-code: US
x-cache-hits: 18, 0

GET
H2 200 email-decode.min.js Show response
www.ghacks.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 84ms
77ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 15 Jun 2023 10:17:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"648ae541-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4wZDKJg7bQIk7zaKiX4jr1rzrGwImLQItqCLvq8iccrhap5%2FzI%2FlytQPoeI6pXhHQO5gDHjB456njMwyIiKt%2BwqCprrmyUX0c%2FRzbgY0dFDLKBN4rISIolW7kNNbtuzyGk0EHWN%2Fit1rISVM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7db9576c0e98db2d-MIA
expires: Sun, 25 Jun 2023 02:36:06 GMT

GET
H2 200 affiliate-link-shortcode.css
www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/ 1 KB
870 B 90ms
84ms Stylesheet
text/css 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/affiliate-link-shortcode.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e4ea1a836c9e61ca541b43dec61bcd3314ee017b899177e00355034775adce14

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1190115
cf-polished: origSize=1544
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G0KVxGW5npghZr12nw4S3q7JG5N2RLoRq2%2Ba1TEog5yJpCWRQHWkwKiDu88U5KTPPhEfI6VCBdhnxaKNfHd34iwi8%2FdnZ5bypLaeCLAdzVzcxAG0OH3Lsfod88I7BbwXHwpGF7MOwD4xCS5g"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c0e97db2d-MIA
expires: Sat, 08 Jun 2024 08:00:51 GMT

GET
H2 200 frontend.js Show response
www.ghacks.net/wp-content/plugins/geoip-detect/js/dist/ 20 KB
8 KB 170ms
37ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/geoip-detect/js/dist/frontend.js?ver=5.0.0

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b13fc50b6ed0a616dc2581175f19de22c59207a54ab0099f32b96c5e13fd71d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228578
cf-polished: origSize=20717
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Mon, 17 Jan 2022 06:49:32 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OdNH4DaVVfZw3T%2BvNPkqsMa8xc1FJDBJ6iwx3GwfQJ79vom%2FlRMP9BbhtY0GW1K9py5Zcto6%2FRbR%2FyX%2BCdq%2B1F8RccVULb0Qa6RTilidcbxoUSnwveWp2Z%2BWFLelkZG4nvLmuApHGb7G3%2BUS"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576e7c0ddb2d-MIA
expires: Tue, 05 Dec 2023 16:53:08 GMT

GET
H2 200 swiper.min.js Show response
www.ghacks.net/wp-content/plugins/my-custom-functionality-master/assets/js/ 133 KB
35 KB 181ms
48ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/my-custom-functionality-master/assets/js/swiper.min.js?ver=9.9.0

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d36ac645d9f3443fe2b4ee6306a14b305bc3d93f3ed72e913d067d02200e889c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228578
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jul 2021 09:37:48 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i8g3%2BFO6UEQKbHkcNKePMi8oPrgFyjaUlzolUa%2BFpwwTXos0DzTnxUqE1lIN8k2qRwcMYMUgQidNZbp%2BicnbLkjzAikzI8aExhujrvlMZZHeY2CYjZ1yCtW0DgwvnnYAuTR3%2Bvpmm5spsq6c"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576e7c0fdb2d-MIA
expires: Tue, 05 Dec 2023 16:53:08 GMT

GET
H2 200 rmp-menu.js Show response
www.ghacks.net/wp-content/plugins/responsive-menu/v4.0.0/assets/js/ 7 KB
2 KB 174ms
41ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/responsive-menu/v4.0.0/assets/js/rmp-menu.js?ver=4.2.0

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25d617eac8e9a101e470e45fefe975a9c7c7420f5d3f0eff1a3ffe6a535a03dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2014734
cf-polished: origSize=10883
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Mon, 21 Nov 2022 18:21:27 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h8dhK6vQMrd08kkNvkc2o6PnIHSRcULO%2FjVwtiMQrdZLmHGfuuYJuRUtOiUwPs0StL0INwFZ3BQ8nVHUFjfY3pngzLG7GGVBbjimsyvUvO3odEEbWBPs%2Bn9xTOzgBaAQbIwvvHbkU4EP9GYu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576e7c13db2d-MIA
expires: Wed, 29 May 2024 18:57:12 GMT

GET
H2 200 scripts.js Show response
www.ghacks.net/wp-content/themes/new-ghacks-preview/ 711 B
792 B 175ms
44ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/themes/new-ghacks-preview/scripts.js?ver=1.2.3.4.26

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42acc026706304b5193dbb474671c1258d2ab58d51512fa283e2ec02718fc531

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 13074251
cf-polished: origSize=792
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 12 Nov 2021 11:58:46 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SVfgWyTwQi4oD6WCk26KQ%2FzhJ6WlDlWPz0WhH1bmUTXLYCTn4L6MhWbQhjNVw20KuMTSg4s%2FTY30rkjfu%2FhabuhHe0O8WlM8xL7PdP11R9qk94ZAHRM7BiaXCB2Mv4iAU6N%2BdxO47oj7qGtj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576e7c14db2d-MIA
expires: Mon, 22 Jan 2024 18:51:55 GMT

GET
H2 200 comment-reply.min.js Show response
www.ghacks.net/wp-includes/js/ 3 KB
2 KB 251ms
120ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/js/comment-reply.min.js?ver=5.8.7

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2316976
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Sun, 18 Apr 2021 15:10:03 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qX2t337fiZq0%2BDbpVow3KfLlkggFweAKtvfTLX1CgXsX6SUkYNHzWhilyj5vUb9I%2BY53sqoPuRGtn%2BarnPdw3sWyDJZly1vkZhBDVjK2AyYkPVDWPynqZq3zp3lEfUBuK2I9xI9o2y4kCWDM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576e7c15db2d-MIA
expires: Sun, 26 May 2024 06:59:50 GMT

GET
H2 200 revamp-infinite-leaderboard.js Show response
www.ghacks.net/wp-content/themes/new-ghacks-preview/ 4 KB
2 KB 175ms
45ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/themes/new-ghacks-preview/revamp-infinite-leaderboard.js?ver=0.2

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eee2cc0688e4321b02687d1644a880232b97ba8bbaa2effb391b98da84cb408f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4378088
cf-polished: origSize=5368
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Wed, 03 May 2023 10:15:21 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=koeu340g%2BcmYhL%2FWxcoKnSnKVhhEINPAiNosj9%2BPJcSAH8EcBFLxPT0T5ahzzPkmLltr6FXCQb30Nf%2FdNhe0M3rVCrtN5wE9OiT50B4gjWk%2FMtqCxFDXwu8uqZa8lUYZVSK%2B7fdh1NWxa9gR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576e7c16db2d-MIA
expires: Thu, 02 May 2024 10:27:58 GMT

GET
H2 200 wp-embed.min.js Show response
www.ghacks.net/wp-includes/js/ 1 KB
1 KB 248ms
122ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/js/wp-embed.min.js?ver=5.8.7

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a482d2d94c0d1bc6937a1759389d01b475e6b28a0d9b5d7eaa3f9cc8f59f3cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2316976
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Tue, 16 May 2023 21:46:29 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FkR01FNvnnm9wa%2BRM8XvymFOX9udIYFMuZeeDziZ%2BGQwM5rWtLZaj1aS1wAWyS2mrnLpHM6JCRj0dNFD6O1Vwd2vlH7LvSvAAFN3L3rzKSliSTHEAx3B9agJEXmM4rAMh6FQjv5i7tH3WGO0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576eac68db2d-MIA
expires: Sun, 26 May 2024 06:59:50 GMT

GET
H2 200 lazyload.min.js Show response
www.ghacks.net/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ 8 KB
3 KB 250ms
124ms Script
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228577
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 17 Jan 2022 06:51:30 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xCwchB37UyASZqrBeY2QlSTWrNFdAWPYEx4dxj5MH6GiJ3cpS3eGpu0dKqMzovEA2uSHL8fNDORqQUtoM%2BIyZ6W7Yl5vgA8MFOCAe%2BMgDUWjGH2cSMI2Shl5RSZGDqVEbcHAZ1T4oAiToMHu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576eac69db2d-MIA
expires: Tue, 05 Dec 2023 16:53:09 GMT

GET
H2 200 dfp.js Show response
www.ghacks.net/statics/ 106 B
414 B 196ms
32ms Fetch
application/javascript 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/statics/dfp.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aea4e7430290383948b2c8a639f25a8a6998ee0cba5eba1f49de44b34f6d1487

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228581
cf-polished: origSize=110
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Mon, 06 Jul 2020 09:03:09 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dcVHWAgnxCiT9ZnLldBXdaVP%2Fjyo%2BxjesnzG0U8LseAtLHj6V90Vb1s5ZwrJMCjCVvGfeHABG5L7A2rjAdEWd3Whad76kuMbwcuQoB%2BvYfAesFm9zjavhwKDXV6%2BWaSkRf8lo3Al9anLtPYP"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576e7c05db2d-MIA
expires: Tue, 05 Dec 2023 16:53:05 GMT

GET
H2 200 px.gif Show response
www.ghacks.net/statics/ 68 B
438 B 194ms
30ms Fetch
image/gif 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/statics/px.gif

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5788121
content-length: 68
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 13 Aug 2020 14:05:45 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3UHtvmRkwKdc2FTAf88P%2BJ7y7HrkeXKxKP1aZsdok2LIwCmfsNBjYTrj1F8lp%2FUNbl2sSbMizIsWvD5PgvVlgszGvemAgdOS2quHWlzsA%2Fnw%2FpPoEmrusCLwv8ZUD5lfatiIn4kt8p2mvQox"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public, max-age=10368000
accept-ranges: bytes
cf-ray: 7db9576e7c07db2d-MIA
expires: Tue, 15 Aug 2023 02:47:25 GMT

GET
H2 200 enot.min.js Show response
notix.io/ent/current/ 90 KB
26 KB 833ms
276ms Script
application/javascript 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/ent/current/enot.min.js
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 00bf6629654c4bdef1a8aacb834c7522d0798c4fc681fb85761e3b9ae2913db6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:35:59 GMT
content-encoding: gzip
last-modified: Wed, 21 Jun 2023 16:09:29 GMT
server: nginx
etag: W/"649320b9-1675a"
content-type: application/javascript
cache-control: no-cache
access-control-allow-credentials: true

GET
H2 200 loader.js Show response
sdk.privacy-center.org/a8ff32f4-78c7-4428-825d-0badb488b68b/ 54 KB
12 KB 639ms
86ms Script
application/javascript 2600:9000:24f3:7200:5:b7cc:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.privacy-center.org/a8ff32f4-78c7-4428-825d-0badb488b68b/loader.js?target=www.ghacks.net
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f3:7200:5:b7cc:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e47839620ae791505f14bcf06a9ada7a2ecf1a0268cbda2c9efc883d77558449

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: gzip
via: 1.1 e71e9c9156db978f5f1b9e1ec8ca9458.cloudfront.net (CloudFront)
x-didomi-remote-config-source: Lambda
server: CloudFront
x-amz-cf-pop: IAD55-P2
age: 2470
etag: "655cd1060229c5692fb1e7c9b958a121"
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: max-age=7200, public
content-length: 12312
x-amz-cf-id: _kQhLVlQJf9pc3dzF4pUOaHSIg7F8xaz-SRD7CFfPaMdTmjpSjrhLw==

GET
H2 200 marfeel-sdk.js Show response
sdk.mrf.io/statics/ 112 KB
31 KB 623ms
315ms Script
application/javascript 2606:4700:3033::ac43:9fa2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=2544
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:9fa2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59cb9485f12fbd706268412d6ac360905369d2aca4889973b8fbfe8ba834db2a

Request headers

Referer: https://www.ghacks.net/
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-response-time: 2ms
date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Fri, 23 Jun 2023 02:26:33 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=1800
x-envoy-upstream-service-time: 6
accept-ranges: bytes
cf-ray: 7db9576f98590992-MIA
alt-svc: h3=":443"; ma=86400
content-length: 31571

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 112 KB
29 KB 345ms
68ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 23 Jun 2023 02:36:06 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 28296
x-xss-protection: 0
pragma: public
x-fb-debug: TUf/Gzx0YyTPb3jMU9hmwZLBI1q/bSaBW8R2tNDbdD+xZC7i/cEfE4/1QxrtZM4MqspwnAf+oHpEsceCV620fA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 134 KB
51 KB 398ms
119ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NHW6RDK

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2b82501522d0253e83dbf9b23cee0f17ecdddecae1a9a3db36c7c8f08d530645

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52081
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Jun 2023 02:36:07 GMT

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e00e9bc52a415fc6e22f2332ba8c16d996f59962d5d80ff84f2de86b23782e2d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4919ddf6337285052dc0fe47fd60298fceb2679267a3fd1a85938d2b52538ef2

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec922a202c99fe67c6a7a2d4cddb5947f4f9ba6a501768b9900114d32ab43315

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9cca958d544314da08debbbdc0614a7310a50846cf880c26746104cde227de84

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75e0fe33a139622cde1d4bacdef52e609e623b514c56b113c69568fa16c23a12

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aaf69f969c85107828b863ad90f70534c60fc64cbb1a7f3e28d78692d8854db5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3b0c961624b56351ac1fdcfed1a3ce5c68e73921d08887d89713a1d0df83427

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 search-icon.svg
www.ghacks.net/wp-content/themes/new-ghacks-preview/images/ 894 B
962 B 216ms
124ms Image
image/svg+xml 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ghacks.net/wp-content/themes/new-ghacks-preview/images/search-icon.svg

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/single.css?ver=1686297620

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c56ae0ce6a61669700b75187f654ea8b5fe23cb1377e463c7fc93d052eade027

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/single.css?ver=1686297620
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 126805
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jul 2021 09:43:09 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7DHV%2FYkofwH6tNKafJy%2BUCpRi224HB%2FC%2BF07%2FbWuOb4aNBtygCJYq51f5q3k2%2By4OMEevF1xKZItZqESoiwf4%2Fvd9K1JT0xlprIgynddoQl%2Bf%2FraCiDAuutxqkZdGpMUxY99tA4FsZlPmfD6"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 7db9576eac6adb2d-MIA
expires: Fri, 21 Jul 2023 15:22:41 GMT

GET
DATA 200
OK truncated
/ 384 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8564419bba762b0ce4e3bc45fe5c478fcdaac5cc92e78862ce30a6581e11a3f0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 datadog-rum-v4.js Show response
www.datadoghq-browser-agent.com/ 141 KB
45 KB 348ms
65ms Script
application/javascript 13.32.195.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.195.219 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-195-219.iad66.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9d8c5621c9f8cbe6b7a788a8f34d405a443c511cc5135f38452da0c6d901ba6d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:35:44 GMT
content-encoding: br
via: 1.1 aabff76d9515c67bc2758117b3e68446.cloudfront.net (CloudFront)
last-modified: Mon, 19 Jun 2023 09:41:15 GMT
server: AmazonS3
x-amz-cf-pop: IAD66-C1
age: 23
x-amz-server-side-encryption: AES256
etag: W/"f7e0ebdf291cb29f61bc6eff74446bf9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: oPUquJUPcqXzsPKxtKbFno-a-XsNVC9H0roQJpZXUxssS_NW0nWW9Q==

HEAD
H2 200 ghacks.js
spn-v1.revampcdn.com/publishers/ 0
0 120ms
20ms Fetch
application/javascript 151.101.193.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1140.0
date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: br
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
age: 3597
x-cache: HIT, HIT
x-envoy-upstream-service-time: 350
x-region: NY
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 53454
x-request-id: 85845830-d70a-45e5-8fba-548261bb8b43
x-served-by: cache-ams21024-AMS, cache-mia-kmia1760087-MIA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-platform-id: Windows 10
server: istio-envoy
x-publisher-id: ghacks
x-timer: S1687487767.235217,VS0,VE1
etag: W/"3e8e50d8958c079a0b33cf131d941b9c"
x-browser-name: Chrome
vary: Accept-Encoding,x-device-platform
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=172500, public, s-maxage=172800, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
accept-ranges: bytes
x-country-code: US
x-cache-hits: 18, 1

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 236 KB
58 KB 301ms
75ms Script
application/javascript 18.67.67.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.67.228 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-67-228.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:06:35 GMT
content-encoding: gzip
via: 1.1 a1157b69a14bebe8162237750a074fae.cloudfront.net (CloudFront), 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront)
last-modified: Thu, 15 Jun 2023 18:14:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, IAD89-P1
age: 1773
x-amz-server-side-encryption: AES256
etag: W/"7c6a36eb4b73f6b7cf4a63a33418a2c9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: lSNE64UwwTXKroipuPqgnyJSHhrw3tZPeazZ1p8J8SNunmrNY3eKig==

GET
H2 200 tag Show response
btloader.com/ 15 KB
7 KB 288ms
95ms Script
application/javascript 2606:4700:20::681a:78b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?o=5633429348548608&domain=ghacks.net&upapi=true
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:78b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02563f6dd488eac87d5c8280cdc49326a311cde34be86fe6ec5f5793385d7ad7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Fri, 23 Jun 2023 02:32:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"85918af2c3611aef454ef5c6285bc0b0"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RV022SLfE5iFrUJx%2Be2tJtGnxHxfoTf5N%2FYFTqnvEqtjSShqu3d0kf7S4DWm%2FYJIlGzjt5sTc%2B5188SL03%2Bzpn2ivbnDDZvbU%2FM24Qv8bEJVEu%2Fi%2B7UikCCXWLdIB8UEh8x5MxmgVFj4Aw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
cf-ray: 7db9577268d62577-MIA

GET
H3 200 https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F Show response
spn-v1.revampcdn.com/contextual/ghacks/ 315 B
895 B 90ms
49ms Fetch
application/json 151.101.193.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/contextual/ghacks/https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 151.101.193.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: ff481473ceb28fd40f49e1d1dce9a969cc0d52f89be7fd2c687044cc2ff98cce

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1140.0
date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: br
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
age: 236904
x-cache: HIT, HIT
x-envoy-upstream-service-time: 26
x-region: NY
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 153
x-request-id: 4225ac43-c1b9-4b52-8a19-2f79316b11dd
x-served-by: cache-ams21057-AMS, cache-mia-kmia1760079-MIA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-platform-id: Windows 10
server: istio-envoy
x-publisher-id: ghacks
x-timer: S1687487767.249070,VS0,VE1
etag: W/"063af77f2196cd23fab5a55029c48576"
x-browser-name: Chrome
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=2419200, public, s-maxage=2419500, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
accept-ranges: bytes
x-country-code: US
x-cache-hits: 3, 1

GET
H3 200 https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F Show response
spn-v1.revampcdn.com/policyshield/ghacks/ 39 B
950 B 206ms
164ms Fetch
application/json 151.101.193.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/policyshield/ghacks/https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 151.101.193.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: b8898a324d47c121f750f567f66777129c9a6980d0590cdc93a90043963f110c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1125.0
content-encoding: br
x-compliant: 0
age: 847731
x-rv-policy: crime
x-served-by: cache-ams21053-AMS, cache-mia-kmia1760079-MIA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-publisher-id: ghacks
x-timer: S1687487767.265922,VS0,VE119
etag: W/"73178ed97c848f1611171ac6e2a0c92c"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=2419200, public, s-maxage=2419500, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
x-cache-hits: 35, 0
date: Fri, 23 Jun 2023 02:36:07 GMT
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
x-cache: HIT, MISS
x-envoy-upstream-service-time: 48
x-region: NY
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 43
x-request-id: f41874a4-cb0f-4d53-b784-8e511d81b70a
x-last-modified-timestamp: 1686351793
last-modified: Fri, 09 June 2023 23:03:13 GMT
server: istio-envoy
x-platform-id: Windows 10
x-browser-name: Chrome
accept-ranges: bytes
x-param-url: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
x-country-code: US

GET
H2 200 google-amp_02.jpg
www.ghacks.net/wp-content/uploads/2023/05/ 82 KB
82 KB 838ms
802ms Image
image/jpeg 2606:4700:20::681a:1fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ghacks.net/wp-content/uploads/2023/05/google-amp_02.jpg

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e03c4dee893e4ab667b0e92e791bd76021c03a88925e4a6124e0115372b85d55

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 83942
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Wed, 10 May 2023 13:22:09 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rCh%2FG6crgaef%2Fb9Vjj2rGTVSJv5MdWCXRfLeTI2kvtHFjhocfWHgY0wj8hJ9bpLaoxHhAMXyE7zlKbVN4flJsy9EkEBil%2FZT%2Bh4px426WiNC7Dohdljx%2FbVcXEemFTYL65PW8fz2M7uktPwl"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=10368000
accept-ranges: bytes
cf-ray: 7db95771ab71db2d-MIA
expires: Sat, 21 Oct 2023 02:36:07 GMT

GET
H2 200 908872676891328 Show response
connect.facebook.net/signals/config/ 300 KB
86 KB 406ms
404ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/908872676891328?v=2.9.108&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e477cf8c725f201e70140a5806a96b2b62fb58e92ae48b107b8129d952f5b163

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 23 Jun 2023 02:36:07 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: HSc42z+dCCEVZZ+zuNYruUgQnkDwMolCSErmiDVPAhWQQ5gooCg72S4GOSyUymMQOlZuongFHoGMvtdFgLaU+g==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 154ms
38ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NHW6RDK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 23 Jun 2023 01:54:56 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2471
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 23 Jun 2023 03:54:56 GMT

GET
H2 200 sdk.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js Show response
sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/ 312 KB
78 KB 80ms
71ms Script
application/javascript 2600:9000:24f3:7200:5:b7cc:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/sdk.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js
Requested by: Host: sdk.privacy-center.org
URL: https://sdk.privacy-center.org/a8ff32f4-78c7-4428-825d-0badb488b68b/loader.js?target=www.ghacks.net
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f3:7200:5:b7cc:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a558ceae2f0ab0ad8a509bf14731225828b3c4fec3e07169da9d5a9259cb216d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 07:39:19 GMT
content-encoding: gzip
via: 1.1 e71e9c9156db978f5f1b9e1ec8ca9458.cloudfront.net (CloudFront)
last-modified: Wed, 21 Jun 2023 07:34:50 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1687332584/ctime:1687332584/gid:0/gname:root/md5:437042dea76567c00952101e6322af49/mode:33188/mtime:1687332584/uid:0/uname:root
x-amz-cf-pop: IAD55-P2
age: 154609
etag: W/"437042dea76567c00952101e6322af49"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-cf-id: bag-BbShVIt9FLrugal7R4wsfB6lfNXWN38EXOZlMMY65tsHaYxSUQ==

GET
DATA 200
OK truncated
/ 371 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f170e41fd143aba25a29a7f83762ca400d552d00ec7657c4fb0f2c7f31ef3e7

Request headers

Referer
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H2 200 GenerateAudioDocStream Show response
readaloud.googleapis.com/$rpc/google.search.readaloud.v1.ReadAloudService/ 5 KB
3 KB 154ms
150ms XHR
application/x-protobuf 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://readaloud.googleapis.com/$rpc/google.search.readaloud.v1.ReadAloudService/GenerateAudioDocStream

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/readaloud/player/web/api/js/api.js?ver=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1e31328d65eb73c4a693643bfd9170f2a4b68bec2a92e3cade94361f829d82eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
accept-language: en-US,en;q=0.9
Authorization
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-protobuf
X-Goog-FieldMask: metadata,text,image
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
X-Goog-Api-Key: AIzaSyAk4mlRyaxd3TYwnoVAE8fPiIZHzZ9gaaQ
X-Goog-AuthUser
X-Accept-Content-Transfer-Encoding: base64

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/x-protobuf
access-control-allow-origin: https://www.ghacks.net
access-control-expose-headers: content-transfer-encoding,content-disposition,vary,vary,vary,content-encoding,transfer-encoding,date,server
cache-control: private
content-transfer-encoding: base64
content-disposition: attachment
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

OPTIONS
H2 200 GenerateAudioDocStream
readaloud.googleapis.com/$rpc/google.search.readaloud.v1.ReadAloudService/ Frame 0
0 257ms
80ms Preflight
text/html 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://readaloud.googleapis.com/$rpc/google.search.readaloud.v1.ReadAloudService/GenerateAudioDocStream

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-accept-content-transfer-encoding,x-goog-api-key,x-goog-authuser,x-goog-fieldmask,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type,x-accept-content-transfer-encoding,x-goog-api-key,x-goog-authuser,x-goog-fieldmask,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Fri, 23 Jun 2023 02:36:08 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 639 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02879cae62ad89aabb9030bdeec952a3004c2bcb6453d21bfd50c6c4743f5080

Request headers

Referer
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e2b1a7f14cb9db010e10b9e983aab0c2e619a529ea7f29d8a310a032c8ef5e54

Request headers

Referer
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 204 state Show response
api.btloader.com/mw/ 0
101 B 174ms
70ms Fetch 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/mw/state?bt_env=prod
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 23 Jun 2023 02:36:08 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
928 B 145ms
45ms Image
image/gif 2606:4700:20::681a:246
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:246 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 884933
x-guploader-uploadid: ADPycdtcMwtX2rPGbmZ4Kum_A4SWLHKDD0-6uwkCQ6JJTnQ6zZL0JXLhtnNIDbixaVxSk8We0bM9mqIJvUqLncD60IPpmQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2WryGROL4ey3ibqYAio6npsZhyyZ4UVK%2Bh9OKMLuW2PExOYgND3U%2FB9ECMDooaqSZ8pBsOjmE%2BRjCH2zyltw43nxAj4VAdjqW10ewF0V2FDQ2fGDaaZUhcihrvplPmi03IeoWWvlpF99ktIbtg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7db95776dc4409b6-MIA
expires: Mon, 12 Jun 2023 20:58:05 GMT

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
571 B 262ms
79ms Image
image/x-icon 172.217.13.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s04-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:11:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55476
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 11:11:32 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
338 B 149ms
51ms Image
image/gif 2606:4700:20::681a:246
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.8519629466135294
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:246 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 884933
x-guploader-uploadid: ADPycdtcMwtX2rPGbmZ4Kum_A4SWLHKDD0-6uwkCQ6JJTnQ6zZL0JXLhtnNIDbixaVxSk8We0bM9mqIJvUqLncD60IPpmQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a36THs%2BX%2FyIoRNfYALhFWxJAL3i9itORc0SIUgQPBeZ4PeOAlASbEMT0mfgTSbrIUJxJgzRLGFjJx3iGTylkL7fj149AJGlAr7WUl651kQ7KIuU0i83OmsXZCMn5s%2Fy0LnVDarPgZmBcW1kN3g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7db95776dc4709b6-MIA
expires: Mon, 12 Jun 2023 20:58:05 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 470 B
819 B 80ms
54ms XHR
application/json 18.67.67.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3177&u=https%3A%2F%2Fwww.ghacks.net
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.67.228 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-67-228.iad89.r.cloudfront.net
Software: Server /
Resource Hash: 8117ea09b5caab594dd88ba8826f107ef9f3a5f91e36b1f89672b03dc33ae48e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
via: 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: IAD89-P1
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.ghacks.net
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 470
x-amz-cf-id: h7BAKniWX8iermBGP-i9JdsK6pG5Ba-PpEnIz-nWYySD4AVKgsktDA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 183ms
55ms XHR
application/javascript 18.67.67.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.67.228 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-67-228.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 04:12:57 GMT
x-amz-version-id: Zm_tZQQ808JKRizBfXGgSN2OWn8Z6JUU
content-encoding: gzip
via: 1.1 68261aebcfc232344da2ef3bf1d3f9ea.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD89-P1
age: 80592
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 26 May 2023 01:35:48 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: N4L3mm6L34L8E-kO0t0XRauHJjYkoVrt8g6JVJeV9y_KfTouJmz8OA==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
209 B 49ms
47ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1315828116&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&ul=en-us&de=UTF-8&dt=Google%27s%20.zip%20Top%20Level%20domain%20is%20already%20used%20in%20phishing%20attacks%20-%20gHacks%20Tech%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=2064607939&gjid=1863348660&cid=1506523288.1687487768&tid=UA-111230-1&_gid=1575432595.1687487768&_r=1&_slc=1&gtm=45He36l0n81NHW6RDK&z=2019491521

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ghacks.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
132 B 36ms
35ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1315828116&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&dr=&ul=en-us&de=UTF-8&dt=&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YMBAAEABAAAAACgDIE~&cid=1809023694.1687487767&tid=UA-168915890-36&_gid=1855659421.1687487768&z=675826306

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 06:27:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 72502
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
91 B 36ms
36ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1315828116&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&dr=&ul=en-us&de=UTF-8&dt=&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=GoogleReadAloudPlayer&ea=load&el=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&_u=YMBAAEABAAAAACgDIEC~&cid=1809023694.1687487767&tid=UA-168915890-36&_gid=1855659421.1687487768&cm1=1&z=472236895

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 06:27:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 72502
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306150101/ 411 KB
127 KB 78ms
75ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306150101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f295fdb1019a3c2ff2479582f5eda1915c67e8d8634f8b089920f86b6cc4fb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 20:56:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 20384
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 129960
x-xss-protection: 0
server: cafe
etag: 10643696450713337328
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Fri, 21 Jun 2024 20:56:24 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 1001 B
440 B 253ms
101ms XHR
application/json 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.ghacks.net

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1215d4981afb248c13294b152d9f8366af3b5bda4c670fdff59ec2a62b4fba3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 415
x-xss-protection: 0
expires: Fri, 23 Jun 2023 02:36:08 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 489ms
75ms Image
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=908872676891328&ev=PageView&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&rl=&if=false&ts=1687487768343&sw=1600&sh=1200&v=2.9.108&r=stable&ec=0&o=30&fbp=fb.1.1687487768342.1645855733&it=1687487767288&coo=false&exp=a0&rqm=GET

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 23 Jun 2023 02:36:08 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 current Show response
api.privacy-center.org/v1/locations/ 40 B
543 B 156ms
154ms XHR
application/json 2600:9000:2073:2a00:d:2044:5c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.privacy-center.org/v1/locations/current?fields[]=country_code&fields[]=region_code

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2073:2a00:d:2044:5c40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

fa2914905b5a71d2fb85796c93db460fd0dd65186f6e2f525b1bd8623fe7da2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:09 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD50-C2
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
content-length: 40
x-xss-protection: 1; mode=block
etag: W/"28-uBGSDfnFy3nGZ2fR84pwOyvrLHA"
x-download-options: noopen
x-frame-options: SAMEORIGIN
allow: GET
content-type: application/json; charset=utf-8
vary: Accept
access-control-allow-origin: *
cache-control: max-age=3600, private
x-amz-cf-id: Bk4xNmG3UgZz6f1n3rtqsTeXW-22aFzyYvFw8jCS0PV6V3TPO_sR3Q==

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 101 KB
25 KB 390ms
40ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd08be9cbf5f35486ce3011abc8286e9e2f59ac1de1ff9840377332383263f19

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Jun 2023 08:35:03 GMT
server: cloudflare
x-amz-request-id: 0KA8DY47DSSDMKF7
age: 662
etag: W/"bb626f116ff54963039a9ea05c53620b"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7db9577aff43db29-MIA
x-amz-id-2: kgnboTDmbswcEg6LbvsakDP10H/QF428lLcu65N2LYs2l+f6EiS1CQdTNK1hGWFCj1FR7RrL1Mg=

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 137 B
576 B 646ms
339ms XHR
text/javascript 18.160.1.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&pid=yfkr1WSrYmK1q&cb=0&ws=1600x1200&v=23.612.1758&t=1200&slots=%5B%7B%22sd%22%3A%22snhb-snhb_ghacks_sidebar_top-0__ad%22%2C%22s%22%3A%5B%22336x375%22%2C%22336x280%22%2C%22300x600%22%2C%22300x500%22%2C%22300x450%22%2C%22300x360%22%2C%22300x337%22%2C%22300x300%22%2C%22300x280%22%2C%22300x250%22%2C%22300x180%22%2C%22300x150%22%2C%22250x250%22%2C%22200x320%22%2C%22200x300%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FATF_MPU_First%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1524862513262-0__ad%22%2C%22s%22%3A%5B%22550x309%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FBTF_OOP_Seethrough%22%7D%2C%7B%22sd%22%3A%22snhb-sidebar_01-0__ad%22%2C%22s%22%3A%5B%22336x375%22%2C%22336x280%22%2C%22300x600%22%2C%22300x500%22%2C%22300x450%22%2C%22300x360%22%2C%22300x337%22%2C%22300x300%22%2C%22300x280%22%2C%22300x250%22%2C%22300x180%22%2C%22300x150%22%2C%22250x250%22%2C%22200x320%22%2C%22200x300%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FBTF_MPU_First%22%7D%2C%7B%22sd%22%3A%22snhb-snhb_ghacks_top-0__ad%22%2C%22s%22%3A%5B%22980x250%22%2C%22980x90%22%2C%22970x250%22%2C%22970x170%22%2C%22970x100%22%2C%22970x90%22%2C%22960x90%22%2C%22950x90%22%2C%22790x250%22%2C%22750x200%22%2C%22750x100%22%2C%22728x250%22%2C%22728x170%22%2C%22728x90%22%2C%22500x250%22%2C%22500x90%22%2C%22468x90%22%2C%22468x60%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FATF_Leaderboard_First%22%7D%2C%7B%22sd%22%3A%22snhb-sidebar_02-0__ad%22%2C%22s%22%3A%5B%22336x375%22%2C%22336x280%22%2C%22300x600%22%2C%22300x500%22%2C%22300x450%22%2C%22300x360%22%2C%22300x337%22%2C%22300x300%22%2C%22300x280%22%2C%22300x250%22%2C%22300x180%22%2C%22300x150%22%2C%22250x250%22%2C%22200x320%22%2C%22200x300%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FBTF_MPU_Second%22%7D%5D&gdprl=%7B%22status%22%3A%22tcfv2-timeout%22%7D

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.1.134 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-1-134.iad12.r.cloudfront.net

Software

Server /

Resource Hash

80cd4bb42ae5db873104aef0b9cb4f6e55d72ea7440eae108640d9779d258c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:09 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 3203c4b5504fa019a752072f0419ef6a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: IAD12-P3
x-amz-rid: 699Z3WJE6704X8V1D9AQ
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 137
x-amz-cf-id: BhSAUuGTds8BPur6RFhI9k2vnIGj3IhyFpDzT0LJUHduVHaYB_ocRQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 137 B
578 B 639ms
336ms XHR
text/javascript 18.160.1.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.1.134 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-1-134.iad12.r.cloudfront.net

Software

Server /

Resource Hash

ec7021417bccc9935ae1720f04f406f19180c7db0345c9c190167273b8dbabeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:09 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 3203c4b5504fa019a752072f0419ef6a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: IAD12-P3
x-amz-rid: MRXB07Z8VKH2GNNZ4AT5
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 137
x-amz-cf-id: vKcKlXOTP55XkPUPKrgeS9ZGewSUo_dhXH9VUeAB8ej4aG67leXVLg==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 137 B
576 B 636ms
338ms XHR
text/javascript 18.160.1.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.1.134 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-1-134.iad12.r.cloudfront.net

Software

Server /

Resource Hash

18bea37622937ec27c9d10bb5fc1e49f747260846281dde3cb1890b24d70e079

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:09 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 3203c4b5504fa019a752072f0419ef6a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: IAD12-P3
x-amz-rid: 2XPXXR6CXET22YJJ6H71
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 137
x-amz-cf-id: rv0s9Mk27DIAc7xZMoiwQVRxXKyUxBz30Ip5Apeli3WpY7u-O9SVxQ==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 2 B
347 B 355ms
65ms XHR
text/plain 2607:f8b0:4004:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-111230-1&cid=1506523288.1687487768&jid=2064607939&gjid=1863348660&_gid=1575432595.1687487768&_u=YEBAAEAAAAAAACAAI~&z=706367100

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9d Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 23 Jun 2023 02:36:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ghacks.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 country Show response
api.btloader.com/ 16 B
141 B 74ms
69ms Fetch
application/json 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/country
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 30c714bf4216e577686d238b98561d093672cb25bf90baab50dd956f75cda4b3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: *
cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16

GET
H2 204 pv Show response
api.btloader.com/ 0
66 B 75ms
70ms XHR
text/plain 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=OxAkWLaU&w=5874461553721344&o=5633429348548608&cv=2.1.13-15-g6498499&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&sid=w7Of44dxhO&upapi=true
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 23 Jun 2023 02:36:08 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 40ms
37ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1315828116&t=event&ni=1&_s=3&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&dr=&ul=en-us&de=UTF-8&dt=&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=GoogleReadAloudPlayer&ea=firstView&el=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&_u=aMBAAEABAAAAACgDIEC~&cid=1809023694.1687487767&tid=UA-168915890-36&_gid=1855659421.1687487768&z=1101525159

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 07:31:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68662
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 settings Show response
notix.io/ 73 B
326 B 140ms
136ms Fetch
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/settings?appId=100463775616ecb625f0290cd8eaf73&ver=0.11.0

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

a184d88796612148bc44440e8ac2a264e745e8f3774a82e2e3219c079134ac45

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:01 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 73

POST
H2 200 event
notix.io/ 15 B
268 B 163ms
136ms Ping
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/event

Requested by

Host: notix.io
URL: https://notix.io/ent/current/enot.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:01 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 15

OPTIONS
H2 204 current
api.privacy-center.org/v1/locations/ Frame 0
0 607ms
233ms Preflight 2600:9000:2073:2a00:d:2044:5c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.privacy-center.org/v1/locations/current?fields[]=country_code&fields[]=region_code
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2073:2a00:d:2044:5c40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
access-control-max-age: 86400
date: Fri, 23 Jun 2023 02:36:08 GMT
vary: Access-Control-Request-Headers
via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront)
x-amz-cf-id: xO6VpcLp7UdbHSqPT4lxr0k4BerC8S4WQ_4al0FpiNy9UsrQ12TGNg==
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
x-powered-by: Express

OPTIONS
H2 200 event
notix.io/ Frame 0
0 419ms
138ms Preflight
text/plain 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/event
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 23 Jun 2023 02:36:00 GMT
server: nginx

POST
H2 200 event
notix.io/ 15 B
268 B 196ms
74ms Ping
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/event

Requested by

Host: notix.io
URL: https://notix.io/ent/current/enot.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:01 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 15

OPTIONS
H2 200 event
notix.io/ Frame 0
0 188ms
139ms Preflight
text/plain 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/event
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 23 Jun 2023 02:36:00 GMT
server: nginx

POST
H2 200 event
notix.io/ 15 B
268 B 210ms
88ms Ping
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/event

Requested by

Host: notix.io
URL: https://notix.io/ent/current/enot.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:01 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 15

OPTIONS
H2 200 event
notix.io/ Frame 0
0 183ms
140ms Preflight
text/plain 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/event
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 23 Jun 2023 02:36:00 GMT
server: nginx

POST
H2 200 event
notix.io/ 15 B
268 B 198ms
76ms Ping
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/event

Requested by

Host: notix.io
URL: https://notix.io/ent/current/enot.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:01 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 15

OPTIONS
H2 200 event
notix.io/ Frame 0
0 175ms
139ms Preflight
text/plain 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/event
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 23 Jun 2023 02:36:00 GMT
server: nginx

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 293ms
99ms Image
image/gif 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-111230-1&cid=1506523288.1687487768&jid=2064607939&_u=YEBAAEAAAAAAACAAI~&z=1144465922

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame FBC3 0
72 B 156ms
155ms Document
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.ghacks.net
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.ghacks.net
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 02:36:09 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame C19F
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t

307 B
1 KB

89ms
89ms

Document
text/html

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

991af7dd3de951ca288e28e445bb9bea1787505ee067ff4d871964c216fc430d

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 307
Content-Type: text/html;charset=ISO-8859-1
Date: Fri, 23 Jun 2023 02:36:09 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: X6PZA22F8QKGN8BSANZQ

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:09 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: W4R1Q1AD5PN51HX9ZYCP

GET
H2 200 ui-gdpr-en-web.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js Show response
sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/ 227 KB
48 KB 73ms
72ms Script
application/javascript 2600:9000:24f3:7200:5:b7cc:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/ui-gdpr-en-web.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js
Requested by: Host: sdk.privacy-center.org
URL: https://sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/sdk.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f3:7200:5:b7cc:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 30c47497e599dc8a9c75d6919a956a9e289140c64d7ab7018885722be1ac8fcf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 07:39:35 GMT
content-encoding: gzip
via: 1.1 e71e9c9156db978f5f1b9e1ec8ca9458.cloudfront.net (CloudFront)
last-modified: Wed, 21 Jun 2023 07:35:05 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1687332584/ctime:1687332584/gid:0/gname:root/md5:cd0b8cb55802f0359dc96dfb50e803b5/mode:33188/mtime:1687332584/uid:0/uname:root
x-amz-cf-pop: IAD55-P2
age: 154595
etag: W/"cd0b8cb55802f0359dc96dfb50e803b5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-cf-id: Cn2frNre-jTC7RqyEyAb7Ved9XXKZqIyNtNeCi5vluK5Zz0P8j8gzA==

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 2FD8 2 KB
3 KB 66ms
65ms Document
text/html 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

06c84712eebc7afcfce95b203548a68c52f260a0db4e75f5f670794528ea3bd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 2137
Content-Type: text/html;charset=ISO-8859-1
Date: Fri, 23 Jun 2023 02:36:09 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 89CKVE86HGWH8GESQSTA

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 2FD8
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1687487770128
https://ad.turn.com/r/cs?pid=45&rndcb=5474820486
https://sync.1rx.io/usersync/turn/7290125297624499648?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-63af46ad-9403-4b02-8413-5a1c0959cf9d-005?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-63af46ad-9403-4b02-8413-5a1c...
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-63af46ad-9403-4b02-8413-5a1c0959cf9d-005

43 B
479 B

74ms
73ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-63af46ad-9403-4b02-8413-5a1c0959cf9d-005

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: WWPGY1JSW906074989NK
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Tengine
ETag: RX63af46ad94034b0284135a1c0959cf9d005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-63af46ad-9403-4b02-8413-5a1c0959cf9d-005
Content-Type: text/html
Connection: keep-alive

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame C315 4 KB
2 KB 232ms
72ms Document
text/html 3.224.253.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.253.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-253-54.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3618d3138665819d4ab6469f6637213dfa9b2dbb6ed56487888e52733bb84f4d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 23 Jun 2023 02:36:10 GMT
etag: W/"0b8c4e4ed1e6b4102866039819b12c099"
server: nginx
timing-allow-origin: *

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame 556D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

2 KB
2 KB

75ms
75ms

Document
text/html

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 6d5b3f361644a23e070023b9445a85f776a2d727bf6ee74ad789c7b0b1a217fa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1817
Content-Type: text/html
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Keep-Alive: timeout=1, max=499
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

Redirect headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
Location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame F6D1 16 KB
6 KB 631ms
55ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=123967
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Fri, 23 Jun 2023 02:36:10 GMT
expires: Sat, 24 Jun 2023 13:02:17 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-akamai-pragma-client-ip: 23.44.237.135, 4.7.166.102
x-check-cacheable: YES
x-serial: 66383

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 0B2F 281 B
554 B 674ms
73ms Document
text/html 104.102.111.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.111.7 Billerica, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-111-7.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 23 Jun 2023 02:36:10 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame FA32
Redirect Chain

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX...

693 B
732 B

55ms
53ms

Document
text/html

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: b956ed89f0282f022536c040611327c57af24645645882838fa2b2671669d9df

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 400
content-type: text/html
date: Fri, 23 Jun 2023 02:36:10 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 23 Jun 2023 02:36:10 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
via: 1.1 google

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 27A2
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4002225585452661977&gdpr=0&gdpr_consent=

43 B
479 B

215ms
68ms

Document
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4002225585452661977&gdpr=0&gdpr_consent=

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: QBPGZFRKBCQ5889N2YX5

Redirect headers

content-length: 0
date: Fri, 23 Jun 2023 02:36:10 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4002225585452661977&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 5B78
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3927527952426166214561

43 B
479 B

183ms
68ms

Document
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3927527952426166214561

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: HA0JD7FP643CVXHRRR5F

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Fri, 23 Jun 2023 02:36:10 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3927527952426166214561
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dapn%26i%3D%24UID
https://usersync.gumgum.com/usersync?b=apn&i=1739900112503368577

35 B
250 B

467ms
80ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=1739900112503368577
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Date: Fri, 23 Jun 2023 02:36:10 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.67; 38.132.118.67; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 5a0bed61-7610-42b2-9d94-78f8a8c27796
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://usersync.gumgum.com/usersync?b=apn&i=1739900112503368577
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&gdpr=&gdpr_consent=&us_privacy=
https://r.bidswitch.net/sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=503c2303-1534-4098-b63f-c1bd8262953e
https://pixel.tapad.com/idsync/ex/receive?partner_id=3205&partner_device_id=503c2303-1534-4098-b63f-c1bd8262953e&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%26ssp%...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%252Chttps%25253A%25252F%25252Fx.bidswitch.net%25252Fsync%25253Fdsp_id%25253D393%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%2Chttps%253A%252F%252Fx.bidswitch.net%...
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=gumgum2&bsw_param=503c2303-1534-4098-b63f-c1bd8262953e
https://usersync.gumgum.com/usersync?b=bsw&i=503c2303-1534-4098-b63f-c1bd8262953e&gdpr=&gdpr_consent=&us_privacy=

35 B
250 B

77ms
76ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=503c2303-1534-4098-b63f-c1bd8262953e&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=503c2303-1534-4098-b63f-c1bd8262953e&gdpr=&gdpr_consent=&us_privacy=
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

c.gif
c.bing.com/ Frame C315
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRd...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28r_35w56fXvt4sqV4qJTdl3aCIzztknmG1u8Ctztvdg9MdgCzfV_DROP1lYFFaEdb%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&obuid=ENC(r_35w56fXvt4sqV4qJTdl3aCIzztknmG1u8Ctztvdg9MdgCzfV_DROP1lYFFaEdb)
https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51
https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D

42 B
667 B

153ms
66ms

Image
image/gif

2620:1ec:c11::200

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Server: 2620:1ec:c11::200 -, , ASN (),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:12 GMT
last-modified: Tue, 06 Jun 2023 17:34:29 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 12E6EE026769455A82D3FE3FE742DEE8 Ref B: MIAEDGE1406 Ref C: 2023-06-23T02:36:12Z
etag: "4729cb259d98d91:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

Location: https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
Date: Fri, 23 Jun 2023 02:36:11 GMT
X-TraceId: 408c345654504b00550fc818a088f489
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=8ea94d70-ea6a-0c65-2103-45fab4632c43

35 B
250 B

895ms
394ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=8ea94d70-ea6a-0c65-2103-45fab4632c43
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 23 Jun 2023 02:36:10 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=8ea94d70-ea6a-0c65-2103-45fab4632c43
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-35d1521b-f6b0-5fb7-7d95-65b5470920a1$ip$38.132.118.67

35 B
250 B

232ms
65ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-35d1521b-f6b0-5fb7-7d95-65b5470920a1$ip$38.132.118.67
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-35d1521b-f6b0-5fb7-7d95-65b5470920a1$ip$38.132.118.67
Date: Fri, 23 Jun 2023 02:36:11 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-JbW51stE2pew3Uejmj1trF233cIrEJJVm97c~A

35 B
250 B

464ms
61ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-JbW51stE2pew3Uejmj1trF233cIrEJJVm97c~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 23 Jun 2023 02:36:10 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-JbW51stE2pew3Uejmj1trF233cIrEJJVm97c~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%...
https://usersync.gumgum.com/usersync?b=vnt&i=5bf92233-d79f-4542-a466-a3e35ba1da1f

35 B
250 B

237ms
63ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=5bf92233-d79f-4542-a466-a3e35ba1da1f
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=5bf92233-d79f-4542-a466-a3e35ba1da1f
Date: Fri, 23 Jun 2023 02:36:11 GMT
Connection: keep-alive
X-CI-RTID: a91d0e03-8a13-4304-b45a-0dcbf15ccacc
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=E38C30D9BA97405BB79CACF9A2C6426C

35 B
250 B

176ms
64ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=E38C30D9BA97405BB79CACF9A2C6426C
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 23 Jun 2023 02:36:11 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 27616151
location: https://usersync.gumgum.com/usersync?b=snc&i=E38C30D9BA97405BB79CACF9A2C6426C
access-control-allow-origin: https://rtb.gumgum.com/
access-control-allow-credentials: true
content-length: 0

GET
H2 200 142
match.deepintent.com/usersync/ Frame C315 0
222 B 659ms
59ms Image
image/gif 38.91.45.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 23 Jun 2023 02:36:10 GMT
server: b
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=s7kuEnhvI7wdGswMrdsJ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTJHVZTO23VIVXGQ5SJG53WIR3TO5GXEZDTJI
https://usersync.gumgum.com/usersync?b=zem&i=s7kuEnhvI7wdGswMrdsJ

35 B
250 B

79ms
78ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=s7kuEnhvI7wdGswMrdsJ
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&i=s7kuEnhvI7wdGswMrdsJ
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 92
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=9f467434-44d2-4849-830c-d907f0ee0ce2

35 B
250 B

64ms
63ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=9f467434-44d2-4849-830c-d907f0ee0ce2
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=9f467434-44d2-4849-830c-d907f0ee0ce2
access-control-allow-origin: *
date: Fri, 23 Jun 2023 02:36:11 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=gxKKHkVNd6xy&ev=1&pid=558355

35 B
250 B

62ms
61ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=gxKKHkVNd6xy&ev=1&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://usersync.gumgum.com/usersync?b=pln&i=gxKKHkVNd6xy&ev=1&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-6d945594b4-hxr87
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame C315
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=4002225585452661977

35 B
250 B

64ms
64ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=4002225585452661977
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=4002225585452661977
date: Fri, 23 Jun 2023 02:36:11 GMT
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame C315 43 B
479 B 73ms
70ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: JA6CZFTX1JZK5YHR3PSJ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame FA32 43 B
479 B 94ms
93ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=2142957d-ded5-8fc9-8676-d7801400e6e5

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: JAYA3PF7V5CND2EN8TP6
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ed538f44-52d3-a67a-77af-43e28364e04c
pr-bh.ybp.yahoo.com/sync/openx/ Frame FA32 43 B
603 B 249ms
66ms Image
image/gif 2600:1f18:4e9:5a02:d35b:426d:ec00:d12d
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/ed538f44-52d3-a67a-77af-43e28364e04c?gdpr=0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:d35b:426d:ec00:d12d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:10 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame FA32 43 B
855 B 163ms
78ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=2142957d-ded5-8fc9-8676-d7801400e6e5

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: M0CCYS8NM34KV11CTCJJ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame FA32
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=7994e900-c27f-3433-4678-55177c332d05&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=7994e900-c27f-3433-4678-55177c332d05&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=7994e900-c27f-3433-4678-55177c332d05&gdpr=0&gdpr_consent=

43 B
62 B

69ms
59ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=7994e900-c27f-3433-4678-55177c332d05&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=7994e900-c27f-3433-4678-55177c332d05&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame FA32
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTVmYjNhY2EtMGIwOC02YTk3LTUzOTgtMGZhZWI2ZDFlMzY1
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTVmYjNhY2EtMGIwOC02YTk3LTUzOTgtMGZhZWI2ZDFlMzY1&google_tc=

170 B
232 B

110ms
99ms

Image
image/png

172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTVmYjNhY2EtMGIwOC02YTk3LTUzOTgtMGZhZWI2ZDFlMzY1&google_tc=

Requested by

Protocol

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTVmYjNhY2EtMGIwOC02YTk3LTUzOTgtMGZhZWI2ZDFlMzY1&google_tc=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame FA32
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPceqjnfL9XSWeRBuSOvK5A&google_cver=1

43 B
61 B

57ms
49ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPceqjnfL9XSWeRBuSOvK5A&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPceqjnfL9XSWeRBuSOvK5A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 81E0
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=a0856495-051b-4700-b552-e42be4745fc4&gdpr=&gdpr_consent=

35 B
250 B

118ms
67ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=a0856495-051b-4700-b552-e42be4745fc4&gdpr=&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: Fri, 23 Jun 2023 02:36:10 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 1031 59fd23a master ord ord-pixel-x6 config_version:"1969"
location: https://usersync.gumgum.com/usersync?b=mmh&i=a0856495-051b-4700-b552-e42be4745fc4&gdpr=&gdpr_consent=

GET
H/1.1 400
Bad Request user-sync Show response
sync.adkernel.com/ Frame 2FA9 22 B
192 B 735ms
67ms Document
text/plain 174.137.133.32
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=&gdpr_consent=&ccpa=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: 4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 22
Date: Fri, 23 Jun 2023 02:36:11 GMT
Pragma: no-cache
Server: nginx

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 2E86
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=&_test=ZJUFGgATwZwDugBS
https://usersync.gumgum.com/usersync?b=atm&i=ZJUFGgATwZwDugBS&gdpr=&gdpr_consent=&_test=ZJUFGgATwZwDugBS

35 B
250 B

168ms
82ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=ZJUFGgATwZwDugBS&gdpr=&gdpr_consent=&_test=ZJUFGgATwZwDugBS
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Fri, 23 Jun 2023 02:36:11 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=ZJUFGgATwZwDugBS&gdpr=&gdpr_consent=&_test=ZJUFGgATwZwDugBS
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-mia-kmia1760064-MIA
x-timer: S1687487771.006025,VS0,VE0

GET
H2

200

pixel Show response
cm.g.doubleclick.net/ Frame 99D2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81MDZkN2NjZC1kNzJlLTQzNmUtOTg1YS0zYzE2YWExZjlmZmM=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync...
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81MDZkN2NjZC1kNzJlLTQzNmUtOTg1YS0zYzE2YWExZjlmZmM=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync...

170 B
243 B

102ms
96ms

Document
image/png

172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81MDZkN2NjZC1kNzJlLTQzNmUtOTg1YS0zYzE2YWExZjlmZmM=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv&google_tc=

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 02:36:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 435
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 02:36:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81MDZkN2NjZC1kNzJlLTQzNmUtOTg1YS0zYzE2YWExZjlmZmM=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv&google_tc=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 556D 43 B
855 B 236ms
69ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZJUFGsWwGwEDkgDk9JCJHgAAAB8AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: K3V7KCTKK2EGDXR94FWH
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 556D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJUFGsWwGwEDkgDk9JCJHgAA
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm=&google_sc=&google_hm=ZJUFGsWwGwEDkgDk9JCJHgAA&google_tc=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECPYshnhw3zk7QRg3S5CGcw&google_cver=1

43 B
631 B

67ms
65ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECPYshnhw3zk7QRg3S5CGcw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECPYshnhw3zk7QRg3S5CGcw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 556D
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://match.adsrvr.org/track/cmb/casale?
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&expiration=1690079771&gdpr=0&gdpr_consent=

43 B
631 B

147ms
68ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&expiration=1690079771&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&expiration=1690079771&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 556D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJUFGsWwGwEDkgDk9JCJHgAAAB8AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm=&google_hm=ZJUFGsWwGwEDkgDk9JCJHgAAAB8AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=&google_tc=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEAOkSRufFYkYGw1YDIY98VU&google_cver=1

43 B
764 B

74ms
67ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEAOkSRufFYkYGw1YDIY98VU&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEAOkSRufFYkYGw1YDIY98VU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum.casalemedia.com/ Frame 556D
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdsum.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D190%26external_user_id%3D%24UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2437852161117978659

43 B
631 B

312ms
163ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2437852161117978659
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Date: Fri, 23 Jun 2023 02:36:11 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.67; 38.132.118.67; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: cab848f8-e828-4c7e-aef1-0d84a50aea34
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2437852161117978659
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ZJUFGsWwGwEDkgDk9JCJHgAAAB8AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 556D 43 B
600 B 145ms
67ms Image
image/gif 2600:1f18:4e9:5a02:d35b:426d:ec00:d12d
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZJUFGsWwGwEDkgDk9JCJHgAAAB8AAAIB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:d35b:426d:ec00:d12d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:10 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 556D
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=29
https://c1.adform.net/serving/cookie/match?CC=1&party=29
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=8178002886123411338&expiration=1688697371

43 B
631 B

69ms
69ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=8178002886123411338&expiration=1688697371
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=8178002886123411338&expiration=1688697371
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 556D
Redirect Chain

https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=ZJUFGsWwGwEDkgDk9JCJHgAA%26031&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f610ffa-737c-4848-a9e6-83dff33b6fdd-tuctb8e8a9b

43 B
631 B

94ms
70ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f610ffa-737c-4848-a9e6-83dff33b6fdd-tuctb8e8a9b
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f610ffa-737c-4848-a9e6-83dff33b6fdd-tuctb8e8a9b
date: Fri, 23 Jun 2023 02:36:11 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 69299

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 556D 43 B
479 B 638ms
482ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZJUFGsWwGwEDkgDk9JCJHgAAAB8AAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: NE795A4SWEGQX2VNKV0B
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 51C3 16 KB
6 KB 94ms
68ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=123967
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Fri, 23 Jun 2023 02:36:10 GMT
expires: Sat, 24 Jun 2023 13:02:17 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-akamai-pragma-client-ip: 23.44.237.135, 4.7.166.102
x-check-cacheable: YES
x-serial: 66383

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 75F6
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=7b45d823-797c-407a-919e-fb1a2f32ebf2

35 B
250 B

96ms
67ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=7b45d823-797c-407a-919e-fb1a2f32ebf2
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Fri, 23 Jun 2023 02:36:11 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=7b45d823-797c-407a-919e-fb1a2f32ebf2
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame FC61
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s0AAHSSWRgAAAAA

35 B
250 B

70ms
68ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s0AAHSSWRgAAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:11 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s0AAHSSWRgAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 3
X-SO-Cluster-ID: 0
X-SO-HostName: m-ad416.dc4p.scaleout.jp
X-SO-IP: 38.132.118.67
X-SO-Key: ZJUFG8Co5s0AAHSSWRgAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"38.132.118.67","key":"ZJUFG8Co5s0AAHSSWRgAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad416"}
X-SO-LB-Hostname: a-tgng40009.dc2p.scaleout.jp
X-SO-Upstream-ID: m-ad416

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 5EB5
Redirect Chain

https://cs.admanmedia.com/sync/gumgum?puid=u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=&gdpr_consent=&ccpa=
https://usersync.gumgum.com/usersync?b=aad&i=cdeddcb7-abea-41d3-a235-dbc2f2b8f778

35 B
250 B

107ms
66ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=aad&i=cdeddcb7-abea-41d3-a235-dbc2f2b8f778
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: 0
Location: https://usersync.gumgum.com/usersync?b=aad&i=cdeddcb7-abea-41d3-a235-dbc2f2b8f778
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Transfer-Encoding: chunked
X-Frame-Options: DENY

GET
H/1.1 200
OK usermatchredir Show response
ssum-sec.casalemedia.com/ Frame 2B51 43 B
764 B 81ms
73ms Document
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Keep-Alive: timeout=1, max=498
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame B1BA
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=v6oecdCPtA1mG0MxQnCr&pi=gumgum&tc=1

35 B
250 B

65ms
64ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=v6oecdCPtA1mG0MxQnCr&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Fri, 23 Jun 2023 02:36:11 GMT Fri, 23 Jun 2023 02:36:11 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=v6oecdCPtA1mG0MxQnCr&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 0E01
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

109ms
85ms

Document
text/html

104.102.111.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.111.7 Billerica, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-111-7.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 23 Jun 2023 02:36:11 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 23 Jun 2023 02:36:11 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 0B2F 34 KB
10 KB 78ms
76ms Script
text/html 104.102.111.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.111.7 Billerica, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-111-7.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 7c3e76841d761aad3b6f24d093762e22faab2bb0c784ff8a8d275d114569a8f8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 02:36:10 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Jun 2023 20:47:17 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=65420
Connection: keep-alive
Content-Length: 10113
Expires: Fri, 23 Jun 2023 20:46:30 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame F6D1 2 KB
2 KB 328ms
59ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=37860887&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: b0426d13c08230e1ab660126ab1c6451f121981e87c53fa409bbdebc152efe93

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 23 Jun 2023 02:36:10 GMT
content-length: 1573
content-type: text/html; charset=UTF-8

GET
H2 200 b9pj45k4 Show response
sync-tm.everesttech.net/upi/pid/ Frame 8BAF 85 B
237 B 298ms
297ms Document
image/png 151.101.130.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Fri, 23 Jun 2023 02:36:11 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760064-MIA
x-timer: S1687487771.405899,VS0,VE28

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame 916A 43 B
479 B 74ms
73ms Document
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDF257B517-7ADD-448F-830A-1881685394C1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: GV5ZR98MSY7TZ5AQBCRT

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame F6D1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8le1F3rdRI-DChiBaFOUwQ%3D%3D&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8le1F3rdRI-DChiBaFOUwQ%3D%3D&gdpr=0&gdpr_consent=&google_tc=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

67ms
65ms

Image
text/html

72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:11 GMT
content-encoding: gzip
x-check-cacheable: YES
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
x-akamai-pragma-client-ip: 23.44.237.135, 4.7.166.102
x-serial: 66383
server: Apache
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-type: text/html
cache-control: max-age=123966
accept-ranges: bytes
content-length: 5554
expires: Sat, 24 Jun 2023 13:02:17 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame F6D1
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=F257B517-7ADD-448F-830A-1881685394C1
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=F257B517-7ADD-448F-830A-1881685394C1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%2C%2C

95 B
123 B

59ms
58ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%2C%2C

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=7b45d823-797c-407a-919e-fb1a2f32ebf2&ttd_puid=fef6161f-cb21-41d5-99d0-9e17ffa9080a%2C%2C
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 359

GET
H2 200 xuid
eb2.3lift.com/ Frame F6D1 37 B
354 B 70ms
65ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7976&xuid=F257B517-7ADD-448F-830A-1881685394C1&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 23 Jun 2023 02:36:11 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

insync
thrtle.com/ Frame F6D1
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F257B517-7ADD-448F-830A-1881685394C1&vxii_pid=12&vxii_pid1=10067&vxii_rcid=aa130dac-a4ca-432e-b171-f278267bf022

43 B
294 B

66ms
66ms

Image
image/gif

54.236.237.143

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F257B517-7ADD-448F-830A-1881685394C1&vxii_pid=12&vxii_pid1=10067&vxii_rcid=aa130dac-a4ca-432e-b171-f278267bf022
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 54.236.237.143 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Fri, 23 Jun 2023 02:36:11 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F257B517-7ADD-448F-830A-1881685394C1&vxii_pid=12&vxii_pid1=10067&vxii_rcid=aa130dac-a4ca-432e-b171-f278267bf022
date: Fri, 23 Jun 2023 02:36:11 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame F6D1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjI1N0I1MTctN0FERC00NDhGLTgzMEEtMTg4MTY4NTM5NEMx&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjI1N0I1MTctN0FERC00NDhGLTgzMEEtMTg4MTY4NTM5NEMx&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

59ms
57ms

Image
image/gif

8.28.7.83

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 00:38:08 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame F6D1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEMzyFSASx939jsi03lt485I&google_cver=1

42 B
377 B

59ms
57ms

Image
image/gif

8.28.7.83

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEMzyFSASx939jsi03lt485I&google_cver=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 00:40:45 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEMzyFSASx939jsi03lt485I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame F6D1
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:1C571F13044E47339E4121854C4234AF

42 B
326 B

78ms
58ms

Image
image/gif

8.28.7.83

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:1C571F13044E47339E4121854C4234AF
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:10 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Fri, 23 Jun 2023 02:36:11 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:1C571F13044E47339E4121854C4234AF
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 22 Jun 2023 02:36:11 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame F6D1
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7290125297624499648&gdpr=0&gdpr_consent=&us_privacy=

1 B
407 B

211ms
58ms

Image
text/html

8.28.7.83

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7290125297624499648&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 23 Jun 2023 00:40:33 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7290125297624499648&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame F6D1
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=7b45d823-797c-407a-919e-fb1a2f32ebf2&gdpr=0&gdpr_consent=

42 B
410 B

206ms
60ms

Image
image/gif

8.28.7.83

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=7b45d823-797c-407a-919e-fb1a2f32ebf2&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 00:40:05 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=7b45d823-797c-407a-919e-fb1a2f32ebf2&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 355

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 0E01 34 KB
10 KB 104ms
102ms Script
text/html 104.102.111.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.111.7 Billerica, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-111-7.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 7c3e76841d761aad3b6f24d093762e22faab2bb0c784ff8a8d275d114569a8f8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 02:36:11 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Jun 2023 20:47:17 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=65419
Connection: keep-alive
Content-Length: 10113
Expires: Fri, 23 Jun 2023 20:46:30 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 0B2F 284 B
922 B 825ms
325ms Image
image/jpg 8.43.72.98

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 0E01 284 B
921 B 243ms
59ms Image
image/jpg 8.43.72.98

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 35ms
34ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1315828116&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&ul=en-us&de=UTF-8&dt=Google%27s%20.zip%20Top%20Level%20domain%20is%20already%20used%20in%20phishing%20attacks%20-%20gHacks%20Tech%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=AdBlockDetection&ea=IsAdBlockingX10&el=false&_u=aMDAAEABAAAAACgDIEC~&jid=&gjid=&cid=1506523288.1687487768&tid=UA-111230-1&_gid=1575432595.1687487768&gtm=45He36l0n81NHW6RDK&z=526531057

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 07:31:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68666
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 36ms
35ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1315828116&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&ul=en-us&de=UTF-8&dt=Google%27s%20.zip%20Top%20Level%20domain%20is%20already%20used%20in%20phishing%20attacks%20-%20gHacks%20Tech%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=AdBlockDetection&ea=IsAdBlockPlusX10&el=false&_u=aMDAAEABAAAAACgDIEC~&jid=&gjid=&cid=1506523288.1687487768&tid=UA-111230-1&_gid=1575432595.1687487768&gtm=45He36l0n81NHW6RDK&z=1269077674

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 07:31:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68666
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 0E01
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=LJ7YNEA0-K-1YFZ
https://usersync.gumgum.com/usersync?b=mag&i=LJ7YNEA0-K-1YFZ

35 B
250 B

67ms
66ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=LJ7YNEA0-K-1YFZ
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:12 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usersync.gumgum.com/usersync?b=mag&i=LJ7YNEA0-K-1YFZ
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
Expires: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 0B2F
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=LJ7YNEHC-21-EQWI
https://s.amazon-adsystem.com/ecm3?id=LJ7YNEHC-21-EQWI&ex=d-rubiconproject.com&status=ok

43 B
479 B

72ms
71ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LJ7YNEHC-21-EQWI&ex=d-rubiconproject.com&status=ok

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: PYAFYNSMEAN69DYH15YN
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LJ7YNEHC-21-EQWI&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c52bde874ac36e8646ae455e9e84952e
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 0B2F
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/vNTzQAxqFBsM_G-Zm2XVfQ?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-m3vr_JBE2oKIwpmBBC_Fd4_25j5tHAFQKqgn6A--~A

42 B
678 B

182ms
58ms

Image
image/gif

8.43.72.98

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-m3vr_JBE2oKIwpmBBC_Fd4_25j5tHAFQKqgn6A--~A
Protocol: HTTP/1.1
Server: 8.43.72.98 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Fri, 23 Jun 2023 02:36:12 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-m3vr_JBE2oKIwpmBBC_Fd4_25j5tHAFQKqgn6A--~A
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 0B2F
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=mxPtqkoSQk6_O3RA0AjsPA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=mxPtqkoSQk6_O3RA0AjsPA

43 B
479 B

76ms
75ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=mxPtqkoSQk6_O3RA0AjsPA

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YTHGM9E5BQH34HQE9RPD
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=mxPtqkoSQk6_O3RA0AjsPA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 0B2F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEP4EEpWDIIE_ntrsiP4seiU&google_cver=1

42 B
678 B

140ms
60ms

Image
image/gif

8.43.72.98

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEP4EEpWDIIE_ntrsiP4seiU&google_cver=1
Protocol: HTTP/1.1
Server: 8.43.72.98 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEP4EEpWDIIE_ntrsiP4seiU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0B2F
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo3WU5FQTAtSy0xWUZa
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDyuBfJuL4sYeoEPApyRkwA&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo3WU5FSEMtMjEtRVFXSQ==&google_push=

170 B
188 B

95ms
95ms

Image
image/png

172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo3WU5FSEMtMjEtRVFXSQ==&google_push=

Protocol

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo3WU5FSEMtMjEtRVFXSQ==&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
Expires: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 0B2F
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ7YNEA0-K-1YFZ

0
515 B

352ms
135ms

Image
text/plain

2620:1ec:21::14

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ7YNEA0-K-1YFZ
Protocol: H2
Server: 2620:1ec:21::14 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:12 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 044CFC0FC3E44E26BFB15C629B2ACC42 Ref B: MIAEDGE2110 Ref C: 2023-06-23T02:36:12Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX+wt1F1rTi514F5S+/cA==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ7YNEA0-K-1YFZ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 0B2F
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=7b45d823-797c-407a-919e-fb1a2f32ebf2&gdpr=0&gdpr_consent=&expires=30

42 B
678 B

60ms
59ms

Image
image/gif

8.43.72.98

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=7b45d823-797c-407a-919e-fb1a2f32ebf2&gdpr=0&gdpr_consent=&expires=30
Protocol: HTTP/1.1
Server: 8.43.72.98 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=7b45d823-797c-407a-919e-fb1a2f32ebf2&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0B2F
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NmM3ZTMwZDgyZDk4Mjg5ZmZiYzY4NzRhODQyMjUxYjA3MzAyN2E2Nw

170 B
188 B

94ms
93ms

Image
image/png

172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NmM3ZTMwZDgyZDk4Mjg5ZmZiYzY4NzRhODQyMjUxYjA3MzAyN2E2Nw

Protocol

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NmM3ZTMwZDgyZDk4Mjg5ZmZiYzY4NzRhODQyMjUxYjA3MzAyN2E2Nw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 0B2F 43 B
855 B 702ms
220ms Image
image/gif 67.220.224.144

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.220.224.144 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YKB99EDVS4EH1G7RFDBG
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame F6D1 0
261 B 315ms
58ms Script
text/plain 8.28.7.84

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.84 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 51C3 2 KB
3 KB 57ms
57ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=86856406&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: faea64847a50ec38f0b41d8340d589c0fd1f38cd04d71c5cfe6885bfede3af1b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Fri, 23 Jun 2023 02:36:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 4F6C
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978477415877548149

42 B
274 B

59ms
58ms

Document
image/gif

8.28.7.83

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978477415877548149
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 00:40:34 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:14 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978477415877548149
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame 7EAC 43 B
855 B 73ms
72ms Document
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F257B517-7ADD-448F-830A-1881685394C1&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 4XT35900A89XSQFK35F9

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 62FC
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0856495-051b-4700-b552-e42be4745fc4&gdpr=0&gdpr_consent=

42 B
406 B

58ms
57ms

Document
image/gif

8.28.7.83

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0856495-051b-4700-b552-e42be4745fc4&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 00:40:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:14 GMT
Expires: Fri, 23 Jun 2023 02:36:13 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 1031 59fd23a master ord ord-pixel-x48 config_version:"1969"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0856495-051b-4700-b552-e42be4745fc4&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 8724
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDWFcwN0pLZ29BQUNNNVJTUUdtZw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AACXW07JKgoAACM5RSQGmg&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsyn%252Csas%252Cpm%26bee_sync_cur...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=syn%2Csas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AACXW07JKgoAACM5RSQGmg&pid=558502&do=add&gd...
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AACXW07JKgoAACM5RSQGmg&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_syn...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=3
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AACXW07JKgoAACM5RSQGmg&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%2...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=4002225585452661977&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACXW07JKgoAACM5RSQGmg&gdpr=0&gdpr_consent=

42 B
280 B

59ms
58ms

Document
image/gif

8.28.7.83

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACXW07JKgoAACM5RSQGmg&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:15 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AACXW07JKgoAACM5RSQGmg&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 666B
Redirect Chain

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_65ee040f9e244c04b7bff

42 B
279 B

58ms
57ms

Document
image/gif

8.28.7.83

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_65ee040f9e244c04b7bff
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
content-type: image/gif
date: Fri, 23 Jun 2023 02:36:13 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_65ee040f9e244c04b7bff
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: b

GET
H/1.1 200 usersync Show response
usersync.gumgum.com/ Frame 5386 35 B
250 B 66ms
65ms Document
image/gif 54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=F257B517-7ADD-448F-830A-1881685394C1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:14 GMT
Expires: 0
Pragma: no-cache

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame 51C3 43 B
61 B 49ms
48ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:13 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK Martin
crb.kargo.com/api/v1/dsync/ Frame 51C3 43 B
504 B 285ms
64ms Image
image/gif 44.206.150.230

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.206.150.230 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:14 GMT
X-Accel-Expires: 0
Vary: Origin
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame 51C3 0
425 B 275ms
62ms Image
text/plain 52.54.245.27

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.245.27 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Connection: keep-alive
Date: Fri, 23 Jun 2023 02:36:14 GMT

GET
H/1.1 200 syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 51C3 0
397 B 1099ms
169ms Image
text/plain 52.212.37.98

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.37.98 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 02:36:14 GMT
X-Clacks-Overhead: GNU Terry Pratchett
X-Adswizz-request-id: b964a680-116e-11ee-b121-0a0d737e9fcb
Connection: keep-alive
Content-Length: 0
X-Application-Context: application:production
Instance-id: i-09f11860ba3a29063

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 51C3
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F257B517-7ADD-448F-830A-1881685394C1&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-MYIr0gtE2uUuBN6uea.6UIKGaKeH15A-~A&gdpr=0

0
129 B

62ms
57ms

Image
text/plain

8.28.7.84

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-MYIr0gtE2uUuBN6uea.6UIKGaKeH15A-~A&gdpr=0
Protocol: H2
Server: 8.28.7.84 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:14 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-MYIr0gtE2uUuBN6uea.6UIKGaKeH15A-~A&gdpr=0
date: Fri, 23 Jun 2023 02:36:14 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 F257B517-7ADD-448F-830A-1881685394C1
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 51C3 43 B
601 B 68ms
66ms Image
image/gif 2600:1f18:4e9:5a02:d35b:426d:ec00:d12d
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/F257B517-7ADD-448F-830A-1881685394C1?gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:d35b:426d:ec00:d12d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

502

Pug
simage2.pubmatic.com/AdServer/ Frame 51C3
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=af9cf83e3a5062d&is_secure=true&networkId=17100&version=1&nuid=F257B517-7ADD-448F-830A-1881685394C1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAB8cKqck5xvANDgdymAAAAAAA&expiration=1687574174&nuid=F257B517-7ADD-448F-830A-1881685394C1&...

0
0

58ms
57ms

Image
text/html

8.28.7.83

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAB8cKqck5xvANDgdymAAAAAAA&expiration=1687574174&nuid=F257B517-7ADD-448F-830A-1881685394C1&is_secure=true&gdpr_consent=&gdpr=0
Protocol: H2
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:14 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAB8cKqck5xvANDgdymAAAAAAA&expiration=1687574174&nuid=F257B517-7ADD-448F-830A-1881685394C1&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 51C3
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=5bf92233-d79f-4542-a466-a3e35ba1da1f&gdpr=0&gdpr_consent=

1 B
317 B

58ms
57ms

Image
text/html

8.28.7.83

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=5bf92233-d79f-4542-a466-a3e35ba1da1f&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 23 Jun 2023 02:36:12 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=5bf92233-d79f-4542-a466-a3e35ba1da1f&gdpr=0&gdpr_consent=
Date: Fri, 23 Jun 2023 02:36:13 GMT
Connection: keep-alive
X-CI-RTID: e2b8b999-51b6-491d-ae3b-13a4f7525db1
Content-Length: 205
Content-Type: text/html; charset=utf-8

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 51C3
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://rtb2-useast.marketiq.com/sync?exchange=685&ssp=pubmatic&bsw_param=503c2303-1534-4098-b63f-c1bd8262953e
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.marketiq.com%2Fsync%3Fexchange%3D685%26ssp%3Dpubmatic%26bsw_param%3D503c2303-1534-4098-b63f-c1bd8262953e
https://rtb2-useast.marketiq.com/sync?adkuid=A6020429032800635758&exchange=685&ssp=pubmatic&bsw_param=503c2303-1534-4098-b63f-c1bd8262953e
https://x.bidswitch.net/sync?dsp_id=458&user_id=A6020429032800635758&expires=5&ssp=pubmatic&bsw_param=503c2303-1534-4098-b63f-c1bd8262953e
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=503c2303-1534-4098-b63f-c1bd8262953e&gdpr=&gdpr_consent=&gdpr_pd=

1 B
246 B

59ms
58ms

Image
text/html

8.28.7.83

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=503c2303-1534-4098-b63f-c1bd8262953e&gdpr=&gdpr_consent=&gdpr_pd=
Protocol: H2
Server: 8.28.7.83 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 23 Jun 2023 02:36:14 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=503c2303-1534-4098-b63f-c1bd8262953e&gdpr=&gdpr_consent=&gdpr_pd=
Date: Fri, 23 Jun 2023 02:36:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 126 B
514 B 864ms
158ms XHR
application/json 116.202.32.62

General

Check archive.org

Show headers Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.32.62 -, , ASN (),
Reverse DNS
Software: istio-envoy /
Resource Hash: c4866c723c789cf04a4900008e83e9a923d0209e0ee11f32a679c3ece024e103

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 23 Jun 2023 02:36:14 GMT
content-encoding: gzip
server: istio-envoy
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.ghacks.net
access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 86

GET
H2 200 experiences Show response
flowcards.mrf.io/json/ 51 B
283 B 413ms
307ms Fetch
application/json 2606:4700:3033::6815:325a

General

Check archive.org

Show headers Download Go to

Full URL: https://flowcards.mrf.io/json/experiences?site_id=2544&client_id=73628a77-d48c-415f-8a89-cba229385d99&user_type=0&canonical_url=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&referrer=&recirculation_source=&previous_page=&geo=__INJECT_GEO__&session_duration=5&pageviews=1&first_visit=1687487769&page_technology=0
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:325a -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: c58ae9a450c0b6887adcbc1b278ecdab16a6abe92c35f3e91dae50d11cbee03d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:15 GMT
content-encoding: gzip
cf-cache-status: BYPASS
server: cloudflare
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private
x-envoy-upstream-service-time: 188
accept-ranges: bytes
cf-ray: 7db957a1ee5f09ca-MIA
alt-svc: h3=":443"; ma=86400
content-length: 64

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 51C3 0
129 B 58ms
58ms Script
text/plain 8.28.7.84

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.84 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:15 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 126 B
514 B 790ms
473ms Fetch
application/json 116.202.32.62

General

Check archive.org

Show headers Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.32.62 -, , ASN (),
Reverse DNS
Software: istio-envoy /
Resource Hash: c4866c723c789cf04a4900008e83e9a923d0209e0ee11f32a679c3ece024e103

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 23 Jun 2023 02:36:17 GMT
content-encoding: gzip
server: istio-envoy
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.ghacks.net
access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 86

Verdicts & Comments Add Verdict or Comment

106 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

122 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ghacks.net/	1970-01-20 12:44:49	Name: rv_test_position Value: 395
.ghacks.net/	1970-01-20 12:44:49	Name: rv_test_variant Value: 0
.ghacks.net/	1970-01-20 22:20:47	Name: _ga Value: GA1.2.1506523288.1687487768
.ghacks.net/	1970-01-20 12:46:14	Name: _gid Value: GA1.2.1575432595.1687487768
.ghacks.net/	1970-01-20 12:44:47	Name: _gat_UA-111230-1 Value: 1
.ghacks.net/	1970-01-20 14:54:23	Name: _fbp Value: fb.1.1687487768342.1645855733
.ghacks.net/	1970-01-20 21:31:50	Name: didomi_token Value: eyJ1c2VyX2lkIjoiMTg4ZTYxYmUtNzFkNy02NGJhLTk1N2MtMzk3M2M1YzE0YmI2IiwiY3JlYXRlZCI6IjIwMjMtMDYtMjNUMDI6MzY6MDkuMjM0WiIsInVwZGF0ZWQiOiIyMDIzLTA2LTIzVDAyOjM2OjA5LjIzNFoiLCJ2ZXJzaW9uIjpudWxsfQ==
.amazon-adsystem.com/	1970-01-20 17:21:16	Name: ad-id Value: AyAEX_R6B0AbowHY4_SwVjM
.amazon-adsystem.com/	1970-01-20 22:20:47	Name: ad-privacy Value: 0
.openx.net/	1970-01-20 21:30:23	Name: i Value: aa38d659-6bf8-0bc4-1cae-9dff18141ef8\|1687487770
.3lift.com/	1970-01-20 14:54:23	Name: tluid Value: 3927527952426166214561
.gumgum.com/	1970-01-20 21:30:23	Name: vst Value: u_506d7ccd-d72e-436e-985a-3c16aa1f9ffc
.casalemedia.com/	1970-01-20 21:30:23	Name: CMID Value: ZJUFGsWwGwEDkgDk9JCJHgAA
.casalemedia.com/	1970-01-20 14:54:23	Name: CMPS Value: 031
.casalemedia.com/	1970-01-20 14:54:23	Name: CMPRO Value: 031
.openx.net/	1970-01-20 13:06:23	Name: pd Value: v2\|1687487770\|vMgavPkWgy
.smartadserver.com/	1970-01-20 22:15:02	Name: pid Value: 4002225585452661977
.turn.com/	1970-01-20 17:03:59	Name: uid Value: 7290125297624499648
.yahoo.com/	1970-01-20 21:30:45	Name: A3 Value: d=AQABBBoFlWQCEARFgmIiNJ_TeNZhhYMtsBcFEgEBAQFWlmSeZAAAAAAA_eMAAA&S=AQAAAhJ4t05xa_QvZAsBwH6M_ls
.bidswitch.net/	1970-01-20 21:30:23	Name: tuuid Value: 503c2303-1534-4098-b63f-c1bd8262953e
.bidswitch.net/	1970-01-20 21:30:23	Name: c Value: 1687487770
.1rx.io/	1970-01-20 21:30:23	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-63af46ad-9403-4b02-8413-5a1c0959cf9d-005%22%7D
.everesttech.net/	1970-01-20 21:30:23	Name: everest_g_v2 Value: g_surferid~ZJUFGgATwZwDugBS
.deepintent.com/	1970-01-20 22:20:47	Name: CDIUSER Value: di_65ee040f9e244c04b7bff
.technoratimedia.com/	1970-01-20 12:45:06	Name: tads_uidp_88 Value: 55178557093803767587
.technoratimedia.com/	1970-01-20 12:45:06	Name: tads_uidp_44 Value: LJ7NRW7J-15-1J59
.technoratimedia.com/	1970-01-20 12:49:35	Name: tads_uidp_45 Value: BFAC1E11-F054-4A0F-ABD8-8369E573091E
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_46 Value: 1629492657629111753
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_48 Value: 82480efa-3d0b-4ed8-8316-ac5aa72df8d7
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_49 Value: AQEHcDBSOpJVzgETRX3QAQEBAQE
.technoratimedia.com/	1970-01-20 12:49:35	Name: tads_uidp_90 Value: 550978e3-2ce1-4147-9c12-907687941822
.technoratimedia.com/	1970-01-20 12:49:06	Name: tads_uidp_91 Value: 6036790348656135630brt77751645033995481903ac
.technoratimedia.com/	1970-01-20 12:49:35	Name: tads_uidp_70 Value: 1673880228405-966706107837-006419-012-003860
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_50 Value: 4dd8b81b-a36a-0ef1-0009-b91582c6401e
.technoratimedia.com/	1970-01-20 12:45:06	Name: tads_uidp_76 Value: RX-99cbb38d-1973-48ab-b2cb-379cafc2ac7a-005
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_77 Value: iR7fepuXJqk25BSZKYwsh1qR9oHwgTud5UwDoLTb2og
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_79 Value: 949a7543-6bce-4592-8955-01862a0d5c0d
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_37 Value: 4f35f3ba-b028-392d-a41c-4439c5fbdcc3
.technoratimedia.com/	1970-01-20 12:49:35	Name: tads_uidp_16 Value: 1550792441571
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_7 Value: 96cf827e-72b7-4043-8b52-0152f81f1da3
.technoratimedia.com/	1970-01-20 12:45:28	Name: tads_uidp_80 Value: y-2qZrWcFE2uFdQJmdKea_MNIvbZlxRGve~A
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_82 Value: YlPvbF8EOzuqt1uJldtsSAAA&1005
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_61 Value: 119069131713948
.technoratimedia.com/	1970-01-20 12:49:06	Name: tads_uidp_83 Value: BzKIS13TXEMI
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_62 Value: 3190818658973792000V10
.technoratimedia.com/	1970-01-20 12:45:01	Name: tads_uidp_64 Value: SyV_hjKKvCbiaJvXmOcU7P8ns6E8JIFZ
.technoratimedia.com/	1970-01-20 22:20:47	Name: tads_uid Value: E38C30D9BA97405BB79CACF9A2C6426C
.technoratimedia.com/	1970-01-20 22:20:47	Name: tads_uid_cd Value: 20230612102910+0000
.technoratimedia.com/	1970-01-20 22:20:47	Name: tads_zora Value: 2
.technoratimedia.com/	1970-01-20 12:46:14	Name: envelope_liveramp.com Value: 1687042535605
.adsrvr.org/	1970-01-20 21:31:50	Name: TDID Value: 7b45d823-797c-407a-919e-fb1a2f32ebf2
.outbrain.com/	1970-01-20 14:54:23	Name: obuid Value: d0a8f11f-399f-496e-a1ca-250442c0743e
.bidswitch.net/	1970-01-20 21:30:23	Name: tuuid_lu Value: 1687487771
.mathtag.com/	1970-01-20 22:10:42	Name: uuid Value: a0856495-051b-4700-b552-e42be4745fc4
.pubmatic.com/	1970-01-20 21:30:23	Name: KADUSERCOOKIE Value: F257B517-7ADD-448F-830A-1881685394C1
sync.srv.stackadapt.com/	1970-01-20 21:30:23	Name: sa-user-id Value: s%3A0-35d1521b-f6b0-5fb7-7d95-65b5470920a1.HIRTD9gMs93M9a28vDFs9mEEgDOE7%2FR8YC0gtMHQy7U
sync.srv.stackadapt.com/	1970-01-20 21:30:23	Name: sa-user-id-v2 Value: s%3ANdFSG_awX7d9lWW1RwkgoSaEdkM.yHf4PAncx22XeHFj7ki2eihMdqit4jSA3UDJckjpRRw
.srv.stackadapt.com/	1970-01-20 21:30:23	Name: sa-user-id-v2 Value: s%3ANdFSG_awX7d9lWW1RwkgoSaEdkM.yHf4PAncx22XeHFj7ki2eihMdqit4jSA3UDJckjpRRw
.zemanta.com/	1970-01-20 21:30:23	Name: zuid Value: s7kuEnhvI7wdGswMrdsJ
.ipredictive.com/	1970-01-20 21:30:23	Name: cu Value: 5bf92233-d79f-4542-a466-a3e35ba1da1f\|1687487771099
.admanmedia.com/	1970-01-20 13:04:57	Name: admtr Value: cdeddcb7-abea-41d3-a235-dbc2f2b8f778
.admanmedia.com/	1970-01-20 13:04:57	Name: ac_r Value: CS71
.creativecdn.com/	1970-01-20 21:30:23	Name: u Value: v6oecdCPtA1mG0MxQnCr
.creativecdn.com/	1970-01-20 21:30:23	Name: ts Value: 1687487771
.adform.net/	1970-01-20 13:27:59	Name: C Value: 1
.taboola.com/	1970-01-20 21:30:23	Name: t_gid Value: 4f610ffa-737c-4848-a9e6-83dff33b6fdd-tuctb8e8a9b
.adnxs.com/	1970-01-20 14:54:23	Name: uuid2 Value: 2437852161117978659
.socdm.com/	1970-01-20 22:20:47	Name: SOC Value: ZJUFG8Co5s0AAHSSWRgAAAAA
.targeting.unrulymedia.com/	1970-01-20 21:30:23	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-63af46ad-9403-4b02-8413-5a1c0959cf9d-005%22%7D
.openx.net/	1970-01-20 13:06:23	Name: univ_id Value: 537072971\|7b45d823-797c-407a-919e-fb1a2f32ebf2\|1687487771265126
.tapad.com/	1970-01-20 14:11:11	Name: TapAd_TS Value: 1687487771286
.tapad.com/	1970-01-20 14:11:11	Name: TapAd_DID Value: fef6161f-cb21-41d5-99d0-9e17ffa9080a
.360yield.com/	1970-01-20 14:54:23	Name: tuuid Value: 9f467434-44d2-4849-830c-d907f0ee0ce2
.360yield.com/	1970-01-20 14:54:23	Name: tuuid_lu Value: 1687487771
.simpli.fi/	1970-01-20 21:31:50	Name: suid Value: 1C571F13044E47339E4121854C4234AF
.doubleclick.net/	1970-01-20 22:20:47	Name: IDE Value: AHWqTUk2GbAN_Jt_S9GerIMjIqoC0b306wzNKYJ56aVmHJPG7o3RF06qvL7QnN6eVzo
.contextweb.com/	1970-01-20 21:23:11	Name: V Value: gxKKHkVNd6xy
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: 9e69e4ee6560cc6d
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_22 Value: 14911-7290125297624499648&KRTB&23150-7290125297624499648
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_377 Value: 6810-7b45d823-797c-407a-919e-fb1a2f32ebf2&KRTB&22918-7b45d823-797c-407a-919e-fb1a2f32ebf2&KRTB&22926-7b45d823-797c-407a-919e-fb1a2f32ebf2&KRTB&23031-7b45d823-797c-407a-919e-fb1a2f32ebf2
.thrtle.com/	1970-01-20 17:32:47	Name: mc Value: eyJpZCI6ImFhMTMwZGFjLWE0Y2EtNDMyZS1iMTcxLWYyNzgyNjdiZjAyMiIsImwiOjE2ODc0ODc3NzE0MDYsInQiOjF9
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_148 Value: 19421-uid:1C571F13044E47339E4121854C4234AF&KRTB&23489-uid:1C571F13044E47339E4121854C4234AF
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_80 Value: 22987-CAESEMzyFSASx939jsi03lt485I&KRTB&16514-CAESEMzyFSASx939jsi03lt485I&KRTB&23025-CAESEMzyFSASx939jsi03lt485I&KRTB&23386-CAESEMzyFSASx939jsi03lt485I
.tapad.com/	1970-01-20 14:11:11	Name: TapAd_3WAY_SYNCS Value: 1!4178
.adform.net/	1970-01-20 14:11:11	Name: uid Value: 8178002886123411338
.bluekai.com/	1970-01-20 17:08:18	Name: bku Value: ikG99OLakVHo1kG2
.bluekai.com/	1970-01-20 17:08:18	Name: bkpa Value: KJhz06awLp9R9mO46IITjVIdQo4a3BOu6GJvN0vl6MRjQSsCTeJdF4ciy4mEjhIcBKyOc2vfIXW4RporIUpI8m7PLliPiTdkF0UTREZKNdDM/F09QYvQducKjg4fYCzfglq7liX/bOqeWZIpx6efSxrMcHOxjbKo+tfXKjCbCnw3WxgIwN1aq8rWYYPNPfOWNavtgYSiAQx1YJPPhwphNmEw93xtMKpWZbhmf9ZgxoTuXd+vPHSbDpPQpUUnUACE1G/B4XV3J3pBr60PdcL9nrj1OQ==
.bing.com/	1970-01-20 22:06:23	Name: MUID Value: 2998EEAE3F1E69683F97FD973E8E68E6
.c.bing.com/	1970-01-20 12:54:52	Name: MR Value: 0
.adsrvr.org/	1970-01-20 21:31:50	Name: TDCPM Value: CAESFwoIcHVibWF0aWMSCwiqhJ66lOf5OxAFEhQKBXRhcGFkEgsI5rDnvJTn-TsQBRIWCgdydWJpY29uEgsIgoXpx5Tn-TsQBRgBIAIoAjILCOao6umq5_k7EAU4AVoFdGFwYWRgAg..
.rubiconproject.com/	1970-01-20 21:30:23	Name: khaos Value: LJ7YNEA0-K-1YFZ
.rubiconproject.com/	1970-01-20 21:30:23	Name: audit Value: 1\|9xMI+sXk+2M22nC4QlG103DuIG0VDpsr2vntTIsSLnU8fCYmOTvXg6QJwK62Iy82m6VhMuuWZ0zLv0ZnN1+t0Vm3DUAyuHnL
.linkedin.com/	1970-01-20 21:30:23	Name: bcookie Value: "v=2&635874a2-27c4-44e6-85a3-9bc33654c6df"
.linkedin.com/	1970-01-20 12:46:14	Name: lidc Value: "b=TGST05:s=T:r=T:a=T:p=T:g=2790:u=1:x=1:i=1687487773:t=1687574173:v=2:sig=AQEXIQYI5M-OSDwm1i5xBuWR7WYqmn3q"
.pubmatic.com/	1970-01-20 14:54:23	Name: chkChromeAb67Sec Value: 2
.pubmatic.com/	1970-01-20 12:46:14	Name: pi Value: 0:4
.pubmatic.com/	1970-01-20 14:54:23	Name: DPSync3 Value: 1688688000%3A201_261_260_259_258_263_262%7C1688083200%3A248
.pubmatic.com/	1970-01-20 14:54:23	Name: SyncRTB3 Value: 1688688000%3A250_231_104_22_54_46_220_13_71_7_166_21%7C1688083200%3A15_2_223%7C1688342400%3A63
.deepintent.com/	1970-01-20 22:20:47	Name: CDIPARTNERS Value: %7B%22141%22%3A%2220230623%22%7D
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_279 Value: 22890-5bf92233-d79f-4542-a466-a3e35ba1da1f&KRTB&23011-5bf92233-d79f-4542-a466-a3e35ba1da1f&KRTB&23355-5bf92233-d79f-4542-a466-a3e35ba1da1f
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_1251 Value: 23269-di_65ee040f9e244c04b7bff
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_27 Value: 16735-uid:a0856495-051b-4700-b552-e42be4745fc4&KRTB&16736-uid:a0856495-051b-4700-b552-e42be4745fc4&KRTB&23019-uid:a0856495-051b-4700-b552-e42be4745fc4&KRTB&23114-uid:a0856495-051b-4700-b552-e42be4745fc4
.rfihub.com/	1970-01-20 22:06:23	Name: eud Value: H4sIAAAAAAAA_9vEyGtoZmFuYmFubm5iaGQJAKXUWFsQAAAA
.rfihub.com/	1970-01-20 22:06:23	Name: rud Value: H4sIAAAAAAAA_-MSsjS3MDE3NzE0tTA3NzWxMDSxFOIz1DX2d3RyNShwLipIcgIAuayN1SQAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSsjS3MDE3NzE0tTA3NzWxMDSxFOIz1DX2d3RyNShwLipIcgIAuayN1SQAAAA
.analytics.yahoo.com/	1970-01-20 21:30:23	Name: IDSYNC Value: 18z8~2cde
.bfmio.com/	1970-01-20 21:30:23	Name: __187_cid Value: F257B517-7ADD-448F-830A-1881685394C1
.bfmio.com/	1970-01-20 21:30:23	Name: __io_cid Value: e515bd8e8840776d2fae29b431a75ce5c2761b83
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_18 Value: 22947-978477415877548149
.kargo.com/	1970-01-20 21:30:23	Name: ktcid Value: c4d36296-a824-0c53-5427-1ce230086907
.bidr.io/	1970-01-20 22:13:21	Name: bito Value: AACXW07JKgoAACM5RSQGmg
.bidr.io/	1970-01-20 22:13:21	Name: bitoIsSecure Value: ok
.dotomi.com/	1970-01-20 12:44:47	Name: DotomiTest Value: af9cf83e3a5062d
.contextweb.com/	1970-01-20 21:30:23	Name: pb_rtb_ev Value: 3-1lb9\|7dN.0.AACXW07JKgoAACM5RSQGmg\|7bq.0.1
.adkernel.com/	1970-01-20 13:27:59	Name: ADKUID Value: A6020429032800635758
.marketiq.com/	1970-01-20 12:51:59	Name: ADK_EX_685 Value: 1
.marketiq.com/	1970-01-20 13:27:59	Name: ADKUID Value: A6020429032800635758
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_466 Value: 16530-503c2303-1534-4098-b63f-c1bd8262953e
.pubmatic.com/	1970-01-20 13:27:59	Name: PugT Value: 1687487774
.smartadserver.com/	1970-01-20 21:31:50	Name: csync Value: 127:AACXW07JKgoAACM5RSQGmg
www.ghacks.net/	1970-01-20 12:44:48	Name: _dd_s Value: rum=0&expire=1687488667981
.pubmatic.com/	1970-01-20 13:27:59	Name: SPugT Value: 1687487775

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=&gdpr_consent=&ccpa= Message: Failed to load resource: the server responded with a status of 400 (Bad Request)
network	error	URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAB8cKqck5xvANDgdymAAAAAAA&expiration=1687574174&nuid=F257B517-7ADD-448F-830A-1881685394C1&is_secure=true&gdpr_consent=&gdpr=0 Message: Failed to load resource: the server responded with a status of 502 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-eu.amazon-adsystem.com
aax.amazon-adsystem.com
ad-delivery.net
ad.360yield.com
ad.doubleclick.net
ad.turn.com
ads.pubmatic.com
api.btloader.com
api.privacy-center.org
b1sync.zemanta.com
bh.contextweb.com
btloader.com
c.amazon-adsystem.com
c.bing.com
c1.adform.net
cdn.id5-sync.com
cm.g.doubleclick.net
connect.facebook.net
crb.kargo.com
creativecdn.com
cs.admanmedia.com
dsp.adkernel.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
eb2.3lift.com
eus.rubiconproject.com
events.newsroom.bi
flowcards.mrf.io
ib.adnxs.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
imasdk.googleapis.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
notix.io
p.rfihub.com
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
pixel.tapad.com
polyfill.io
pr-bh.ybp.yahoo.com
pubmatic-match.dotomi.com
px.ads.linkedin.com
r.bidswitch.net
readaloud.googleapis.com
rtb-csync.smartadserver.com
rtb.gumgum.com
rtb2-useast.marketiq.com
s.amazon-adsystem.com
sdk.mrf.io
sdk.privacy-center.org
secure-assets.rubiconproject.com
secure.adnxs.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
spn-v1.revampcdn.com
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
stags.bluekai.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.adkernel.com
sync.bfmio.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.srv.stackadapt.com
sync.taboola.com
sync.targeting.unrulymedia.com
sync.technoratimedia.com
synchroscript.deliveryengine.adswizz.com
tg.socdm.com
thrtle.com
token.rubiconproject.com
u.openx.net
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
usersync.gumgum.com
www.baesystems.zip
www.datadoghq-browser-agent.com
www.facebook.com
www.ghacks.net
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
x.bidswitch.net
104.102.111.7
116.202.32.62
13.32.195.219
130.211.23.194
139.45.240.92
141.226.224.48
15.197.193.217
151.101.130.49
151.101.193.91
172.217.13.102
172.217.13.115
172.217.13.130
174.137.133.32
174.137.133.49
18.160.1.134
18.67.67.228
185.167.164.39
185.184.8.90
192.40.39.223
198.148.27.139
199.127.204.171
199.38.167.131
2001:4860:4802:34::178
202.241.208.54
216.200.232.253
216.22.16.4
23.1.200.83
23.105.14.105
23.192.51.216
2600:1f18:4e9:5a02:d35b:426d:ec00:d12d
2600:9000:2073:2a00:d:2044:5c40:93a1
2600:9000:24f3:7200:5:b7cc:d3c0:93a1
2603:c020:400d:3000:7130:bb0b:d7e:bee2
2604:9e00:1:129::2:a01
2606:4700:10::ac43:266a
2606:4700:20::681a:1fa
2606:4700:20::681a:246
2606:4700:20::681a:78b
2606:4700:3033::6815:325a
2606:4700:3033::ac43:9fa2
2606:ae80:1471:16::730
2607:f8b0:4004:c0b::9d
2607:f8b0:4006:80e::200a
2607:f8b0:4020:805::2002
2607:f8b0:4020:806::2008
2607:f8b0:4020:806::200a
2607:f8b0:4020:807::2003
2607:f8b0:4020:807::2004
2620:112:f002:bbbb::21
2620:1ec:21::14
2620:1ec:c11::200
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
2a04:4e42:200::282
3.224.253.54
3.225.218.10
3.228.34.13
34.111.113.62
34.150.170.96
34.98.64.218
35.211.118.13
35.211.178.172
38.91.45.7
44.206.150.230
50.31.142.95
52.202.56.4
52.212.37.98
52.223.22.214
52.46.128.147
52.54.245.27
52.73.94.167
54.236.237.143
54.81.62.10
54.87.127.173
64.202.112.95
67.220.224.144
68.67.160.114
68.67.161.208
72.247.71.192
8.28.7.81
8.28.7.83
8.28.7.84
8.43.72.97
8.43.72.98
80.77.87.161
00bf6629654c4bdef1a8aacb834c7522d0798c4fc681fb85761e3b9ae2913db6
02563f6dd488eac87d5c8280cdc49326a311cde34be86fe6ec5f5793385d7ad7
02879cae62ad89aabb9030bdeec952a3004c2bcb6453d21bfd50c6c4743f5080
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06c84712eebc7afcfce95b203548a68c52f260a0db4e75f5f670794528ea3bd8
08184568b41f4a1b579301887aaa8f60958c9aefa33617c09b0fe10d521fd00a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
11ec9bb8e81592df9f2c0e18c6dae852561b7ed0dca2d47d5dc50edc8d2a90a6
124e61a3b158acb4ab3d8b81c92f3d11d3444ae08413e03e23aa4c14ea4d308a
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
18bea37622937ec27c9d10bb5fc1e49f747260846281dde3cb1890b24d70e079
1e31328d65eb73c4a693643bfd9170f2a4b68bec2a92e3cade94361f829d82eb
2464528204e216b4f6b2e8f52b577c86621d2297d0f0b69e848abe643aa6896c
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
25d617eac8e9a101e470e45fefe975a9c7c7420f5d3f0eff1a3ffe6a535a03dd
27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db
2b82501522d0253e83dbf9b23cee0f17ecdddecae1a9a3db36c7c8f08d530645
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
30c47497e599dc8a9c75d6919a956a9e289140c64d7ab7018885722be1ac8fcf
30c714bf4216e577686d238b98561d093672cb25bf90baab50dd956f75cda4b3
34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf
3618d3138665819d4ab6469f6637213dfa9b2dbb6ed56487888e52733bb84f4d
3664be3a8c387d48a6ba88f70f557117597213f1d377d6b54810de6a6abe20c5
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791
3b13fc50b6ed0a616dc2581175f19de22c59207a54ab0099f32b96c5e13fd71d
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
42acc026706304b5193dbb474671c1258d2ab58d51512fa283e2ec02718fc531
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4919ddf6337285052dc0fe47fd60298fceb2679267a3fd1a85938d2b52538ef2
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
554f3ff96cba4f2f33ff2c37c48282006ab24a85cf9ca0ac8b22b0a06126c1d4
59cb9485f12fbd706268412d6ac360905369d2aca4889973b8fbfe8ba834db2a
5b477c9694f19d0c1f986ba24a394caaf31be4d2b06e4df9b30be12f9cb1e76e
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
6a482d2d94c0d1bc6937a1759389d01b475e6b28a0d9b5d7eaa3f9cc8f59f3cd
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a
6d5b3f361644a23e070023b9445a85f776a2d727bf6ee74ad789c7b0b1a217fa
6f170e41fd143aba25a29a7f83762ca400d552d00ec7657c4fb0f2c7f31ef3e7
70d9311702ac457eb90a7133063593c379191d9d9ca1d3c9549d78481283be6f
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48
7378fe642cc87c3a1343b20efdd53f4e560319daf19f95c4312163a3b788585c
75e0fe33a139622cde1d4bacdef52e609e623b514c56b113c69568fa16c23a12
7c3e76841d761aad3b6f24d093762e22faab2bb0c784ff8a8d275d114569a8f8
7f295fdb1019a3c2ff2479582f5eda1915c67e8d8634f8b089920f86b6cc4fb7
80cd4bb42ae5db873104aef0b9cb4f6e55d72ea7440eae108640d9779d258c14
8117ea09b5caab594dd88ba8826f107ef9f3a5f91e36b1f89672b03dc33ae48e
8276d99808a3a111dcb2dc61c895388c21341d48be9c3f87d905787a49c2b832
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8564419bba762b0ce4e3bc45fe5c478fcdaac5cc92e78862ce30a6581e11a3f0
8aa3471bd234c6963a168e8501f9aeb622c42ffe00fba96072a487f71a00029b
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
9615d053779f17698d32327e1fe8296c8fb45353770837879e4795f9c28cad38
991af7dd3de951ca288e28e445bb9bea1787505ee067ff4d871964c216fc430d
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9cca958d544314da08debbbdc0614a7310a50846cf880c26746104cde227de84
9d8c5621c9f8cbe6b7a788a8f34d405a443c511cc5135f38452da0c6d901ba6d
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a184d88796612148bc44440e8ac2a264e745e8f3774a82e2e3219c079134ac45
a558ceae2f0ab0ad8a509bf14731225828b3c4fec3e07169da9d5a9259cb216d
aaf69f969c85107828b863ad90f70534c60fc64cbb1a7f3e28d78692d8854db5
ac8cd48b7a9d1e1e1e9bb3939b1f76cfaf430ab142be8d36593b0a4b8204e6ce
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
aea4e7430290383948b2c8a639f25a8a6998ee0cba5eba1f49de44b34f6d1487
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b0426d13c08230e1ab660126ab1c6451f121981e87c53fa409bbdebc152efe93
b1215d4981afb248c13294b152d9f8366af3b5bda4c670fdff59ec2a62b4fba3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3e051a82490a96f88cc2342630f59cac4c7c4bcab275ee30f9cbecd8e8a62b3
b6738331b4ac9f5a9c6c2cad8fa28ea9a6834d28bdc5ebcb545ec7a4acd6795e
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
b8898a324d47c121f750f567f66777129c9a6980d0590cdc93a90043963f110c
b956ed89f0282f022536c040611327c57af24645645882838fa2b2671669d9df
b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd08be9cbf5f35486ce3011abc8286e9e2f59ac1de1ff9840377332383263f19
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c1e8df27eefed0250a8e2785a341a5d35d838d8136f4ffde3168c57e9137aa2b
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c3b0c961624b56351ac1fdcfed1a3ce5c68e73921d08887d89713a1d0df83427
c4866c723c789cf04a4900008e83e9a923d0209e0ee11f32a679c3ece024e103
c56ae0ce6a61669700b75187f654ea8b5fe23cb1377e463c7fc93d052eade027
c58ae9a450c0b6887adcbc1b278ecdab16a6abe92c35f3e91dae50d11cbee03d
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d36ac645d9f3443fe2b4ee6306a14b305bc3d93f3ed72e913d067d02200e889c
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e00e9bc52a415fc6e22f2332ba8c16d996f59962d5d80ff84f2de86b23782e2d
e03c4dee893e4ab667b0e92e791bd76021c03a88925e4a6124e0115372b85d55
e2b1a7f14cb9db010e10b9e983aab0c2e619a529ea7f29d8a310a032c8ef5e54
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e477cf8c725f201e70140a5806a96b2b62fb58e92ae48b107b8129d952f5b163
e47839620ae791505f14bcf06a9ada7a2ecf1a0268cbda2c9efc883d77558449
e4ea1a836c9e61ca541b43dec61bcd3314ee017b899177e00355034775adce14
e808c4a589bbe7ad73f3e66b99f651c32d1a10079973e9db31bd2cce64855c16
ec7021417bccc9935ae1720f04f406f19180c7db0345c9c190167273b8dbabeb
ec922a202c99fe67c6a7a2d4cddb5947f4f9ba6a501768b9900114d32ab43315
ed3307c62c0d78bf73af142b4c660e3257374d97385b2f50b28b1003a5c00513
edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b
eee2cc0688e4321b02687d1644a880232b97ba8bbaa2effb391b98da84cb408f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fa2914905b5a71d2fb85796c93db460fd0dd65186f6e2f525b1bd8623fe7da2c
faea64847a50ec38f0b41d8340d589c0fd1f38cd04d71c5cfe6885bfede3af1b
ff481473ceb28fd40f49e1d1dce9a969cc0d52f89be7fd2c687044cc2ff98cce

www.ghacks.net Open in urlscan Pro 2606:4700:20::681a:1fa Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

186 Requests

77 %HTTPS

31 %IPv6

64 Domains

93 Subdomains

53 IPs

6 Countries

1458 kBTransfer

4538 kBSize

122 Cookies

16 Outgoing links

Page URL History

Redirected requests

186 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.ghacks.net Open in urlscan Pro
2606:4700:20::681a:1fa Public Scan

Screenshot
Live screenshot

Full Image

186
Requests

77 %
HTTPS

31 %
IPv6

64
Domains

93
Subdomains

53
IPs

6
Countries

1458 kB
Transfer

4538 kB
Size

122
Cookies

186 HTTP transactions
13 data transactions