lifars.com Open in urlscan Pro
208.97.144.40  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 38

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=696521&time=1639480301067&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D696521%26time%3D1639480301067%26url%3Dhttps%253A%252F%252Flifars.com%252F2021%252F12%252Fquick-look-at-new-trickbot-affiliates%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=696521&time=1639480301067&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=696521&time=1639480301067&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&liSync=true&e_ipv6=AQLuY6gnysS1xwAAAX24pBhhg5ULMsd7O7jfrXnxvaY_W4phVnhMJce-YJMS6GeWP8XDMroT

Request Chain 82

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/954568561/?random=470482605&cv=9&fst=1639480301272&num=1&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&auid=690898990.1639480301&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=7Xu4YerQFJvLx_AP_uGpqAM&sscte=1&crd=&eitems=ChEIgJ7hjQYQ7LDOlI7U-J20ARIdADmdPEWU0F3aZQ4syev2vUD12-rxZEGJzg3pgJM HTTP 302
• https://www.google.com/pagead/1p-conversion/954568561/?random=470482605&cv=9&fst=1639480301272&num=1&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&auid=690898990.1639480301&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=7Xu4YerQFJvLx_AP_uGpqAM&eitems=ChEIgJ7hjQYQ7LDOlI7U-J20ARIdADmdPEU5v9ytqCf1mOf87xP5fsTN1j5k639QD8s&random=2998915897&resp=GooglemKTybQhCsO HTTP 302
• https://www.google.de/pagead/1p-conversion/954568561/?random=470482605&cv=9&fst=1639480301272&num=1&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&auid=690898990.1639480301&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=7Xu4YerQFJvLx_AP_uGpqAM&eitems=ChEIgJ7hjQYQ7LDOlI7U-J20ARIdADmdPEU5v9ytqCf1mOf87xP5fsTN1j5k639QD8s&random=2998915897&resp=GooglemKTybQhCsO&ipr=y&prhg=0

133 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/	73 KB 15 KB	2555ms 2196ms	Document text/html	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash cb64c464bca2d3d5493b238a4a12149d586e1338c03a42c40718a0cd33798ad5 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Tue, 14 Dec 2021 11:11:25 GMT content-type text/html; charset=UTF-8 server Apache link <https://lifars.com/wp-json/>; rel="https://api.w.org/", <https://lifars.com/wp-json/wp/v2/posts/29615>; rel="alternate"; type="application/json", <https://lifa.rs/3ok4ti3>; rel=shortlink x-content-type-options nosniff permissions-policy microphone=();camera=(); x-frame-options SAMEORIGIN cache-control max-age=600 expires Tue, 14 Dec 2021 11:21:23 GMT vary User-Agent referrer-policy strict-origin-when-cross-origin strict-transport-security max-age=63072000; includeSubDomains; preload x-xss-protection 1; mode=block x-cacheable YES x-varnish 682610904 age 0 content-encoding br
GET H2	200	js Show response www.googletagmanager.com/gtag/	90 KB 36 KB	133ms 53ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-60073856-1 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e4a16d2bae983ea9c73094bca665f71379f55f1830577613741dae49cea989c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:40 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36251 x-xss-protection 0 last-modified Tue, 14 Dec 2021 09:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 14 Dec 2021 11:11:40 GMT
GET H2	200	autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css lifars.com/wp-content/cache/autoptimize/css/	329 KB 48 KB	95ms 94ms	Stylesheet text/css	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash cec479e643ffd8c0210739c30675bdca2d22702c2aca5ac74ab4f762834f0da7 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 324 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 30 Nov 2021 01:57:54 GMT server Apache x-frame-options SAMEORIGIN etag W/"524d6-5d1f7e2b8c23e" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610907 682610700 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/css expires Sun, 04 Dec 2022 11:06:02 GMT
GET H2	200	jquery.min.js Show response lifars.com/wp-content/themes/lifars/build/js/	87 KB 30 KB	274ms 274ms	Script application/javascript	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/build/js/jquery.min.js?ver=1602867320 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable NO:Not Cacheable age 0 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 16 Oct 2020 16:55:20 GMT server Apache x-frame-options SAMEORIGIN etag W/"15d84-5b1cca1481946" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610908 cache-control max-age=31536000, private, must-revalidate permissions-policy microphone=();camera=(); accept-ranges bytes content-type application/javascript expires Thu, 13 Jan 2022 11:11:26 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	97 KB 39 KB	64ms 64ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-954568561 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 372fdb39d7bc2c3ab2a5a13433acc913929871d2d68ca627d3eac46f48acfae6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:40 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39584 x-xss-protection 0 last-modified Tue, 14 Dec 2021 09:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 14 Dec 2021 11:11:40 GMT
GET H2	200	pinit_fg_en_rect_gray_20.png assets.pinterest.com/images/pidgets/	908 B 1 KB	66ms 8ms	Image image/png	2a02:26f0:6c00:2af::1931 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://assets.pinterest.com/images/pidgets/pinit_fg_en_rect_gray_20.png Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:2af::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 3aec2b233c010f1f2213ecf8360d509f3eeca34f69d162335aefa01fe0035e2f Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-cdn akamai etag "8a25277cfdf72f8f916b4cdc34052149" vary Accept-Encoding, Origin access-control-allow-methods GET content-type image/png access-control-allow-origin * access-control-max-age 86400 cache-control max-age=80319 accept-ranges bytes content-length 908 access-control-expose-headers X-CDN
GET H2	200	Cyber-Email-Newsletter.jpg lifars.com/wp-content/uploads/2020/07/	25 KB 25 KB	94ms 92ms	Image image/jpeg	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL https://lifars.com/wp-content/uploads/2020/07/Cyber-Email-Newsletter.jpg Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 398bfc9f9c02f7a58f98c56f5a22adcb4d92147ff182579440f53f337d870a8f Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT x-content-type-options nosniff x-cacheable YES age 323 vary User-Agent content-length 25355 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Jul 2021 13:50:28 GMT server Apache x-frame-options SAMEORIGIN etag "630b-5c80709362bc3" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610909 682610702 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); accept-ranges bytes content-type image/jpeg expires Thu, 13 Jan 2022 11:06:02 GMT
GET H2	200	LIFARS-Cyber-Security-Video-Gallery.jpg lifars.com/wp-content/uploads/2020/07/	126 KB 127 KB	94ms 92ms	Image image/jpeg	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL https://lifars.com/wp-content/uploads/2020/07/LIFARS-Cyber-Security-Video-Gallery.jpg Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 54075f5b877a320dda87848acbd7adbbe8c5edf822956a897d38af3627bdb2c7 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT x-content-type-options nosniff x-cacheable YES age 323 vary User-Agent content-length 129072 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Jul 2021 13:50:28 GMT server Apache x-frame-options SAMEORIGIN etag "1f830-5c80709365aa2" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610910 682610704 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); accept-ranges bytes content-type image/jpeg expires Thu, 13 Jan 2022 11:06:03 GMT
GET H2	200	114.png lifars.com/wp-content/plugins/wpfront-scroll-top/images/icons/	958 B 1 KB	184ms 182ms	Image image/png	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL https://lifars.com/wp-content/plugins/wpfront-scroll-top/images/icons/114.png Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 7c2a248c901ae688a4f9b377b4db8b75201b754d5c069934003d967e926bf134 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT x-content-type-options nosniff x-cacheable YES age 323 vary User-Agent,Accept-Encoding content-length 958 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 17 Aug 2021 13:13:53 GMT server Apache x-frame-options SAMEORIGIN etag "3be-5c9c116e7fe20" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610913 682610705 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); accept-ranges bytes content-type image/png expires Thu, 13 Jan 2022 11:06:03 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	139 KB 51 KB	89ms 87ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-54MKD2 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 499aadf1c333399161daacdbb9f233bded9996e909e269b1dc3b407b6925dbed Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:40 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 52527 x-xss-protection 0 last-modified Tue, 14 Dec 2021 09:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 14 Dec 2021 11:11:40 GMT
GET H2	200	loading.gif lifars.com/wp-content/plugins/jetpack/modules/sharedaddy/images/	2 KB 3 KB	184ms 182ms	Image image/gif	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL https://lifars.com/wp-content/plugins/jetpack/modules/sharedaddy/images/loading.gif Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT x-content-type-options nosniff x-cacheable YES age 193 vary User-Agent content-length 2530 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 07 Dec 2021 19:15:32 GMT server Apache x-frame-options SAMEORIGIN etag "9e2-5d293327e48a6" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610912 682610800 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); accept-ranges bytes content-type image/gif expires Thu, 13 Jan 2022 11:08:13 GMT
GET H2	200	share-button.js Show response assets.tumblr.com/	11 KB 4 KB	38ms 6ms	Script application/javascript	192.0.77.40 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://assets.tumblr.com/share-button.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.40 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS assets.tumblr.com Software nginx / Resource Hash c08c35c552b481fe913ad66c4f71e429ccd8ff9aadd726387f8fa2606c7d12c5 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload, max-age=31536000; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc HIT hhn 1 date Tue, 14 Dec 2021 11:11:40 GMT content-encoding br last-modified Wed, 21 Oct 2020 05:06:36 GMT server nginx etag W/"5f8fc1dc-2d2f" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, immutable strict-transport-security max-age=31536000; preload, max-age=31536000; preload timing-allow-origin * expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	e-202150.js Show response stats.wp.com/	9 KB 3 KB	27ms 6ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202150.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc HIT hhn date Tue, 14 Dec 2021 11:11:40 GMT content-encoding br server nginx etag W/"6197c5cf-3508" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 expires Sun, 04 Dec 2022 22:02:47 GMT
GET H2	200	autoptimize_d0dd1488e6fdf42661886b61ed33cba4.js Show response lifars.com/wp-content/cache/autoptimize/js/	121 KB 33 KB	184ms 182ms	Script application/javascript	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/cache/autoptimize/js/autoptimize_d0dd1488e6fdf42661886b61ed33cba4.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash e687c388069744d6d754b79bd73ca34bdc4bd6e2ab1d2d510eed5286b95ed590 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable NO:Cache-Control=private age 0 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 07 Dec 2021 19:15:48 GMT server Apache x-frame-options SAMEORIGIN etag W/"1e41e-5d293336ebf13" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610911 cache-control max-age=31536000, private, must-revalidate permissions-policy microphone=();camera=(); accept-ranges bytes content-type application/javascript expires Sun, 04 Dec 2022 11:11:26 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	131ms 37ms	Script text/javascript	2a00:1450:4001:802::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-60073856-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 635 date Tue, 14 Dec 2021 11:01:06 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Tue, 14 Dec 2021 13:01:06 GMT
GET H2	200	bat.js Show response bat.bing.com/	36 KB 11 KB	53ms 32ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:40 GMT content-encoding gzip last-modified Fri, 03 Dec 2021 01:53:50 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: ECE5F40992234D3D99E6154724DD4956 Ref B: FRAEDGE1511 Ref C: 2021-12-14T11:11:40Z etag "0cb09ee8e7d71:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 10468
GET H/1.1	200 OK	1b1367cf3302d746e393df002.js Show response chimpstatic.com/mcjs-connected/js/users/7ef36ba4621087543ba16eec9/	2 KB 1 KB	152ms 121ms	Script application/javascript	2.17.177.117 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://chimpstatic.com/mcjs-connected/js/users/7ef36ba4621087543ba16eec9/1b1367cf3302d746e393df002.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.17.177.117 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-17-177-117.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash f845e3aa4da8aff378789d49c35593ae96dd0a807470ada3dea84d14d4630be1 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers X-EdgeConnect-Origin-MEX-Latency 354, 96, 370, 102 Date Tue, 14 Dec 2021 11:11:41 GMT Content-Encoding gzip x-amz-request-id EJWQRKY60YRZG1WE X-EdgeConnect-MidMile-RTT 0, 0, 0, 1 Connection keep-alive Content-Length 704 x-amz-id-2 gH/C0mD3xDBsz6aA6wlcKaeezKOg54icz+gAthcfFTlr42pU3Hw343Tm7etp03gDeJYB8m3tibM= Last-Modified Fri, 14 Aug 2020 19:27:44 GMT Server AmazonS3 ETag "5b8b2e7029630c2e0ce9919494215371" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=1746 Accept-Ranges bytes Expires Tue, 14 Dec 2021 11:40:47 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	98 KB 26 KB	27ms 6ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 25965 x-xss-protection 0 pragma public x-fb-debug +r/krRt+Thhxn0rTQtuqscY8/lrYCqA5jO3GE5C5Eb7qz52H7K573uFTDoGxDx4XUBCZVmTlmY3cYuFz+Ya86A== x-fb-trip-id 917726464 x-frame-options DENY date Tue, 14 Dec 2021 11:11:40 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	97 KB 39 KB	59ms 58ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-954568561&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-60073856-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash bc4d8f8e1b52bcfae4e93f346af24d24d629b0b4cd42fc356c49aebc8c31d68a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:40 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39606 x-xss-protection 0 last-modified Tue, 14 Dec 2021 09:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 14 Dec 2021 11:11:40 GMT
GET H/1.1	200 OK	3b0c19c698cedcb5231140be7.js Show response chimpstatic.com/mcjs-connected/js/users/7ef36ba4621087543ba16eec9/	50 B 785 B	148ms 118ms	Script application/javascript	2.17.177.117 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://chimpstatic.com/mcjs-connected/js/users/7ef36ba4621087543ba16eec9/3b0c19c698cedcb5231140be7.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.17.177.117 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-17-177-117.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash f6e4f5edb3194334a199f0bf80b38d92a0b7388330fbce94c8c0fb2f852c171f Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers X-EdgeConnect-Origin-MEX-Latency 121, 94, 356, 99 Date Tue, 14 Dec 2021 11:11:41 GMT Last-Modified Fri, 14 Aug 2020 19:27:44 GMT Server AmazonS3 x-amz-request-id FQ1FQW6J74S17JGH X-EdgeConnect-MidMile-RTT 0, 0, 0, 0 ETag "104d46a3208b40e8ded389332f5a78a3" Content-Type application/javascript Cache-Control max-age=1743 Connection keep-alive Accept-Ranges bytes Content-Length 50 x-amz-id-2 eLVwUxkS49ESydig2zr6RPTEPjtSuvo+Hhf3osyYKnUzOA7rCnn7qNdNXCNfqu9dxOqyKCpI41s= Expires Tue, 14 Dec 2021 11:40:44 GMT
GET H2	200	button1.html Show response www.reddit.com/static/button/ Frame 5754	5 KB 2 KB	152ms 121ms	Document text/html	151.101.129.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/static/button/button1.html?newwindow=true&width=120&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&title=Quick%20Look%20at%20New%20TrickBot%20Affiliates Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 599d1e06f6a9ce3441a595b193c542e5d92e675e93b0a062d3b293d0ea5dfbf8 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ Response headers content-type text/html last-modified Wed, 30 Jul 2014 19:09:19 GMT etag W/"ce91c4f683d32f8907f0e97f3fb93696" content-encoding gzip x-moose majestic accept-ranges bytes date Tue, 14 Dec 2021 11:11:41 GMT via 1.1 varnish cache-control private, max-age=3600 strict-transport-security max-age=15552000; includeSubDomains; preload server snooserv x-clacks-overhead GNU Terry Pratchett content-length 1801
GET DATA	200 OK	truncated /	42 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	symbol-defs.svg lifars.com/wp-content/themes/lifars/build/images/svg/	16 KB 16 KB	182ms 182ms	Other image/svg+xml	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/build/images/svg/symbol-defs.svg?ver1533657233 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 5b089a492f1878aa62adf1350f58cc82bd4c09baa0b86f088520bab03af30c6a Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT x-content-type-options nosniff x-cacheable YES age 104319 vary User-Agent content-length 16002 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 07 Aug 2018 15:53:53 GMT server Apache x-frame-options SAMEORIGIN etag "3e82-572da66948640" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610914 682555203 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); accept-ranges bytes content-type image/svg+xml expires Wed, 12 Jan 2022 06:12:47 GMT
GET H2	200	search-light-gray.svg lifars.com/wp-content/themes/lifars/build/images/svg/	478 B 953 B	178ms 178ms	Image image/svg+xml	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL https://lifars.com/wp-content/themes/lifars/build/images/svg/search-light-gray.svg Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 55a5396caf11b9897da61286ec53429a92e1ab6880967170ee86234f8247b956 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT x-content-type-options nosniff x-cacheable YES age 104320 vary User-Agent content-length 478 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 07 Aug 2018 15:53:53 GMT server Apache x-frame-options SAMEORIGIN etag "1de-572da66948640" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610915 682555194 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); accept-ranges bytes content-type image/svg+xml expires Wed, 12 Jan 2022 06:12:46 GMT
GET DATA	200 OK	truncated /	7 KB 7 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c Request headers Referer Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type application/font-woff;charset=utf-8
GET H2	200	open-sans-v15-latin-regular.woff2 lifars.com/wp-content/themes/lifars/assets/resources/font/open-sans/	14 KB 14 KB	175ms 174ms	Font text/plain	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/assets/resources/font/open-sans/open-sans-v15-latin-regular.woff2 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 4959e89463a9467fbd929f85e9d62b347dbb7c4fb1d42fda16561dda4acb84fe Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 104320 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Sun, 29 Apr 2018 08:52:35 GMT server Apache x-frame-options SAMEORIGIN etag W/"36e0-56af8dbcf3ac9" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610916 682555190 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/plain expires Wed, 15 Dec 2021 06:12:46 GMT
GET H/1.1	200 OK	track.js Show response serve.albacross.com/	10 KB 5 KB	43ms 9ms	Script application/javascript	13.225.87.92 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://serve.albacross.com/track.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.225.87.92 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-87-92.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 38fbe56978cc73ba5a5f8c85b360f71aca125c2cd850a3cd6c3683385e388702 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:09:59 GMT Content-Encoding gzip Connection keep-alive Last-Modified Thu, 08 Apr 2021 13:13:21 GMT Server AmazonS3 Age 102 ETag W/"b769e9b4f23be6c9bab7c715fdf2526a" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront) Cache-Control max-age=120 Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C2 X-Amz-Cf-Id ec2K1ufqVbJT76m4x2BVVf4KjZiJFQDiDfopIJ7_qlF_I1-m4iImiQ==
GET H/1.1	200 OK	widgets.js Show response platform.twitter.com/	96 KB 29 KB	31ms 6ms	Script application/javascript	2606:2800:234:46c:e8b:1e2f:2bd:694 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67F2) / Resource Hash 97719c71e44494e537beba8d51c6bb268a34dcd867fdefc431229225ca734b46 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:11:41 GMT Content-Encoding gzip Last-Modified Thu, 02 Dec 2021 21:35:27 GMT Server ECS (frb/67F2) Age 926 Etag "50ec7e701ed018305368886c39cac301+gzip" Vary Accept-Encoding x-tw-cdn VZ P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin * Cache-Control public, max-age=1800 X-Cache HIT Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Content-Length 29126
GET H3	200	sdk.js Show response connect.facebook.net/en_US/	3 KB 2 KB	18ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash b68033d8513f1647fb51f6ac7f51420e8910990451b6e3d6418652ca29f7970e Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 hYc+HxTEcxAHLFAz3krNxA== document-policy force-load-at-top cross-origin-resource-policy cross-origin expires Tue, 14 Dec 2021 11:29:57 GMT alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 1687 x-fb-rlafr 0 x-fb-debug i6V/pKXetkz3Nn6C3/XqlPFbetn7wcgJSVnNwvvTfC4VaT7O1kOPwEj/gTo4GZUR/rqq7Q3OJQYVb5qTMzF0sw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-content-md5 5af6aed81b243528036a3be76693ea7d cross-origin-opener-policy same-origin-allow-popups date Tue, 14 Dec 2021 11:11:41 GMT x-frame-options DENY report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public,max-age=1200,stale-while-revalidate=3600 etag "57c1ca1e309983ceea9e88bfcb27477b" timing-allow-origin * priority u=3,i access-control-expose-headers X-FB-Content-MD5
GET H2	200	skypewebsdk.js Show response swx.cdn.skype.com/shared/v/latest/	415 B 555 B	61ms 7ms	Script application/x-javascript	2606:2800:133:f17:19e8:2356:251b:2a9 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://swx.cdn.skype.com/shared/v/latest/skypewebsdk.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:133:f17:19e8:2356:251b:2a9 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F40) / Resource Hash ffa9005d5fc8c04baa86f5e1d759c0873c88e32a9164e1b8ce87802ea3aa2c46 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip content-md5 mpocD6xlbe0bgJ8Pv08HTw== age 198135 x-cache HIT content-length 260 x-ms-lease-status unlocked last-modified Thu, 29 Oct 2015 16:47:16 GMT server ECAcc (frc/8F40) etag 0x8D2E0809A8DD755 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 83a19851-801e-006a-3a0e-efb84f000000 x-ms-version 2009-09-19
GET H2	200	pinit.js Show response assets.pinterest.com/js/	361 B 431 B	366ms 362ms	Script application/javascript	2a02:26f0:6c00:2af::1931 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.pinterest.com/js/pinit.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:2af::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 3faadebc89cdb21d11634a032816f152462d1cb8903eb21d0642501fcad065de Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-encoding br x-cdn akamai etag "62d32c28f14783b94192cd8d35bc010d" vary Accept-Encoding, Origin access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-max-age 86400 cache-control max-age=300 accept-ranges bytes content-length 203 access-control-expose-headers X-CDN
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	5 KB 2 KB	30ms 8ms	Script application/x-javascript	2a02:26f0:6c00::210:ba0a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:ba0a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:11:41 GMT Content-Encoding gzip Last-Modified Wed, 29 Sep 2021 19:17:49 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=79141 Connection keep-alive Accept-Ranges bytes Content-Length 2036
GET H2	200	uwt.js Show response static.ads-twitter.com/	14 KB 6 KB	35ms 6ms	Script application/javascript	199.232.136.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip last-modified Mon, 20 Sep 2021 23:58:10 GMT etag "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip" vary Accept-Encoding,Host x-tw-cdn FT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" cache-control no-cache x-cache HIT, HIT accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 5410 x-served-by cache-iad-kiad7000162-IAD, cache-hhn11536-HHN
GET H2	200	g.gif pixel.wp.com/	50 B 116 B	6ms 6ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&j=1%3A10.4&blog=144359790&post=29615&tz=-5&srv=lifars.com&host=lifars.com&ref=&fcp=0&rand=0.5913741215311905 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers access-control-allow-origin * date Tue, 14 Dec 2021 11:11:41 GMT cache-control no-cache server nginx content-length 50 content-type image/gif
GET H2	204	25045877.js Show response bat.bing.com/p/action/	0 93 B	31ms 30ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/25045877.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers access-control-allow-origin * date Tue, 14 Dec 2021 11:11:40 GMT cache-control private,max-age=1800 accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 39D5B35535574285B515D77AFBDD7D64 Ref B: FRAEDGE1511 Ref C: 2021-12-14T11:11:41Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 151 B	33ms 33ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=25045877&Ver=2&mid=66a9fc09-e20d-4eea-8d9b-9e919b33eeed&sid=9d166c005cce11ec8f9f0769501d0876&vid=9d16c4e05cce11ecaeb875b41d80d814&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Quick%20Look%20at%20New%20TrickBot%20Affiliates&p=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&r=&evt=pageLoad&msclkid=N&sv=1&rn=102700 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:40 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 7E58C17D1CEA433AB8CAC4EFDCBCCBD9 Ref B: FRAEDGE1511 Ref C: 2021-12-14T11:11:41Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	252325295512279 Show response connect.facebook.net/signals/config/	305 KB 87 KB	8ms 8ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/252325295512279?v=2.9.48&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 47b806df20fbcb94e10b070a1bf4f8e7b281c3e99886dd7a33a250571a5e0b86 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 88844 x-xss-protection 0 pragma public x-fb-debug ZeMWkWarLQBaQLseaStnzj+6Q5JxXyh48deQ3Yu57U11NVNGrVMnvM2vsKBhHXZcr7T6FYUdwi7cvLx61o96Dw== cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:41 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	37 KB 14 KB	136ms 53ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-954568561 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash 9f4922667f15ec47709504b75c4433e7145f96078261bc9a11e386ca52fa18bb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14328 x-xss-protection 0 server cafe etag 12503521247758841375 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Tue, 14 Dec 2021 11:11:41 GMT
GET H3	200	sdk.js Show response connect.facebook.net/en_US/	284 KB 80 KB	17ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js?hash=8c1477978f8582be7b1888e16ebe7488 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/sdk.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 69bc73c4ad40e4f2a3bde43fd1f4c718582d1f05e5a02cbe745cd28e102d5841 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://lifars.com/ Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 oat4h0Ipa2D2dmWrRGImAg== document-policy force-load-at-top cross-origin-resource-policy cross-origin expires Wed, 14 Dec 2022 09:14:04 GMT alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 81992 x-fb-rlafr 0 x-fb-debug uzXNFvsUObuSQ8EcFvc1O1z67UZ4BiNekB2wG8JMHeLMQIaHXTIlMeMvagD+cG0Ckn8k0eARFKPd4FcCHQ/WOg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-content-md5 876d6a7fdd19b6cba95a926233713d18 cross-origin-opener-policy same-origin-allow-popups date Tue, 14 Dec 2021 11:11:41 GMT x-frame-options DENY report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public,max-age=31536000,stale-while-revalidate=3600,immutable etag "2a111603ebb39c960bd3fdfb44123c84" timing-allow-origin * priority u=3,i access-control-expose-headers X-FB-Content-MD5
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=696521&time=1639480301067&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D696521%26time%3D1639480301067%26url%3Dhttps%253A%252F%252Flifars.com%252F2021%252... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=696521&time=1639480301067&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=696521&time=1639480301067&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&liSync=true&e_ipv6=AQLuY6gnysS1xwAA...	0 156 B	601ms 398ms	Image application/javascript	108.174.10.14 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=696521&time=1639480301067&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&liSync=true&e_ipv6=AQLuY6gnysS1xwAAAX24pBhhg5ULMsd7O7jfrXnxvaY_W4phVnhMJce-YJMS6GeWP8XDMroT Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Server 108.174.10.14 , United States, ASN14413 (LINKEDIN, US), Reverse DNS 108-174-10-14.fwd.linkedin.com Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:42 GMT server Play linkedin-action 1 x-li-fabric prod-lor1 x-li-proto http/2 x-li-pop prod-lva1 content-type application/javascript content-length 0 x-li-uuid vJ7o+aWawBbgMkKloysAAA== Redirect headers date Tue, 14 Dec 2021 11:11:41 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 59918C1241B7407485347C9675236EC6 Ref B: VIEEDGE2308 Ref C: 2021-12-14T11:11:41Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=696521&time=1639480301067&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&liSync=true&e_ipv6=AQLuY6gnysS1xwAAAX24pBhhg5ULMsd7O7jfrXnxvaY_W4phVnhMJce-YJMS6GeWP8XDMroT x-li-proto http/2 content-length 0 x-li-uuid AAXTGUD/AkHWLwesj5R7/Q==
GET H/1.1	200 OK	embed.js Show response downloads.mailchimp.com/js/signup-forms/popup/	126 KB 46 KB	40ms 10ms	Script application/javascript	13.224.189.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://downloads.mailchimp.com/js/signup-forms/popup/embed.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-54MKD2 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-22.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 07442f2bc9e417e7e700d142493b5564d926d3b28a365632e87f9e0a1c992b70 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:11:29 GMT Content-Encoding gzip Last-Modified Thu, 09 Dec 2021 21:56:25 GMT Server AmazonS3 Age 29 ETag W/"0685931cf1dde37f88e2e0520bb8fcdc" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront) Connection keep-alive Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 X-Amz-Cf-Id lWOO7RkvoJTN2rgco-mPd16e128XVp9S7svqGgvUUw0PkxY-okSbKQ==
GET H/1.1	200 OK	widget_iframe.21f942bb866c2823339b839747a0c50c.html Show response platform.twitter.com/widgets/ Frame F9C0	319 KB 103 KB	8ms 7ms	Document text/html	2606:2800:234:46c:e8b:1e2f:2bd:694 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/widget_iframe.21f942bb866c2823339b839747a0c50c.html?origin=https%3A%2F%2Flifars.com Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6739) / Resource Hash c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ Response headers Content-Encoding gzip Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 398715 Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Tue, 14 Dec 2021 11:11:41 GMT Etag "8321d7cf58d70200c1423dfa0bca40f6+gzip" Last-Modified Thu, 02 Dec 2021 21:34:18 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (frb/6739) Vary Accept-Encoding X-Cache HIT x-tw-cdn VZ Content-Length 105433
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	95ms 46ms	XHR text/plain	2a00:1450:4001:802::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j96&a=8368347&t=pageview&_s=1&dl=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&ul=en-us&de=UTF-8&dt=Quick%20Look%20at%20New%20TrickBot%20Affiliates&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1076401058&gjid=1307000091&cid=1921844734.1639480301&tid=UA-60073856-1&_gid=525509657.1639480301&_r=1&gtm=2ouc10&z=1845642241 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://lifars.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://lifars.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	4 B 24 B	90ms 47ms	XHR text/plain	2a00:1450:4001:802::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j96&a=8368347&t=pageview&_s=1&dl=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&ul=en-us&de=UTF-8&dt=Quick%20Look%20at%20New%20TrickBot%20Affiliates&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAUABAAAAAC~&jid=685748755&gjid=1456138793&cid=1921844734.1639480301&tid=UA-60073856-1&_gid=525509657.1639480301&_r=1&_slc=1&z=2113006948 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://lifars.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://lifars.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	83ms 40ms	Image image/gif	2a00:1450:4001:802::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j96&a=8368347&t=pageview&_s=2&dl=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&ul=en-us&de=UTF-8&dt=Quick%20Look%20at%20New%20TrickBot%20Affiliates&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=&gjid=&cid=1921844734.1639480301&tid=UA-60073856-1&_gid=525509657.1639480301&gtm=2ouc10&z=1082239181 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:13:37 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 79084 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 674 B	143ms 115ms	Script application/javascript	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o1tx1&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=f93c706b-38f0-4e4a-ba12-13f6eec2afcf&tw_document_href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tpx_cb=twttr.conversion.loadPixels Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 x-response-time 108 pragma no-cache last-modified Tue, 14 Dec 2021 11:11:41 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 8dfd19b45e3a94ae070441e1228e187fa3f85a68597dab0dec83d2d6b0f40b2c x-transaction 6e520e82d6a93bac expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 470 B	152ms 125ms	Image image/gif	104.244.42.69 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o1tx1&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=f93c706b-38f0-4e4a-ba12-13f6eec2afcf&tw_document_href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.69 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 119 pragma no-cache last-modified Tue, 14 Dec 2021 11:11:41 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash d09c1009aa38ee1c81a21103903b44057d406f84cef9c71d2543c75477f3341c x-transaction 227b0ff1b807b70e expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 295 B	24ms 7ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=252325295512279&ev=PageView&dl=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&rl=&if=false&ts=1639480301186&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1639480301185.360247754&it=1639480301044&coo=false&rqm=GET Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:41 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 44 expires Tue, 14 Dec 2021 11:11:41 GMT
GET H2	200	SkypeBootstrap.min.js Show response swx.cdn.skype.com/shared/v/1.2.5/	4 KB 2 KB	11ms 10ms	Script text/javascript	2606:2800:133:f17:19e8:2356:251b:2a9 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://swx.cdn.skype.com/shared/v/1.2.5/SkypeBootstrap.min.js Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:133:f17:19e8:2356:251b:2a9 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F43) / Resource Hash b03baa47be12bb9ec2a6e8c34b70c77d93e4495479638e6d08af06760dea8f80 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip content-md5 eFHv4baRuzbahX9hdJWxIw== age 554365 x-cache HIT content-length 1930 x-ms-lease-status unlocked last-modified Fri, 12 Jun 2015 13:54:54 GMT server ECAcc (frc/8F43) etag 0x8D2732E7EF2F781 vary Accept-Encoding content-type text/javascript; charset=utf-8 access-control-allow-origin * x-ms-request-id 9b88fc2e-b01e-0004-0bd0-eb1166000000 x-ms-version 2009-09-19
GET H2	200	button-embed.js Show response www.reddit.com/static/button/ Frame 5754	2 KB 3 KB	8ms 7ms	Script application/javascript	151.101.129.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/static/button/button-embed.js Requested by Host: www.reddit.com URL: https://www.reddit.com/static/button/button1.html?newwindow=true&width=120&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&title=Quick%20Look%20at%20New%20TrickBot%20Affiliates Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 03ee9438bb4014edc93a5a2d3069f2371a5e2e35e24b79527ec019790bc270b5 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.reddit.com/static/button/button1.html?newwindow=true&width=120&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&title=Quick%20Look%20at%20New%20TrickBot%20Affiliates User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-moose majestic via 1.1 varnish x-clacks-overhead GNU Terry Pratchett last-modified Wed, 22 Oct 2014 17:47:37 GMT server snooserv etag "f6e79e0098bfda54ca2e0e02da223645" strict-transport-security max-age=15552000; includeSubDomains; preload content-type application/javascript cache-control private, max-age=3600 date Tue, 14 Dec 2021 11:11:41 GMT accept-ranges bytes content-length 2536
GET DATA	200 OK	truncated / Frame 5754	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b2a78959284e4cb23c9e1b47f7b69d90e6a274a894652c58511e81192b5280b7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET H2	200	/ Show response lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/	3 KB 3 KB	771ms 768ms	XHR application/json	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/?relatedposts=1 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/js/autoptimize_d0dd1488e6fdf42661886b61ed33cba4.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 613a104b744cfc30fde2777376cb407292929319860167c699ecf568e8e6f123 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ x-requested-with XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:27 GMT x-content-type-options nosniff x-cacheable NO:Not Cacheable age 0 vary User-Agent content-length 2918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin server Apache x-frame-options SAMEORIGIN strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610917 cache-control max-age=172800 permissions-policy microphone=();camera=(); accept-ranges bytes content-type application/json; charset=utf-8 expires Thu, 16 Dec 2021 11:11:26 GMT
GET H2	200	btn.js Show response widgets.getpocket.com/v1/j/	2 KB 1 KB	35ms 8ms	Script application/javascript	13.225.87.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://widgets.getpocket.com/v1/j/btn.js?v=1 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.87.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-87-39.fra2.r.cloudfront.net Software Apache/2.4.25 (Debian) / Resource Hash 5aa869ba3a3f7a8883a0e6457ebaea6bb7c9069e296bdc166ce30431d318bb90 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 10:57:10 GMT content-encoding gzip last-modified Mon, 13 Dec 2021 19:48:31 GMT server Apache/2.4.25 (Debian) age 1015 etag "90b-5d30c5b74c1c0-gzip" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript access-control-allow-origin https://pocket.com,https://getpocket.com,https://widgets.getpocket.com x-amz-cf-pop FRA2-C2 accept-ranges bytes content-length 1037 via 1.1 debe291145dc27044f50d04bac101cd9.cloudfront.net (CloudFront) x-amz-cf-id nJr84xsjQmNIwsxpe36N5uMycbG1jZer0digSmKb-sdVytHfDDXKyQ==
GET H/1.1	200 OK	in.js Show response platform.linkedin.com/	201 KB 61 KB	33ms 8ms	Script text/javascript	2a02:26f0:6c00::210:ba13 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://platform.linkedin.com/in.js?async=true Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:ba13 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Play / Resource Hash f1af63b5a81bab49295d1ec02867b8ee2aeb20c6108d4e923111bd3ce6526c06 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:11:41 GMT Content-Encoding gzip X-CDN-CLIENT-IP-VERSION IPV6 X-CDN AKAM Connection keep-alive Content-Length 62394 X-LI-UUID AAXTGJ8hHSDz7SwcpuGVXg== Server Play X-Li-Pop prod-lva1-x Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 X-Li-Source-Fabric prod-lva1 Cache-Control public, max-age=3600 X-LI-Proto http/1.1 X-Li-Fabric prod-ltx1 Expires Tue, 14 Dec 2021 11:26:26 GMT
GET H2	200	button Show response embed.tumblr.com/widgets/share/ Frame ED49	17 KB 6 KB	135ms 127ms	Document text/html	192.0.77.40 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://embed.tumblr.com/widgets/share/button?canonicalUrl=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&postcontent%5Btitle%5D=Quick%20Look%20at%20New%20TrickBot%20Affiliates&postcontent%5Bcontent%5D=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F Requested by Host: assets.tumblr.com URL: https://assets.tumblr.com/share-button.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.40 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS assets.tumblr.com Software nginx / Resource Hash 1d2d3014b8a8b583f89e2a5b13a1e9cff6cbd36d5b3852c44f603d4bb22a87fb Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ Response headers server nginx date Tue, 14 Dec 2021 11:11:41 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding x-rid 9f01a178a7f1d3c56f7a2a8d4de851ae p3p CP="Tumblr's privacy policy is available here: https://www.tumblr.com/policy/en/privacy" x-xss-protection 1; mode=block x-content-type-options nosniff x-robots-tag noindex cache-control max-age=120 x-ua-compatible IE=Edge,chrome=1 content-encoding br x-nc MISS hhn 1 access-control-allow-origin * strict-transport-security max-age=31536000; preload
GET H2	200	form-settings Show response mc.us9.list-manage.com/subscribe/	1 KB 2 KB	215ms 177ms	Script application/json	95.101.44.28 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://mc.us9.list-manage.com/subscribe/form-settings?u=7ef36ba4621087543ba16eec9&id=20a0f45127&u=7ef36ba4621087543ba16eec9&id=20a0f45127&c=dojo_request_script_callbacks.dojo_request_script0 Requested by Host: downloads.mailchimp.com URL: https://downloads.mailchimp.com/js/signup-forms/popup/embed.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 95.101.44.28 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-101-44-28.deploy.static.akamaitechnologies.com Software openresty / Resource Hash 5bbeaa1c21f78fada497f6af46de4437362ac0dac831776eb92230fdaae27499 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 154 date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip referrer-policy same-origin server openresty x-edgeconnect-midmile-rtt 0 vary Accept-Encoding content-type application/json; charset=utf-8 cache-control max-age=300 x-ua-compatible IE=edge,chrome=1 content-length 767 expires Tue, 14 Dec 2021 11:16:41 GMT
GET H2	200	montserrat-v12-latin-regular.woff2 lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/	18 KB 19 KB	93ms 92ms	Font text/plain	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/montserrat-v12-latin-regular.woff2 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash f4ea8fdaa8cf7d780d60fc5e2c5980f7de2093f80b1b9bea84b06f8bd990426e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 104319 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Sun, 29 Apr 2018 08:52:35 GMT server Apache x-frame-options SAMEORIGIN etag W/"48fc-56af8dbcf3ac9" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610918 682555214 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/plain expires Wed, 15 Dec 2021 06:12:47 GMT
GET H2	200	montserrat-v12-latin-500.woff2 lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/	18 KB 19 KB	94ms 91ms	Font text/plain	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/montserrat-v12-latin-500.woff2 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 0acfb99792103338e34645b65a7fb22e96e2440288250bb4b3828dcecc32ccea Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 104319 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Sun, 29 Apr 2018 08:52:35 GMT server Apache x-frame-options SAMEORIGIN etag W/"4928-56af8dbcf2b29" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610919 682555215 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/plain expires Wed, 15 Dec 2021 06:12:47 GMT
GET H2	200	montserrat-v12-latin-500italic.woff2 lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/	19 KB 19 KB	95ms 91ms	Font text/plain	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/montserrat-v12-latin-500italic.woff2 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash b732e23d085be49cda727e08676df1902200e23383ef7b32c84bd04d45e0f33c Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 104319 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Sun, 29 Apr 2018 08:52:35 GMT server Apache x-frame-options SAMEORIGIN etag W/"4af8-56af8dbcf2b29" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610920 682555216 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/plain expires Wed, 15 Dec 2021 06:12:47 GMT
GET H2	200	montserrat-v12-latin-600.woff2 lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/	18 KB 19 KB	98ms 96ms	Font text/plain	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/montserrat-v12-latin-600.woff2 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash dfdb72efc57dccdb7a16cf417adb4d97fa3238860265b354e6e8a3799789a217 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 104319 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Sun, 29 Apr 2018 08:52:35 GMT server Apache x-frame-options SAMEORIGIN etag W/"4940-56af8dbcf2b29" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610922 682555218 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/plain expires Wed, 15 Dec 2021 06:12:47 GMT
GET H2	200	montserrat-v12-latin-600italic.woff2 lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/	19 KB 19 KB	100ms 98ms	Font text/plain	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/montserrat-v12-latin-600italic.woff2 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 195a3d0f256509759fc4d0657facda1b2d0bc5feceaa955b49e73d9805f3fa4a Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 104319 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Sun, 29 Apr 2018 08:52:35 GMT server Apache x-frame-options SAMEORIGIN etag W/"4b60-56af8dbcf2b29" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610924 682555217 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/plain expires Wed, 15 Dec 2021 06:12:47 GMT
GET H2	200	montserrat-v12-latin-700.woff2 lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/	19 KB 19 KB	98ms 97ms	Font text/plain	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/assets/resources/font/montserrat/montserrat-v12-latin-700.woff2 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 95143c7b094444bce13ebec37e70b530bf36fc88491acaa0490c3fb5d3b1b4b2 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 104318 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Sun, 29 Apr 2018 08:52:35 GMT server Apache x-frame-options SAMEORIGIN etag W/"4a0c-56af8dbcf3ac9" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610923 682555226 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/plain expires Wed, 15 Dec 2021 06:12:48 GMT
GET H2	200	open-sans-v15-latin-600.woff2 lifars.com/wp-content/themes/lifars/assets/resources/font/open-sans/	14 KB 15 KB	95ms 94ms	Font text/plain	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/assets/resources/font/open-sans/open-sans-v15-latin-600.woff2 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 6db8f13cec3a790404fd5bca6adae8ae790eab9c8e6c89d5d6fb9fa2671564e2 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 104318 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Sun, 29 Apr 2018 08:52:35 GMT server Apache x-frame-options SAMEORIGIN etag W/"38d0-56af8dbcf3ac9" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610921 682555229 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/plain expires Wed, 15 Dec 2021 06:12:48 GMT
GET H2	200	open-sans-v15-latin-700.woff2 lifars.com/wp-content/themes/lifars/assets/resources/font/open-sans/	14 KB 15 KB	177ms 177ms	Font text/plain	208.97.144.40 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://lifars.com/wp-content/themes/lifars/assets/resources/font/open-sans/open-sans-v15-latin-700.woff2 Requested by Host: lifars.com URL: https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.97.144.40 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS wp472643.dreamhostps.com Software Apache / Resource Hash 541605d613d8a5f18a310407038dc132487fe623ccfeb6d5a956faf5b191ff22 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lifars.com/wp-content/cache/autoptimize/css/autoptimize_fe867a222fb2986a46f92f9d20f3ed26.css Origin https://lifars.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:26 GMT content-encoding br x-content-type-options nosniff x-cacheable YES age 104318 vary User-Agent,Accept-Encoding x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Sun, 29 Apr 2018 08:52:35 GMT server Apache x-frame-options SAMEORIGIN etag W/"3980-56af8dbcf3ac9" strict-transport-security max-age=63072000; includeSubDomains; preload x-varnish 682610925 682555230 cache-control max-age=31536000, public, must-revalidate permissions-policy microphone=();camera=(); content-type text/plain expires Wed, 15 Dec 2021 06:12:48 GMT
GET H2	404	button_info.json buttons.reddit.com/ Frame 5754	0 0	17ms 6ms	Script text/plain	151.101.129.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://buttons.reddit.com/button_info.json?jsonp=buttonEmbed.parseSubmission&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F Requested by Host: www.reddit.com URL: https://www.reddit.com/static/button/button-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.reddit.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:41 GMT via 1.1 varnish server Varnish x-timer S1639480301.269853,VS0,VE0 x-served-by cache-hhn4026-HHN x-cache MISS content-type text/plain accept-ranges bytes content-length 13 retry-after 0 x-cache-hits 0
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/954568561/	2 KB 2 KB	142ms 51ms	Script text/javascript	2a00:1450:4001:811::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/954568561/?random=1639480301269&cv=9&fst=1639480301269&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash b4e297d79b59f6dfec8a80c5d0bfd9e129c4f2facbe6aee51849477b61bf86de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1068 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ Show response www.googleadservices.com/pagead/conversion/954568561/	2 KB 1 KB	98ms 50ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion/954568561/?random=1639480301272&cv=9&fst=1639480301272&num=1&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&auid=690898990.1639480301&capi=1&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash a01bc604d8d16a18cb1e18b9b8e523a94b4831235d0db743682b07dc3786eb87 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1244 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ 954568561.privacysandbox.googleadservices.com/pagead/privacysandbox/conversion/954568561/	0 0	151ms 47ms	Image text/html	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://954568561.privacysandbox.googleadservices.com/pagead/privacysandbox/conversion/954568561/?random=1639480301272&cv=9&fst=1639480301272&num=1&fmt=3&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&auid=690898990.1639480301&capi=1&hn=www.googleadservices.com&bttype=purchase&async=1 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H2	200	LIFARS-cybersecurity-company-in-New-York.png i1.wp.com/lifars.com/wp-content/uploads/2018/11/	2 KB 3 KB	21ms 6ms	Image image/webp	192.0.77.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://i1.wp.com/lifars.com/wp-content/uploads/2018/11/LIFARS-cybersecurity-company-in-New-York.png?fit=170%2C52&ssl=1 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS i0.wp.com Software nginx / Resource Hash 3f1e9903258d266c9112d9c5158e90acf89b87f01b5919b45be7c9f797cb8afe Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc HIT hhn 2 date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff last-modified Thu, 05 Nov 2020 08:17:44 GMT server nginx etag "87457257e9d24092" vary Accept access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control public, max-age=63115200 timing-allow-origin * link <https://lifars.com/wp-content/uploads/2018/11/LIFARS-cybersecurity-company-in-New-York.png>; rel="canonical" content-length 2436 expires Sat, 05 Nov 2022 20:17:44 GMT
GET H2	200	Quick-Look-at-New-TrickBot-Affiliates-purple.jpg i1.wp.com/lifars.com/wp-content/uploads/2021/11/	16 KB 16 KB	113ms 98ms	Image image/webp	192.0.77.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://i1.wp.com/lifars.com/wp-content/uploads/2021/11/Quick-Look-at-New-TrickBot-Affiliates-purple.jpg?resize=720%2C491&ssl=1 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS i0.wp.com Software nginx / Resource Hash d69215e6bb2deee2f07798951fc52a21af73dd13484e2a799812aef05921f9e1 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc MISS hhn 3 date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff last-modified Tue, 14 Dec 2021 11:11:41 GMT server nginx etag "f4166585868f5626" vary Accept access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control public, max-age=63115200 timing-allow-origin * link <https://lifars.com/wp-content/uploads/2021/11/Quick-Look-at-New-TrickBot-Affiliates-purple.jpg>; rel="canonical" content-length 16090 expires Thu, 14 Dec 2023 23:11:41 GMT
GET H2	200	905_1.2.5.0 Show response a.config.skype.com/config/v1/SkypeLyncWebExperience/	2 KB 1 KB	251ms 170ms	Script application/javascript	2620:1ec:22::16 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://a.config.skype.com/config/v1/SkypeLyncWebExperience/905_1.2.5.0?apikey=shareButton&fingerprint=b8a416e6-f565-4132-9851-9a62240339c7&callback=Skype.onConfigurationLoaded Requested by Host: swx.cdn.skype.com URL: https://swx.cdn.skype.com/shared/v/1.2.5/SkypeBootstrap.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:22::16 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash f6a642d0147ee7b87d533b34f2ffe857a9b89404db0980475a6e20f059d2683d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding br x-content-type-options nosniff x-msedge-ref Ref A: 1F0482CB80F4459CB1BDE28B0DEA0C07 Ref B: VIEEDGE2308 Ref C: 2021-12-14T11:11:41Z etag "GGLFZbaLGlbWn2spnBITcQ+a3NBYK3y74vu30KIhQds=" x-frame-options DENY x-cache CONFIG_NOCACHE content-type application/javascript cache-control no-cache,max-age=3600 date Tue, 14 Dec 2021 11:11:41 GMT content-length 892 expires Tue, 14 Dec 2021 12:11:41 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 438 B	59ms 18ms	XHR text/plain	2a00:1450:400c:c0c::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-60073856-1&cid=1921844734.1639480301&jid=1076401058&gjid=1307000091&_gid=525509657.1639480301&_u=YEBAAUAAAAAAAC~&z=1268464012 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://lifars.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Tue, 14 Dec 2021 11:11:41 GMT content-type text/plain access-control-allow-origin https://lifars.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 70 B	59ms 19ms	XHR text/plain	2a00:1450:400c:c0c::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-60073856-1&cid=1921844734.1639480301&jid=685748755&gjid=1456138793&_gid=525509657.1639480301&_u=YEDAAUABAAAAAC~&z=1910575391 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://lifars.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Tue, 14 Dec 2021 11:11:41 GMT content-type text/plain access-control-allow-origin https://lifars.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	settings Show response syndication.twitter.com/ Frame F9C0	232 B 448 B	130ms 114ms	Fetch application/json	104.244.42.8 TWITTER
General Check archive.org Show headers Download Go to Full URL https://syndication.twitter.com/settings?session_id=2241f6002a14c1e125e8169a92ce3fbb7664fcf6 Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets/widget_iframe.21f942bb866c2823339b839747a0c50c.html?origin=https%3A%2F%2Flifars.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.8 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash 726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers Accept-Language de-DE,de;q=0.9 Referer https://platform.twitter.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-response-time 107 date Tue, 14 Dec 2021 11:11:40 GMT content-encoding gzip last-modified Tue, 14 Dec 2021 11:11:41 GMT server tsa_o vary Origin strict-transport-security max-age=631138519 content-type application/json; charset=utf-8 access-control-allow-origin https://platform.twitter.com cache-control must-revalidate, max-age=600 access-control-allow-credentials true x-connection-hash 8340b5d9de29264991e15a1b65d5a165903bbda35f484ffc8793294724603050 content-length 166
GET H2	200	button Show response widgets.getpocket.com/v1/ Frame E85F	840 B 962 B	8ms 7ms	Document text/html	13.225.87.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://widgets.getpocket.com/v1/button?label=pocket&count=horizontal&v=1&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&title=Quick%20Look%20at%20New%20TrickBot%20Affiliates&src=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&r=0.8501586197397266 Requested by Host: widgets.getpocket.com URL: https://widgets.getpocket.com/v1/j/btn.js?v=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.87.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-87-39.fra2.r.cloudfront.net Software Apache/2.4.25 (Debian) / PHP/5.6.40 Resource Hash 6a0276187ab30f53bc4fb0a3585e29629a9c07b2cc290bcc7969fdf6e30aa9b5 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ Response headers content-type text/html; charset=UTF-8 content-length 549 date Tue, 14 Dec 2021 10:54:49 GMT server Apache/2.4.25 (Debian) content-location button.php tcn choice x-powered-by PHP/5.6.40 content-encoding gzip access-control-allow-origin https://pocket.com,https://getpocket.com,https://widgets.getpocket.com vary Accept-Encoding x-cache Hit from cloudfront via 1.1 debe291145dc27044f50d04bac101cd9.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C2 x-amz-cf-id 6abNLEGZWy06IBymdcNgWuzxVHu7Qek_MfiKJf0MKTqNmhSznGVKlA== age 1012
GET H/1.1	200 OK	widgetButton.91d9e0cb42c020d8c4b1.css assets.getpocket.com/web/ Frame E85F	3 KB 2 KB	63ms 7ms	Stylesheet text/css	13.224.189.116 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets.getpocket.com/web/widgetButton.91d9e0cb42c020d8c4b1.css Requested by Host: widgets.getpocket.com URL: https://widgets.getpocket.com/v1/button?label=pocket&count=horizontal&v=1&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&title=Quick%20Look%20at%20New%20TrickBot%20Affiliates&src=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&r=0.8501586197397266 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.116 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-116.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash e2d84e6a462105e079059bda163a5e23e9b326ad0cb42e2fef52ecf08e20a92e Request headers Accept-Language de-DE,de;q=0.9 Referer https://widgets.getpocket.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Mon, 25 Oct 2021 08:58:35 GMT Content-Encoding gzip Connection keep-alive Last-Modified Sat, 23 Oct 2021 06:23:18 GMT Server AmazonS3 Age 4327987 ETag W/"5ae752a86d7f88b510c944c8fdbd4398" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type text/css Via 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront) Cache-Control max-age=31536000,s-maxage=31536000 Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 X-Amz-Cf-Id HkjLv7ldpBfjUL7US3_G7groAXyw1Zuyp_teSxNxTyB3_3HZVVRbpQ==
GET H/1.1	200 OK	widgetButton.07894e99faa9149efc22.js Show response assets.getpocket.com/web/ Frame E85F	20 KB 8 KB	63ms 7ms	Script application/javascript	13.224.189.116 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets.getpocket.com/web/widgetButton.07894e99faa9149efc22.js Requested by Host: widgets.getpocket.com URL: https://widgets.getpocket.com/v1/button?label=pocket&count=horizontal&v=1&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&title=Quick%20Look%20at%20New%20TrickBot%20Affiliates&src=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&r=0.8501586197397266 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.116 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-116.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash bda25d34085deba48ab93343c355192ad55d7574968b9489445b9c2f476d0fa1 Request headers Accept-Language de-DE,de;q=0.9 Referer https://widgets.getpocket.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 08 Dec 2021 18:33:22 GMT Content-Encoding gzip Connection keep-alive Last-Modified Wed, 08 Dec 2021 17:26:55 GMT Server AmazonS3 Age 491900 ETag W/"df2da7c206cf2779b6512bc373d0005b" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront) Cache-Control max-age=31536000,s-maxage=31536000 Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 X-Amz-Cf-Id t8M_kgU-c94tQWH7wMzqZ2rF-UzI3r0YSaZyJfUc7cFKsRvBxgPhXA==
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	150ms 62ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-60073856-1&cid=1921844734.1639480301&jid=1076401058&_u=YEBAAUAAAAAAAC~&z=1791926745 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	151ms 64ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-60073856-1&cid=1921844734.1639480301&jid=1076401058&_u=YEBAAUAAAAAAAC~&z=1791926745 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	150ms 63ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-60073856-1&cid=1921844734.1639480301&jid=685748755&_u=YEDAAUABAAAAAC~&z=2126842803 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	151ms 64ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-60073856-1&cid=1921844734.1639480301&jid=685748755&_u=YEDAAUABAAAAAC~&z=2126842803 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	index.build.css assets.tumblr.com/client/prod/standalone/share-button-internal/ Frame ED49	2 KB 551 B	6ms 6ms	Stylesheet text/css	192.0.77.40 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://assets.tumblr.com/client/prod/standalone/share-button-internal/index.build.css?_v=09f72c9f7e3de0d8c0cf38d5a207324f Requested by Host: embed.tumblr.com URL: https://embed.tumblr.com/widgets/share/button?canonicalUrl=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&postcontent%5Btitle%5D=Quick%20Look%20at%20New%20TrickBot%20Affiliates&postcontent%5Bcontent%5D=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.40 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS assets.tumblr.com Software nginx / Resource Hash 2e6c1bf7dc5b45def8f7b17f91accb549c53c1199a38296801c6393741a9c395 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload, max-age=31536000; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://embed.tumblr.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc HIT hhn 1 date Tue, 14 Dec 2021 11:11:41 GMT content-encoding br last-modified Sun, 01 Nov 2020 05:00:47 GMT server nginx etag W/"5f9e40ff-6cf" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=315360000, immutable strict-transport-security max-age=31536000; preload, max-age=31536000; preload timing-allow-origin * expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	index.build.js Show response assets.tumblr.com/client/prod/standalone/share-button-internal/ Frame ED49	210 KB 62 KB	6ms 6ms	Script application/javascript	192.0.77.40 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://assets.tumblr.com/client/prod/standalone/share-button-internal/index.build.js?_v=13b74d941227d7bb225b3790be80ee16 Requested by Host: embed.tumblr.com URL: https://embed.tumblr.com/widgets/share/button?canonicalUrl=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&postcontent%5Btitle%5D=Quick%20Look%20at%20New%20TrickBot%20Affiliates&postcontent%5Bcontent%5D=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.40 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS assets.tumblr.com Software nginx / Resource Hash a72ad54e640af3278a14244692e4e237c0ed5abe81e289c67f4552cdd6471698 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload, max-age=31536000; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://embed.tumblr.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc HIT hhn 1 date Tue, 14 Dec 2021 11:11:41 GMT content-encoding br last-modified Wed, 17 Mar 2021 14:25:08 GMT server nginx etag W/"60521144-34864" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, immutable strict-transport-security max-age=31536000; preload, max-age=31536000; preload timing-allow-origin * expires Thu, 31 Dec 2037 23:55:55 GMT
GET H3	200	/ www.google.de/pagead/1p-conversion/954568561/ Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/954568561/?random=470482605&cv=9&fst=1639480301272&num=1&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_... https://www.google.com/pagead/1p-conversion/954568561/?random=470482605&cv=9&fst=1639480301272&num=1&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw... https://www.google.de/pagead/1p-conversion/954568561/?random=470482605&cv=9&fst=1639480301272&num=1&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=...	42 B 64 B	101ms 53ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-conversion/954568561/?random=470482605&cv=9&fst=1639480301272&num=1&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&auid=690898990.1639480301&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=7Xu4YerQFJvLx_AP_uGpqAM&eitems=ChEIgJ7hjQYQ7LDOlI7U-J20ARIdADmdPEU5v9ytqCf1mOf87xP5fsTN1j5k639QD8s&random=2998915897&resp=GooglemKTybQhCsO&ipr=y&prhg=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif location https://www.google.de/pagead/1p-conversion/954568561/?random=470482605&cv=9&fst=1639480301272&num=1&value=0&label=K09ICLatzXAQ8Z6WxwM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgc10&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&auid=690898990.1639480301&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=7Xu4YerQFJvLx_AP_uGpqAM&eitems=ChEIgJ7hjQYQ7LDOlI7U-J20ARIdADmdPEU5v9ytqCf1mOf87xP5fsTN1j5k639QD8s&random=2998915897&resp=GooglemKTybQhCsO&ipr=y&prhg=0 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pinit_main.js Show response assets.pinterest.com/js/	66 KB 19 KB	103ms 102ms	Script application/javascript	2a02:26f0:6c00:2af::1931 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.pinterest.com/js/pinit_main.js?0.18852204699661024 Requested by Host: assets.pinterest.com URL: https://assets.pinterest.com/js/pinit.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:2af::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 20f0315c97ff7007f2e7a94d659e094a7efc01b8306da53987538c1101489e0e Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-encoding br x-cdn akamai etag "3725764cf05d1a0938de73d398772331" vary Accept-Encoding, Origin access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-max-age 86400 cache-control max-age=300 accept-ranges bytes content-length 18679 access-control-expose-headers X-CDN
GET H2	200	flat-t-button-white.svg assets.tumblr.com/images/ Frame ED49	308 B 275 B	7ms 6ms	Image image/svg+xml	192.0.77.40 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://assets.tumblr.com/images/flat-t-button-white.svg?v=b14d6d201b7992bea0f0f2b3aa1ffa28 Requested by Host: assets.tumblr.com URL: https://assets.tumblr.com/client/prod/standalone/share-button-internal/index.build.css?_v=09f72c9f7e3de0d8c0cf38d5a207324f Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.40 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS assets.tumblr.com Software nginx / Resource Hash ff4d0997c2e50c36a602155ee870eb629e5847f610923d45889f4bea0147d16c Security Headers Name Value Strict-Transport-Security max-age=31536000; preload, max-age=31536000; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://assets.tumblr.com/client/prod/standalone/share-button-internal/index.build.css?_v=09f72c9f7e3de0d8c0cf38d5a207324f User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc HIT hhn 1 date Tue, 14 Dec 2021 11:11:41 GMT content-encoding br last-modified Wed, 21 Oct 2020 05:06:36 GMT server nginx etag W/"5f8fc1dc-134" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control max-age=315360000, immutable strict-transport-security max-age=31536000; preload, max-age=31536000; preload timing-allow-origin * expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	saves Show response widgets.getpocket.com/api/ Frame E85F	11 B 382 B	183ms 182ms	XHR application/json	13.225.87.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://widgets.getpocket.com/api/saves?url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F Requested by Host: assets.getpocket.com URL: https://assets.getpocket.com/web/widgetButton.07894e99faa9149efc22.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.87.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-87-39.fra2.r.cloudfront.net Software Apache/2.4.25 (Debian) / PHP/5.6.40 Resource Hash 70a18337b987c7639db9de27723cdb120997777f506cc3b419b055575ca9ff61 Request headers Accept-Language de-DE,de;q=0.9 Referer https://widgets.getpocket.com/v1/button?label=pocket&count=horizontal&v=1&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&title=Quick%20Look%20at%20New%20TrickBot%20Affiliates&src=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&r=0.8501586197397266 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:41 GMT via 1.1 debe291145dc27044f50d04bac101cd9.cloudfront.net (CloudFront) server Apache/2.4.25 (Debian) x-amz-cf-pop FRA2-C2 x-powered-by PHP/5.6.40 x-cache Miss from cloudfront content-type application/json access-control-allow-origin https://pocket.com,https://getpocket.com,https://widgets.getpocket.com tcn choice content-location saves.php content-length 11 x-amz-cf-id QTxQnpwF2z4oFxkS6jGUS2HEUaG5p5g-vokGH-z-GRkvQcoJJwgJyw==
GET H/1.1	200 OK	pocket_button.d3a57cce2ccd22d7db8e29ff66dc09df.png assets.getpocket.com/web/widgetButton/images/ Frame E85F	1 KB 2 KB	8ms 8ms	Image image/png	13.224.189.116 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://assets.getpocket.com/web/widgetButton/images/pocket_button.d3a57cce2ccd22d7db8e29ff66dc09df.png Requested by Host: assets.getpocket.com URL: https://assets.getpocket.com/web/widgetButton.91d9e0cb42c020d8c4b1.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.116 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-116.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 4022b5ef36894f1e2bcedab9a1574665218e7c0f05408ebe8e8ff689601088db Request headers Accept-Language de-DE,de;q=0.9 Referer https://assets.getpocket.com/web/widgetButton.91d9e0cb42c020d8c4b1.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sun, 25 Jul 2021 05:35:48 GMT Via 1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront) Connection keep-alive Last-Modified Wed, 21 Jul 2021 19:25:34 GMT Server AmazonS3 Age 12288954 ETag "d3a57cce2ccd22d7db8e29ff66dc09df" X-Cache Hit from cloudfront Content-Type image/png Cache-Control max-age=31536000,s-maxage=31536000 X-Amz-Cf-Pop FRA2-C1 Accept-Ranges bytes Content-Length 1062 X-Amz-Cf-Id 46YDJbQYB9K-aMpd-iKaIvYItMAAhFxVMX2nXM2LaS_GkR-Ut-yGEw==
GET H2	200	/ www.google.com/pagead/1p-user-list/954568561/	42 B 548 B	52ms 50ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/954568561/?random=1639480301269&cv=9&fst=1639479600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&async=1&fmt=3&is_vtc=1&random=2561946053&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/954568561/	42 B 548 B	54ms 53ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/954568561/?random=1639480301269&cv=9&fst=1639479600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&tiba=Quick%20Look%20at%20New%20TrickBot%20Affiliates&async=1&fmt=3&is_vtc=1&random=2561946053&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Tue, 14 Dec 2021 11:11:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	popup.js Show response downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/	100 KB 31 KB	10ms 10ms	Script application/javascript	13.224.189.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js Requested by Host: downloads.mailchimp.com URL: https://downloads.mailchimp.com/js/signup-forms/popup/embed.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-22.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 650e65709312c691110957b8a8cc1609ac7b5685f265e1e06f389d271da4fedf Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:11:29 GMT Content-Encoding gzip Last-Modified Fri, 22 May 2020 15:07:49 GMT Server AmazonS3 Age 14 ETag W/"9e882a863f24e02737da75af35a34ee6" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront) Connection keep-alive Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 X-Amz-Cf-Id meZO2OXOO-ymBU3jfBfiHAboW4zPb4nKrdZQG5xhHpPf5ZDpBP6lzA==
GET H/1.1	200 OK	button.0d6aa7fd095b2a9dd19cc66c7c2ed64b.js Show response platform.twitter.com/js/	7 KB 3 KB	6ms 6ms	Script application/javascript	2606:2800:234:46c:e8b:1e2f:2bd:694 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/js/button.0d6aa7fd095b2a9dd19cc66c7c2ed64b.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67F2) / Resource Hash 186ef01aca1c73789f73c2f4388a26387e38e5fd8a05f4f1c3785709cec25f66 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:11:41 GMT Content-Encoding gzip Last-Modified Thu, 02 Dec 2021 21:34:11 GMT Server ECS (frb/67F2) Age 398716 Etag "e8090d17c9828f5a217bebb39dd3e689+gzip" Vary Accept-Encoding x-tw-cdn VZ P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin * Cache-Control public, max-age=315360000 X-Cache HIT Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Content-Length 2294
GET H/1.1	200 OK	tweet_button.21f942bb866c2823339b839747a0c50c.en.html Show response platform.twitter.com/widgets/ Frame 516A	32 KB 12 KB	7ms 6ms	Document text/html	2606:2800:234:46c:e8b:1e2f:2bd:694 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/tweet_button.21f942bb866c2823339b839747a0c50c.en.html Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67F2) / Resource Hash 612f1b11300114847b24820da8ce6a8e41e103cad7e3b392b59fb2d4009f96b2 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ Response headers Content-Encoding gzip Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 398716 Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Tue, 14 Dec 2021 11:11:41 GMT Etag "7bedc4d7904c5b9401a38944b0a7ed6f+gzip" Last-Modified Thu, 02 Dec 2021 21:34:15 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (frb/67F2) Vary Accept-Encoding X-Cache HIT x-tw-cdn VZ Content-Length 12236
GET H/1.1	200 OK	common.css downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 0C83	9 KB 3 KB	9ms 8ms	Stylesheet text/css	13.224.189.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css Requested by Host: downloads.mailchimp.com URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-22.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:10:44 GMT Content-Encoding gzip Last-Modified Fri, 22 May 2020 15:07:51 GMT Server AmazonS3 Age 61 ETag W/"82e72d627b04e1654282023cca1d1e69" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type text/css Via 1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront) Connection keep-alive Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 X-Amz-Cf-Id llLENax0SNzvcb8scWjmi1cwgmNBgVqJOil6OJtSdVPhb_5gflUtTg==
GET H/1.1	200 OK	banner.css downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 0C83	1005 B 937 B	17ms 7ms	Stylesheet text/css	13.224.189.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/banner.css Requested by Host: downloads.mailchimp.com URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-22.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash bece213397fe5f546674ee29dd3f69ec2f2cc0e480e67f09dcc4c25c0d12a3d7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:10:54 GMT Content-Encoding gzip Last-Modified Fri, 22 May 2020 15:07:52 GMT Server AmazonS3 Age 59 ETag W/"78d1bdd981816cfbeb6954a85f9efa58" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type text/css Via 1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront) Connection keep-alive Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 X-Amz-Cf-Id C7KGUynOyWCDGqZOy0nxnlYoc463NtuALb8yFAD-q7dB5WuxdetFRg==
GET H/1.1	200 OK	common.css downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 197A	9 KB 3 KB	21ms 9ms	Stylesheet text/css	13.224.189.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css Requested by Host: downloads.mailchimp.com URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-22.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:10:44 GMT Content-Encoding gzip Last-Modified Fri, 22 May 2020 15:07:51 GMT Server AmazonS3 Age 61 ETag W/"82e72d627b04e1654282023cca1d1e69" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type text/css Via 1.1 2bbba694ff55d664208103e9c25dce14.cloudfront.net (CloudFront) Connection keep-alive Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 X-Amz-Cf-Id z1OMZDhgJNjjQeKUcY0pgXRtcn5b5gQCR1O0ZmiPUrD0ry2N7t8wzg==
GET H/1.1	200 OK	layout-4.css downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 197A	1 KB 940 B	22ms 9ms	Stylesheet text/css	13.224.189.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/layout-4.css Requested by Host: downloads.mailchimp.com URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-22.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 7ff8cc81ca4d0241c3de19701bb4b253af27d4d8282ca079428043ad01edda1a Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:10:58 GMT Content-Encoding gzip Last-Modified Fri, 22 May 2020 15:07:52 GMT Server AmazonS3 Age 83 ETag W/"07d96a6ae20a51d3caa30ab83d143c60" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type text/css Via 1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront) Connection keep-alive Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 X-Amz-Cf-Id oZTlt0qaqlCNm-cF08QzsBXlk_S0aWPwgv-FGOtNWy1I_SyhRQQO_g==
GET H/1.1	200 OK	modal-slidein.css downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/	3 KB 2 KB	24ms 9ms	Stylesheet text/css	13.224.189.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/modal-slidein.css Requested by Host: downloads.mailchimp.com URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.189.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-22.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 717a079466da86282255203ddb9f6faafb2bf0ca0bb23ecb539463b3f963bde4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:11:37 GMT Content-Encoding gzip Last-Modified Fri, 22 May 2020 15:07:52 GMT Server AmazonS3 Age 62 ETag W/"d23d4c0fac6d9f158d23552bbd4592f0" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type text/css Via 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront) Connection keep-alive Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 X-Amz-Cf-Id ppnMOAmJiW57DOQrZCjUupPaPbWZMCCRsy77LktJSWFlI64jv7STkQ==
GET H2	200	count.json Show response widgets.pinterest.com/v1/urls/	118 B 345 B	123ms 98ms	Script application/javascript	151.101.192.84 FASTLY
General Check archive.org Show headers Download Go to Full URL https://widgets.pinterest.com/v1/urls/count.json?url=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&callback=PIN_1639480301530.f.callback[0] Requested by Host: assets.pinterest.com URL: https://assets.pinterest.com/js/pinit_main.js?0.18852204699661024 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.192.84 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 5711ddf533eaabef93546c5c0456d4f963b4bddddddb3eae35da1aec3e51e7e6 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:41 GMT content-encoding br x-content-type-options nosniff age 0 vary accept-encoding content-type application/javascript access-control-allow-origin * cache-control must-revalidate, max-age=887 x-envoy-upstream-service-time 1 accept-ranges none x-pinterest-rid 2813067446061489 expires Tue, 14 Dec 2021 11:26:41 GMT
GET DATA	200 OK	truncated / Frame 516A	822 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	shareButton.min.js Show response swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/js/	89 KB 24 KB	9ms 9ms	Script text/javascript	2606:2800:133:f17:19e8:2356:251b:2a9 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/js/shareButton.min.js Requested by Host: swx.cdn.skype.com URL: https://swx.cdn.skype.com/shared/v/1.2.5/SkypeBootstrap.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:133:f17:19e8:2356:251b:2a9 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8FF5) / Resource Hash 1e95bbe885ae3ff7043ba06629dc5d2700abc904dd4a991fc56b11a74cdf549a Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip content-md5 nEbx0XDuTOfKIghlU3AgpA== age 466868 x-cache HIT content-length 24840 x-ms-lease-status unlocked last-modified Fri, 09 Sep 2016 10:05:02 GMT server ECAcc (frc/8FF5) etag 0x8D3D898C4539BF4 vary Accept-Encoding content-type text/javascript;charset=utf-8 access-control-allow-origin * x-ms-request-id 9fa85327-501e-0005-0a9c-ec109b000000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	shareButton.css swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/assets/css/	1 KB 688 B	7ms 7ms	Stylesheet text/css	2606:2800:133:f17:19e8:2356:251b:2a9 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/assets/css/shareButton.css Requested by Host: swx.cdn.skype.com URL: https://swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/js/shareButton.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:133:f17:19e8:2356:251b:2a9 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F1E) / Resource Hash 3742b70cc47b32ad33ec82c11c352ad552f994392b08c48e542cde5b151b4df0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip content-md5 ShlKH1VH3VJxpWckWeUpyg== age 120962 x-cache HIT content-length 533 x-ms-lease-status unlocked last-modified Fri, 09 Sep 2016 10:05:03 GMT server ECAcc (frc/8F1E) etag 0x8D3D898C49F74B2 vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id e31a251f-d01e-0132-2ec1-effa61000000 x-ms-version 2009-09-19 accept-ranges bytes
POST H/1.1	200 OK	/ Show response browser.pipe.aria.microsoft.com/Collector/3.0/	0 397 B	665ms 161ms	XHR application/json	20.189.173.12 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://browser.pipe.aria.microsoft.com/Collector/3.0/?qsp=true&content-type=application%2Fbond-compact-binary&client-id=NO_AUTH&sdk-version=ACT-Web-JS-2.4.0&x-apikey=bc1a88c3ef7240a99d650eacd67609ae-b21a92f6-51f2-46d6-be26-e7f9b8722dfa-7553 Requested by Host: swx.cdn.skype.com URL: https://swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/js/shareButton.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.189.173.12 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 11:11:41 GMT Server Microsoft-HTTPAPI/2.0 time-delta-millis 579 Access-Control-Allow-Methods POST Content-Type application/json Access-Control-Allow-Origin * Access-Control-Expose-Headers kill-tokens, kill-duration-seconds, time-delta-millis Access-Control-Allow-Headers Accept, Content-Type, Content-Encoding, Client-Id Content-Length 0
GET H2	200	s_logo.svg swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/assets/images/	2 KB 1 KB	9ms 9ms	Image image/svg+xml	2606:2800:133:f17:19e8:2356:251b:2a9 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/assets/images/s_logo.svg Requested by Host: swx.cdn.skype.com URL: https://swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/assets/css/shareButton.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:133:f17:19e8:2356:251b:2a9 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8FB6) / Resource Hash 18da17a7e007f25707e9d21e7ee3ae92969fc28e037757b3fbb15d61345cfa96 Request headers Accept-Language de-DE,de;q=0.9 Referer https://swx.cdn.skype.com/skypewebsdk/shareButton/v/1.4.0.0/assets/css/shareButton.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip content-md5 TDfFmJGUdE2r6GuIA8u0hg== age 466316 x-cache HIT content-length 1107 x-ms-lease-status unlocked last-modified Fri, 09 Sep 2016 10:05:04 GMT server ECAcc (frc/8FB6) etag 0x8D3D898C55201E8 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 41c202be-f01e-0003-1d9d-ece7e3000000 x-ms-version 2009-09-19
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 859adbfc48bb0b06c58fe109db4909585fbca5df398d49185fc0f486bad1ac96 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	jot syndication.twitter.com/i/	43 B 357 B	124ms 124ms	Image image/gif	104.244.42.8 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22lifarsllc%22%2C%22widget_creator_screen_name%22%3A%22lifarsllc%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1639480301666%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%229fd78d5%3A1638479056965%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.8 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:41 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 117 pragma no-cache last-modified Tue, 14 Dec 2021 11:11:41 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 8340b5d9de29264991e15a1b65d5a165903bbda35f484ffc8793294724603050 x-transaction 3eec457da40bf590 expires Tue, 31 Mar 1981 05:00:00 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame 58C3	0 18 B	17ms 8ms	Document text/plain	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 Origin https://lifars.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ Response headers content-type text/plain access-control-allow-origin https://lifars.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin content-length 0 server proxygen-bolt alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 priority u=3,i date Tue, 14 Dec 2021 11:11:41 GMT
GET H2	200	Trickbot-Gangs-Extend-its-Reach-Thanks-to-Affiliates-purple.jpg i1.wp.com/lifars.com/wp-content/uploads/2021/11/	4 KB 4 KB	59ms 58ms	Image image/webp	192.0.77.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://i1.wp.com/lifars.com/wp-content/uploads/2021/11/Trickbot-Gangs-Extend-its-Reach-Thanks-to-Affiliates-purple.jpg?fit=1200%2C818&ssl=1&resize=350%2C200 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS i0.wp.com Software nginx / Resource Hash 37d519e4789e25718bca8e14f75296a7b096ea72adbfc67ef22f951a542826a9 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc MISS hhn 3 date Tue, 14 Dec 2021 11:11:42 GMT x-content-type-options nosniff last-modified Tue, 14 Dec 2021 11:11:42 GMT server nginx etag "fd9d42e287281b72" vary Accept access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control public, max-age=63115200 timing-allow-origin * link <https://lifars.com/wp-content/uploads/2021/11/Trickbot-Gangs-Extend-its-Reach-Thanks-to-Affiliates-purple.jpg>; rel="canonical" content-length 3740 expires Thu, 14 Dec 2023 23:11:42 GMT
GET H2	200	Trickbot_purple.jpg i2.wp.com/lifars.com/wp-content/uploads/2021/07/	7 KB 7 KB	14ms 13ms	Image image/webp	192.0.77.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://i2.wp.com/lifars.com/wp-content/uploads/2021/07/Trickbot_purple.jpg?fit=1200%2C818&ssl=1&resize=350%2C200 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS i0.wp.com Software nginx / Resource Hash db9963a3e7bbcb64ed14eee7de31502c06601ccb6bcc8fbb4ff568d9f4d902e8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc MISS hhn 2 date Tue, 14 Dec 2021 11:11:42 GMT x-content-type-options nosniff last-modified Sun, 28 Nov 2021 20:09:24 GMT server nginx etag "da2e869ecb6d9b34" vary Accept access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control public, max-age=63115200 timing-allow-origin * link <https://lifars.com/wp-content/uploads/2021/07/Trickbot_purple.jpg>; rel="canonical" content-length 7340 expires Wed, 29 Nov 2023 08:09:24 GMT
GET H2	200	The-UEFIBIOS-Firmware-is-Vulnerable-to-the-New-TrickBot-Version-scaled.jpg i0.wp.com/lifars.com/wp-content/uploads/2020/12/	4 KB 5 KB	13ms 6ms	Image image/webp	192.0.77.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://i0.wp.com/lifars.com/wp-content/uploads/2020/12/The-UEFIBIOS-Firmware-is-Vulnerable-to-the-New-TrickBot-Version-scaled.jpg?fit=1200%2C800&ssl=1&resize=350%2C200 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS i0.wp.com Software nginx / Resource Hash 1bdd43f0d87b823f10af912554f4fed38ce35ec7f5481d5dae4d3ddb88902d56 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-nc HIT hhn 4 date Tue, 14 Dec 2021 11:11:42 GMT x-content-type-options nosniff last-modified Mon, 15 Nov 2021 10:20:58 GMT server nginx etag "a5bb4510df4dd4b9" vary Accept access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control public, max-age=63115200 timing-allow-origin * link <https://lifars.com/wp-content/uploads/2020/12/The-UEFIBIOS-Firmware-is-Vulnerable-to-the-New-TrickBot-Version-scaled.jpg>; rel="canonical" content-length 4380 expires Wed, 15 Nov 2023 22:20:58 GMT
GET H3	200	share_button.php Show response www.facebook.com/v2.3/plugins/ Frame 325B	43 KB 13 KB	96ms 95ms	Document text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/sdk.js?hash=8c1477978f8582be7b1888e16ebe7488 Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash fdf4531e8f1f751a73f53c6f8a1fafbfe8a928907dbd0d0571b2e8c900e53d2e Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net cx.atdmt.com www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com ad.atdmt.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ Response headers vary Accept-Encoding content-encoding br x-fb-rlafr 0 document-policy force-load-at-top cross-origin-resource-policy cross-origin cross-origin-opener-policy same-origin-allow-popups pragma no-cache cache-control private, no-cache, no-store, must-revalidate expires Sat, 01 Jan 2000 00:00:00 GMT x-content-type-options nosniff x-xss-protection 0 content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net cx.atdmt.com www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com ad.atdmt.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0; content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net cx.atdmt.com www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com ad.atdmt.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; facebook-api-version v5.0 strict-transport-security max-age=15552000; preload content-type text/html; charset="utf-8" x-fb-debug lR6QPmZxN8Bw/cyVQbNLKs8pKwF6ZXnRQMwrmFpy8ebTUeMhXztASjOfMBDFQddxI8y42XpZJofZsPYjicE57g== date Tue, 14 Dec 2021 11:11:42 GMT alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 priority u=3,i
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	41ms 41ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug 8v29V7TuZ7CBORG+KIph3gUVEkmQ4tUPQNXsHoxBa6vVlOMrOpvjCL9SIWs+olST+BRBN5qhi2WUt/PvcCGc6A== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	40ms 40ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug DVkdEwlODkrbFZOD2l+QoVrFUFQG7rNsDpVDPrz43Io+/5kaDtmJ0hTa39ZjWwxt/GjUwaBqZsro+M4bl9ZayA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	88ms 87ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug oKpaZfWz2JemxZnI1Is5CLJ9OudZfcnhIix339Zg2xziW3gRmxP6tEhERFWVZiAHPoKbrUBI/kIkUPswfYPU/A== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	45ms 44ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug eE7b2A9L5EkjadztiVs0XicEjMhADal0VMzRdv3g5nB3Y7GiBWG0FeJJRh6x7hu+0CWeHvFd5d4r0tlyHHecMw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	40ms 40ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug /06xS7qUu1q54eu5cYTsF4b1oDcMjY2fveKl7Pzvrom6tnlHN/vpuHT7iPWBJOh5G5zEfwnyKS1BJ3JbgRg+hQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	42ms 42ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug HkBC4EdR6NEqZr3wb++3NlxHs1to6y0Sk56Td+9VmBu4CpchKGNP4o3Qkl+mjKC7mv2IBWj2StkhVmiibhssyA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	40ms 40ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug 2hgmzlloF5TWb9VRczUUS5mNoSN1/Gmb7ybGVfDe6hPI+IEk/aq91sW98Maj4AQ/KRoITjsS4T3fE6R/vq46qw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	46ms 46ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug xD76Hcx/a/CzTwTRc5JdlLW83jOxPe0LGBItvNEke7phDRtgczAvrcGqY+BNR3AMKbND0aXGnd1L6EsvMs32rw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	48ms 48ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug 36OVBGQtRFuuGSXP7b3/DKpQFrzVzV4sK83SpRkF2SVORvUPuBZBgpmZ0GZk2m2gDOjOq/TCWAeNox/2J8Q01Q== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	43ms 43ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug Qz+o4GVtysVXh4C6ubqGz4pnbYrHcxvlV+pVY60gTyVvMIx12NAF7dmnKPVYKSpGwG8vCWVwUfSIsQ+PjGQWaQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	45ms 44ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug bQz9L7iGyy6KIcRfJnU01L3Rh0AvK8ojHQoovVeUZce4dx1gpFgFOZsxgC3Jh/21f7NWKXqSYtLgru4Wu+WABQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	46ms 46ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug tJiozaXNM/2FlKm2YURkmYVlygzm7sC9QqSdfihjps5NdD7dJK9gwDdAhRdrdBPne24zOCzkL5gtZUY07DMeRQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	38ms 38ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug pD52gXpx8LBcAwmxpsNCgH102Bnn4D5fHRZJuqux7L9B/qMQ1hkaYkQQhRFxYXczbA4p8WCQcL9sZQ1xLozh+A== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	43ms 43ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug nXXEkJ1p3zEIcfttRc9LU/+WIBx3wo1RSSWy2c8HeCcTNNZ4uHdFlOyax6RzX72GPGTxBqA+YnTmU+BRhapWag== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	38ms 38ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug aruhM5k2Hgt/mOnl9iG/n+yeWCT77S8EjgwzxR+WIBg6CIBhI0CAygbluR4rn9yQ2VveDx5CrHiF+bCVfFQXBg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	44ms 44ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug VDNtOGUit7qJlP53QS8uVbgTV4FaYytNjs1QKpDOUvi5v6b7zze7OnxehVUtVqT0AaXJ0ZOZCurmgoJ6RrahNA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	39ms 39ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug /OC6PeDCBBF5A4ATPK76hnDF9q1M5tHhYcdFCYHG76zAYQ5ZFWk6q/0sscqQLCKlYG912HyaH5fcKBlyeqO8Ig== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	45ms 45ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug qHjMpj5cnPrcFmVRgh5cJ6eea+4Q+4tYkm7AWMD04mUDFrD6+X46iBRp7OQ5MkXf4PraYUimnLjWXrco5Erv8A== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	43ms 43ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug 5JUHk7ubcDLuF4/54C8SnwR/zlDylJGlMZD3Buj2vjyUByeHvlQ3eZyOhxG3pbQzZo833QDJaub+onNKVBsRQA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	43ms 42ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug uhXkhlP0fRC6t9XKxawBXNAIXxLmcfX/6zk6UMKICPwdze8ujgj5BP2yX421jNGV7QyoWjsZ4dlafczINxB/jw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
POST H3	200	/ www.facebook.com/csp/reporting/ Frame 325B	0 30 B	49ms 49ms	Other text/html	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/csp/reporting/?minimize=0 Requested by Host: lifars.com URL: https://lifars.com/2021/12/quick-look-at-new-trickbot-affiliates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 0 x-xss-protection 0 pragma no-cache x-fb-debug npaZMGI/cSOEBrJyDcaOcgL1f08nbkwwT8/XcDZEe0lQbaLzfIG1+ic/gsfoDqK+Cqd6W17Objp4VB0Z7qSDrA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" expires Sat, 01 Jan 2000 00:00:00 GMT cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload access-control-allow-methods OPTIONS content-type text/html; charset="utf-8" access-control-allow-origin https://www.facebook.com vary Origin cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true x-fb-rlafr 0 priority u=3,i access-control-expose-headers X-FB-Debug, X-Loader-Length
GET H2	200	zSKZHMh8mXU.png static.xx.fbcdn.net/rsrc.php/v3/yr/r/ Frame 325B	388 B 843 B	7ms 7ms	Image image/png	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/v3/yr/r/zSKZHMh8mXU.png Requested by Host: www.facebook.com URL: https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f9a1a0ac26eaf5b7f6cc7223b5dd4b5f545b5a48fb598c7442e5f76384f1be8c Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.facebook.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:42 GMT x-content-type-options nosniff content-md5 mLIKfuTnwd0c8uA9BXg4cQ== document-policy force-load-at-top content-security-policy-report-only default-src fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'unsafe-inline' 'unsafe-eval';report-uri https://www.xx.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 388 x-fb-rlafr 0 x-fb-debug K7Mfs+hJn/ggyvT/Xk53yZRqfLdIpX/kX5DsewVKq6iRY1CIreO7Kla+FNnBGjMq0RxEH5Lq6Fz7pAFBJ+bVbQ== x-fb-trip-id 917726464 last-modified Mon, 01 Jan 2001 08:00:00 GMT content-type image/png access-control-allow-origin * cache-control public,max-age=31536000,immutable timing-allow-origin * priority u=3,i expires Thu, 01 Dec 2022 03:54:29 GMT
GET H2	200	yGv34OUcS9K.js Show response static.xx.fbcdn.net/rsrc.php/v3iEpO4/ys/l/en_US/ Frame 325B	515 KB 136 KB	8ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/ys/l/en_US/yGv34OUcS9K.js?_nc_x=Ij3Wp8lg5Kz Requested by Host: www.facebook.com URL: https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash c7acc3697272d0897268ade116fbcf39ed8d4d9a8be891d78d099bb5a8184a2d Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.facebook.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:42 GMT content-encoding br x-content-type-options nosniff content-md5 2Z7dKOMbUKs/Nc1zQR4eYA== document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net cx.atdmt.com www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com ad.atdmt.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0; cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 138067 x-fb-rlafr 0 x-fb-debug TWUwdnRGmJ2lrvvK6B5aqgC5kAdcRI8BeTPWCNUSenA50GNscLBecEXgZLQcpJlnpCGxkS58j2ulIJ44DV8EGw== x-fb-trip-id 917726464 last-modified Mon, 01 Jan 2001 08:00:00 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable timing-allow-origin * expires Wed, 14 Dec 2022 02:09:29 GMT
GET H2	200	/ log.pinterest.com/	0 299 B	98ms 97ms	Image text/plain	151.101.192.84 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://log.pinterest.com/?type=pidget&guid=ESspypQNQqU5&tv=2021110201&event=init&sub=www&button_count=2&follow_count=0&pin_count=0&button_hover=1&profile_count=0&board_count=0&section_count=0&lang=en&nvl=en-US&via=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&viaSrc=canonical Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.192.84 , United States, ASN54113 (FASTLY, US), Reverse DNS Software envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:42 GMT via 1.1 varnish x-cache MISS x-envoy-upstream-service-time 0 x-cache-hits 0 content-length 0 x-served-by cache-hhn4058-HHN pragma no-cache server envoy x-timer S1639480303.534896,VS0,VE90 access-control-max-age 86400 access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache,no-store,must-revalidate,max-age=0 x-pinterest-rid 1453238688268518 accept-ranges bytes expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	cavalry_endpoint.php www.facebook.com/common/ Frame 325B	67 B 99 B	36ms 35ms	Image image/png	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/common/cavalry_endpoint.php?t_cstart=1639480302520&t_start=1639480302520&t_domcontent=1639480302527&t_layout=1639480302567&t_onload=1639480302567&t_paint=1639480302567&t_creport=1639480302567&t_tti=1639480302527&lid=7041514280642270130-0 Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df266d8642bfdf3c%26domain%3Dlifars.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flifars.com%252Ff216627e80adf3c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&layout=button_count&locale=en_US&sdk=joey User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding br x-content-type-options nosniff document-policy force-load-at-top content-security-policy-report-only default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 x-xss-protection 0 pragma no-cache x-fb-debug MacmeA0fcHj8w6gtfmNmg+qhlvq+r+DjuqURkNmGG7bznHCU/oKGnrmTBK3bXkR8GtOQoXR7l5tV0Ec4R9rLhA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 14 Dec 2021 11:11:42 GMT strict-transport-security max-age=15552000; preload report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type image/png vary Accept-Encoding cache-control private, no-store, no-cache, must-revalidate x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	e.gif new-collect.albacross.com/	37 B 103 B	100ms 31ms	Image image/gif	52.215.131.87 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://new-collect.albacross.com/e.gif?s=WordPress-Plugin%2C1.3.1&s=JSCollector%2C3.1.1&e0=pageview&ci0=6ce87d2b-5d2e-2d9e-d93d-0c9bd68ad6a5&v0=3d4efebb-702f-a547-ffe8-ef0b34b1b06b&p0=42bbb2ea-59fc-451e-fbbf-f568d9fb7ea0&u0=42bbb2ea-59fc-451e-fbbf-f568d9fb7ea0&c0=89235105&t0=1639480301110&ur0=https%3A%2F%2Flifars.com%2F2021%2F12%2Fquick-look-at-new-trickbot-affiliates%2F&ti0=Quick%20Look%20at%20New%20TrickBot%20Affiliates&re0=1600&re0=1200&o0=landscape-primary&e1=pageview_ping&ci1=6ce87d2b-5d2e-2d9e-d93d-0c9bd68ad6a5&v1=3d4efebb-702f-a547-ffe8-ef0b34b1b06b&p1=42bbb2ea-59fc-451e-fbbf-f568d9fb7ea0&u1=55a9a7a4-2155-e747-c29d-4df5d8cf2f1a&c1=89235105&t1=1639480301112&li1=1639480301108&e2=pageview_ping&ci2=6ce87d2b-5d2e-2d9e-d93d-0c9bd68ad6a5&v2=3d4efebb-702f-a547-ffe8-ef0b34b1b06b&p2=42bbb2ea-59fc-451e-fbbf-f568d9fb7ea0&u2=65582928-dc2b-a1fc-1c75-2b2765d417ec&c2=89235105&t2=1639480301113&li2=1639480301108 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.215.131.87 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-215-131-87.eu-west-1.compute.amazonaws.com Software / Resource Hash 49059d42ad3423fb9f04b2330cdce035e4d555aa9ea7a7ceae097de0c69be05d Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:44 GMT content-length 37 content-type image/gif
GET H2	200	e.gif new-collect.albacross.com/	37 B 102 B	33ms 33ms	Image image/gif	52.215.131.87 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://new-collect.albacross.com/e.gif?s=WordPress-Plugin%2C1.3.1&s=JSCollector%2C3.1.1&e0=pageview_ping&ci0=6ce87d2b-5d2e-2d9e-d93d-0c9bd68ad6a5&v0=3d4efebb-702f-a547-ffe8-ef0b34b1b06b&p0=42bbb2ea-59fc-451e-fbbf-f568d9fb7ea0&u0=b80ea024-7fb4-1660-17e9-9e87109bddff&c0=89235105&t0=1639480305613&li0=1639480301108 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.215.131.87 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-215-131-87.eu-west-1.compute.amazonaws.com Software / Resource Hash 49059d42ad3423fb9f04b2330cdce035e4d555aa9ea7a7ceae097de0c69be05d Request headers Accept-Language de-DE,de;q=0.9 Referer https://lifars.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 11:11:47 GMT content-length 37 content-type image/gif