threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://threatpost.com/microsoft-onenote-sidestep-phishing-detection
Effective URL:
https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Submission: On May 15 via manual (May 15th 2020, 11:14:33 am UTC) from US

Summary HTTP 244 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 54 IPs in 8 countries across 40 domains to perform 244 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by Thawte EV RSA CA 2018 on June 17th 2019. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 19	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
11	52.222.182.71 52.222.182.71	16509 (AMAZON-02) (AMAZON-02)
5	2606:4700:303... 2606:4700:3035::6812:2130	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
8	2600:9000:201... 2600:9000:2016:3c00:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
13	2600:9000:201... 2600:9000:2016:a800:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
3 9	2a00:1450:400... 2a00:1450:4001:81e::2004	15169 (GOOGLE) (GOOGLE)
21	194.146.38.23 194.146.38.23	41436 (CLOUDWEBM...) (CLOUDWEBMANAGE-EU)
7	216.58.212.130 216.58.212.130	15169 (GOOGLE) (GOOGLE)
19	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
4	69.173.144.141 69.173.144.141	26667 (RUBICONPR...) (RUBICONPROJECT)
4	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3	72.247.225.98 72.247.225.98	16625 (AKAMAI-AS) (AKAMAI-AS)
4	185.33.221.88 185.33.221.88	29990 (ASN-APPNEX) (ASN-APPNEX)
7 11	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
1 2	167.172.1.14 167.172.1.14	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	216.52.2.30 216.52.2.30	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
1 6	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE)
2 3	2a00:1450:400... 2a00:1450:4001:819::200e	15169 (GOOGLE) (GOOGLE)
1	91.228.74.217 91.228.74.217	27281 (QUANTCAST) (QUANTCAST)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
2 2	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	2600:9000:209... 2600:9000:2093:4000:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	52.222.191.80 52.222.191.80	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE)
4	72.247.225.32 72.247.225.32	16625 (AKAMAI-AS) (AKAMAI-AS)
20	185.167.98.14 185.167.98.14	41436 (CLOUDWEBM...) (CLOUDWEBMANAGE-EU)
1 2	52.59.163.227 52.59.163.227	16509 (AMAZON-02) (AMAZON-02)
1 1	148.251.129.84 148.251.129.84	24940 (HETZNER-AS) (HETZNER-AS)
3	18.184.66.147 18.184.66.147	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
2	35.157.88.129 35.157.88.129	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2a05:f500:11:... 2a05:f500:11:101::b93f:9001	14413 (LINKEDIN) (LINKEDIN)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
3	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
1 2	91.228.74.148 91.228.74.148	27281 (QUANTCAST) (QUANTCAST)
1	2a00:1450:400... 2a00:1450:4001:821::2001	15169 (GOOGLE) (GOOGLE)
17	2a00:1450:400... 2a00:1450:4001:81a::2001	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
2	72.247.225.17 72.247.225.17	16625 (AKAMAI-AS) (AKAMAI-AS)
2	104.111.230.142 104.111.230.142	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	52.51.104.248 52.51.104.248	16509 (AMAZON-02) (AMAZON-02)
5 6	52.58.138.174 52.58.138.174	16509 (AMAZON-02) (AMAZON-02)
1 1	172.217.23.162 172.217.23.162	15169 (GOOGLE) (GOOGLE)
1 4	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
1 1	52.203.99.84 52.203.99.84	14618 (AMAZON-AES) (AMAZON-AES)
1	35.168.89.112 35.168.89.112	14618 (AMAZON-AES) (AMAZON-AES)
1 2	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
3	52.222.190.73 52.222.190.73	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:825::2002	15169 (GOOGLE) (GOOGLE)
1	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a02:fa8:8806... 2a02:fa8:8806:16::1400	41041 (VCLK-EU-) (VCLK-EU-)
244	54

19 35.173.160.135 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 52.222.182.71 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-182-71.ham50.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3035::6812:2130 (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2016:3c00:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2600:9000:2016:a800:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:81e::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 194.146.38.23 (None, )

ASN41436 (CLOUDWEBMANAGE-EU, GB)

live.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 216.58.212.130 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f130.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.141 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 72.247.225.98 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-98.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.33.221.88 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 7 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 167.172.1.14 (United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.52.2.30 (United States)

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.95.120.147 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 147.120.95.34.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:819::200e (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.217 (United Kingdom)

ASN27281 (QUANTCAST, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9b (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2093:4000:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.222.191.80 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-191-80.ham50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 72.247.225.32 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-32.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 185.167.98.14 (Amsterdam, Netherlands)

ASN41436 (CLOUDWEBMANAGE-EU, GB)

video.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.59.163.227 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-163-227.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 148.251.129.84 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.84.129.251.148.clients.your-server.de

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.184.66.147 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-66-147.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.157.88.129 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-88-129.eu-central-1.compute.amazonaws.com

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:11:101::b93f:9001 (Ireland)

ASN14413 (LINKEDIN, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (Manchester, United Kingdom)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.228.74.148 (United Kingdom) 1 redirects

ASN27281 (QUANTCAST, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

a4f79a64d2fc9be411e8260fcd860c78.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:81a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.247.225.17 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-17.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.230.142 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.51.104.248 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-104-248.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.58.138.174 (Frankfurt am Main, Germany) 5 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-138-174.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.162 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s22-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.156.0.31 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.203.99.84 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-99-84.compute-1.amazonaws.com

sync.adap.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.168.89.112 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-89-112.compute-1.amazonaws.com

sync.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:110:c305::8000 (United Kingdom) 1 redirects

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.222.190.73 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-190-73.ham50.r.cloudfront.net

math-aids-threatpost-tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:16::1400 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	sekindo.com live.sekindo.com video.sekindo.com	3 MB
39	threatpost.com 1 redirects threatpost.com assets.threatpost.com media.threatpost.com	1 MB
32	googlesyndication.com a4f79a64d2fc9be411e8260fcd860c78.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	369 KB
21	advertising.com 12 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com sync.adaptv.advertising.com	9 KB
14	doubleclick.net 3 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net	104 KB
14	adlightning.com tagan.adlightning.com math-aids-threatpost-tagan.adlightning.com	284 KB
11	google.com 3 redirects www.google.com adservice.google.com	2 KB
10	ampproject.org cdn.ampproject.org	314 KB
8	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	292 B
8	rubiconproject.com fastlane.rubiconproject.com prebid-server.rubiconproject.com eus.rubiconproject.com	8 KB
6	yahoo.com 2 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	5 KB
6	openx.net 1 redirects teachingaids-d.openx.net u.openx.net eu-u.openx.net	1 KB
6	adnxs.com ib.adnxs.com acdn.adnxs.com	3 KB
6	googletagservices.com www.googletagservices.com	152 KB
5	gstatic.com www.gstatic.com fonts.gstatic.com	276 KB
5	google.de adservice.google.de www.google.de	723 B
5	admetricspro.com qd.admetricspro.com	163 KB
4	googleapis.com fonts.googleapis.com	3 KB
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com	9 KB
3	google-analytics.com 2 redirects www.google-analytics.com	18 KB
3	casalemedia.com as-sec.casalemedia.com	3 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	594 B
2	bidswitch.net 1 redirects x.bidswitch.net	917 B
2	amazon-adsystem.com c.amazon-adsystem.com	29 KB
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	748 B
1	dotomi.com aol-match.dotomi.com	104 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	adap.tv 1 redirects sync.adap.tv	221 B
1	reddit.com www.reddit.com	3 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	483 B
1	twitter.com analytics.twitter.com	651 B
1	loopme.me 1 redirects csync.loopme.me	225 B
1	quantcount.com rules.quantcount.com	357 B
1	t.co t.co	448 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	googletagmanager.com www.googletagmanager.com	38 KB
1	lijit.com ap.lijit.com	702 B
1	kasperskycontenthub.com kasperskycontenthub.com	399 B
244	40

	Domain	Requested by
21	live.sekindo.com	threatpost.com live.sekindo.com
20	video.sekindo.com	threatpost.com live.sekindo.com
18	threatpost.com	1 redirects threatpost.com securepubads.g.doubleclick.net
17	tpc.googlesyndication.com	tagan.adlightning.com threatpost.com cdn.ampproject.org
14	pagead2.googlesyndication.com	tagan.adlightning.com threatpost.com pagead2.googlesyndication.com securepubads.g.doubleclick.net
13	media.threatpost.com	threatpost.com
11	adserver-us.adtech.advertising.com	7 redirects threatpost.com qd.admetricspro.com
11	tagan.adlightning.com	threatpost.com tagan.adlightning.com
10	cdn.ampproject.org	securepubads.g.doubleclick.net threatpost.com
9	www.google.com	3 redirects threatpost.com tagan.adlightning.com
8	assets.threatpost.com	threatpost.com
7	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
6	pixel.advertising.com	5 redirects threatpost.com
6	www.googletagservices.com	threatpost.com tagan.adlightning.com securepubads.g.doubleclick.net
5	qd.admetricspro.com	threatpost.com
4	googleads.g.doubleclick.net	tagan.adlightning.com threatpost.com
4	ups.analytics.yahoo.com	1 redirects threatpost.com
4	ads.pubmatic.com	live.sekindo.com qd.admetricspro.com
4	fonts.googleapis.com	live.sekindo.com threatpost.com
4	ib.adnxs.com	qd.admetricspro.com live.sekindo.com
4	hbopenbid.pubmatic.com	qd.admetricspro.com live.sekindo.com
4	fastlane.rubiconproject.com	qd.admetricspro.com
3	math-aids-threatpost-tagan.adlightning.com	tagan.adlightning.com
3	match.adsrvr.org	2 redirects
3	fonts.gstatic.com	threatpost.com
3	ads.adaptv.advertising.com	live.sekindo.com
3	www.google-analytics.com	2 redirects www.googletagmanager.com
3	teachingaids-d.openx.net	qd.admetricspro.com live.sekindo.com
3	as-sec.casalemedia.com	qd.admetricspro.com live.sekindo.com
3	adservice.google.de	tagan.adlightning.com
2	adservice.google.com	tagan.adlightning.com
2	pr-bh.ybp.yahoo.com	1 redirects threatpost.com
2	sync-tm.everesttech.net	2 redirects
2	eus.rubiconproject.com	live.sekindo.com qd.admetricspro.com
2	acdn.adnxs.com	live.sekindo.com qd.admetricspro.com
2	u.openx.net	1 redirects live.sekindo.com
2	pixel.quantserve.com	1 redirects threatpost.com
2	prebid-server.rubiconproject.com	live.sekindo.com
2	x.bidswitch.net	1 redirects threatpost.com
2	c.amazon-adsystem.com	live.sekindo.com c.amazon-adsystem.com
2	www.google.de	threatpost.com
2	stats.g.doubleclick.net	2 redirects
2	www.gstatic.com	www.google.com
1	aol-match.dotomi.com
1	eu-u.openx.net	qd.admetricspro.com
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	sync.adaptv.advertising.com	threatpost.com
1	sync.adap.tv	1 redirects
1	cm.g.doubleclick.net	1 redirects
1	a4f79a64d2fc9be411e8260fcd860c78.safeframe.googlesyndication.com	tagan.adlightning.com
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	analytics.twitter.com	tagan.adlightning.com
1	csync.loopme.me	1 redirects
1	rules.quantcount.com	secure.quantserve.com
1	t.co	threatpost.com
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	www.googletagmanager.com	threatpost.com
1	ap.lijit.com	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	kasperskycontenthub.com	threatpost.com
244	64

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feedly.com
www.instagram.com
cofense.com
media.threatpost.com
www.avanan.com
www.bleepingcomputer.com
attendee.gotowebinar.com
akismet.com
t.co
indd.adobe.com
spotlight.threatpost.com

Subject Issuer	Validity	Valid
threatpost.com Thawte EV RSA CA 2018	`2019-06-17` - `2020-06-17`	a year	crt.sh
*.adlightning.com Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-04` - `2020-10-09`	8 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
kasperskycontenthub.com Thawte RSA CA 2018	`2019-06-14` - `2020-06-13`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-04-28` - `2020-07-21`	3 months	crt.sh
www.sekindo.com Go Daddy Secure Certificate Authority - G2	`2019-05-23` - `2020-06-18`	a year	crt.sh
*.google.de GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-03-24` - `2020-06-22`	3 months	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2018-01-04` - `2020-07-09`	3 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-04-28` - `2020-07-21`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2019-10-04` - `2020-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-04-28` - `2020-07-21`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2019-10-07` - `2020-09-29`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-04-28` - `2020-07-21`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-08-28`	6 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-04-15` - `2020-07-14`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-03-09` - `2020-09-09`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-04-06` - `2020-10-03`	6 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-04-28` - `2020-07-21`	3 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2020-01-02` - `2021-04-02`	a year	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2017-06-14` - `2020-06-18`	3 years	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-02-13` - `2020-08-11`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-01-04` - `2020-07-02`	6 months	crt.sh
*.google.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh

This page contains 29 frames:

Primary Page: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Frame ID: 5297DFEBB1162A586AD9A8FF3572B696
Requests: 98 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1589541251&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Frame ID: 99C2CEA6393451ED77781DCC91DC0AA6
Requests: 43 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: 9FF7720C6E1CB880D0DEDEC05C733A2F
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: BED3258E2D8FA7132F2E363C529224D5
Requests: 18 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Frame ID: 5C8EBD934E4EE03D004440C49A3111D4
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&theme=standard&size=normal&cb=ki2su0pu1l0i
Frame ID: 6D4B877E6CFF41003125E231462DB963
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&theme=light&size=normal&cb=hg74c2kmyo97
Frame ID: A2FB6AC05463E8C5A2D18CE5F6223011
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=k47rlvoj9v4c
Frame ID: 7A2B2FFD0AEFE0CC34CCA2B905FD6C78
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=pg6uue2rbgj0
Frame ID: 282F764E12DB2D4F968527A1871A9F5D
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-2a28c82-ab6585a5.js
Frame ID: 195FD2B15C8E2609FDD768BFDF097A35
Requests: 25 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-2a28c82-ab6585a5.js
Frame ID: D56D83115DCF5B2E3406C921B86EB7FB
Requests: 14 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-2a28c82-ab6585a5.js
Frame ID: AAC548ABCA03E87D49E7D9775ACAC4D8
Requests: 16 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-2a28c82-ab6585a5.js
Frame ID: 4DE10D197FD68257F75AD8C866465DDE
Requests: 10 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Frame ID: 3DA7CA50903D469763C24D91E272A04D
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 4091A6EAC2C2C571F3D07CF1CB73A54D
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: CACE896B02264DE2464B3C71F18746D6
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Frame ID: 636CD5051DBB70AEADE131BD76D2A63D
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 6591C49DD602718507FC7630132AA368
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200511/r20190131/zrt_lookup.html
Frame ID: 195A656CCE99F8B943D83F1413B5D73F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186313&w=336&psa=0&guci=1.2.0.0.2.2.0.0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1589541253810&bpp=51&bdt=536&idt=550&shv=r20200511&cbv=r20190131&ptt=9&saldr=aa&correlator=6579499086307&frm=23&ife=4&pv=2&ga_vid=210511827.1589541254&ga_sid=1589541254&ga_hid=2033927661&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1057&ady=417&biw=1585&bih=1200&isw=336&ish=280&ifk=4091218536&scr_x=0&scr_y=0&eid=21066085%2C44718965&oid=3&pvsid=465538954321845&pem=952&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.k83hq1vo9kmp&fsb=1&dtd=574
Frame ID: CF62B65B17DF0A1CDA53AF2C100B3FAE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186312&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1589541253885&bpp=2&bdt=602&idt=515&shv=r20200511&cbv=r20190131&ptt=9&saldr=aa&correlator=6579499086307&frm=23&ife=4&pv=1&ga_vid=984826920.1589541254&ga_sid=1589541254&ga_hid=255358665&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1075&ady=1753&biw=1585&bih=1200&isw=300&ish=600&ifk=2889418091&scr_x=0&scr_y=0&eid=21066085%2C44718965&oid=3&pvsid=1861385180437502&pem=952&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.f04zrv61m7tk&btvi=1&fsb=1&dtd=573
Frame ID: 3D3570491940670D54A0830D1DE8FB21
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: BC57BB3865C6ABB4D9E71C97D908332A
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 34BEC8E5176E28C55E4D1E17B66364C0
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 09C69008E092FCE06A7A40398CCECF60
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 24EC5C030A6577A745C6709B5D908B39
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 5753B67DB1FD83B9649FE60424331E5A
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: E14A53AB7CDD4CCED337CCCEA9F49F2A
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 1FAD50B11DEB8DC041651B83FDE44532
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
Frame ID: B4041962EE372316C7D6E19803D0D819
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://threatpost.com/microsoft-onenote-sidestep-phishing-detection HTTP 301
https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /\/prebid\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

244
Requests

99 %
HTTPS

40 %
IPv6

40
Domains

64
Subdomains

54
IPs

8
Countries

6552 kB
Transfer

11048 kB
Size

10
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatpost/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/threatpost

Search URL Search Domain Scan URL

URL: https://feedly.com/threatpost

Search URL Search Domain Scan URL

URL: https://www.instagram.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://cofense.com/threat-actor-uses-onenote-learn-credential-phishing-evade-microsoft-fireeye-detection/
Title: in a Tuesday analysis

Search URL Search Domain Scan URL

URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/04115915/Figure-1-1200x961.jpg

Search URL Search Domain Scan URL

URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/04115938/Figure-4-1200x675.jpg

Search URL Search Domain Scan URL

URL: https://www.avanan.com/blog/microsoft-sway-phishing
Title: Microsoft Sway

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/zoho-heavily-used-by-keyloggers-to-transmit-stolen-data/
Title: Zoho Docs

Search URL Search Domain Scan URL

URL: https://attendee.gotowebinar.com/register/3191336203359293954?source=art
Title: “5G, the Olympics and Next-Gen Security Challenges,”

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23Microsoft
Title: #Microsoft

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23Windows
Title: #Windows

Search URL Search Domain Scan URL

URL: https://t.co/LsBe503O7L
Title: https://t.co/LsBe503O7L

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost
Title: Follow @threatpost

Search URL Search Domain Scan URL

URL: https://indd.adobe.com/view/01579c19-a6ca-4cb0-8106-ed4d5d02a292
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://spotlight.threatpost.com/
Title: HackerOne Spotlight

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://threatpost.com/microsoft-onenote-sidestep-phishing-detection HTTP 301
https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 44

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=451d0d2d30cd64a;misc=1589541251386; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=451d0d2d30cd64a;misc=1589541251386 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A34183e8c-969d-11ea-9985-12dcd5311714;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=451d0d2d30cd64a;misc=1589541251386

Request Chain 45

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=46bfe8044568b6b;misc=1589541251386; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=46bfe8044568b6b;misc=1589541251386 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A3418aca0-969d-11ea-8e0b-124a081e334a;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=46bfe8044568b6b;misc=1589541251386

Request Chain 46

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=47686ddb9511477;misc=1589541251386; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=47686ddb9511477;misc=1589541251386 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A34183342-969d-11ea-8db2-123c39a1c2a0;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=47686ddb9511477;misc=1589541251386

Request Chain 47

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=480dcbb5b49c037;misc=1589541251386; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=480dcbb5b49c037;misc=1589541251386

Request Chain 77

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=617734723&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ul=en-us&de=UTF-8&dt=Microsoft%20OneNote%20Used%20To%20Sidestep%20Phishing%20Detection%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAEAB~&jid=441707615&gjid=1799385515&cid=440715696.1589541252&tid=UA-35676203-21&_gid=524900900.1589541252&_r=1&gtm=2wg561PM29HLF&z=1952921706 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=440715696.1589541252&jid=441707615&_gid=524900900.1589541252&gjid=1799385515&_v=j82&z=1952921706 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=441707615&_v=j82&z=1952921706 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=441707615&_v=j82&z=1952921706&slf_rd=1&random=1693348974

Request Chain 95

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5ebe798390995&custom_data=5ebe798390995&gdpr=1&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5ebe798390995&custom_data=5ebe798390995&gdpr=1&gdpr_consent=

Request Chain 96

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D HTTP 307
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=d2496298-3687-4a1b-8a77-f2052a980a8b

Request Chain 148

https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent= HTTP 302
https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=

Request Chain 153

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=2ad09b6a-0713-4b00-8b5e-169bb78abc89&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2ad09b6a-0713-4b00-8b5e-169bb78abc89

Request Chain 154

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEAoWKnKwhY9WTCgnUpuFwTI&google_cver=1 HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEAoWKnKwhY9WTCgnUpuFwTI&google_cver=1&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEAoWKnKwhY9WTCgnUpuFwTI&google_cver=1&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e

Request Chain 155

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=Xr55iAAAAGTkmiTo HTTP 302
https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=Xr55iAAAAGTkmiTo&_test=Xr55iAAAAGTkmiTo HTTP 302
https://sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=Xr55iAAAAGTkmiTo&_test=Xr55iAAAAGTkmiTo

Request Chain 191

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 209

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=617734723&t=timing&_s=2&dl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ul=en-us&de=UTF-8&dt=Microsoft%20OneNote%20Used%20To%20Sidestep%20Phishing%20Detection%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&plt=5721&pdt=1&dns=0&rrt=566&srt=288&tcp=306&dit=2819&clt=2819&_gst=2306&_gbt=2353&_cst=2076&_cbt=2246&_u=YEBAAEAB~&jid=2098670199&gjid=1253405002&cid=440715696.1589541252&tid=UA-35676203-21&_gid=524900900.1589541252&_r=1&gtm=2wg561PM29HLF&z=1225844530 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=440715696.1589541252&jid=2098670199&_gid=524900900.1589541252&gjid=1253405002&_v=j82&z=1225844530 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=2098670199&_v=j82&z=1225844530 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=2098670199&_v=j82&z=1225844530&slf_rd=1&random=2832635875

Request Chain 224

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 227

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=rgyXbaxQzTy2DcM5q17YPfhQzT62DME6qlEWAaVC HTTP 302
https://ups.analytics.yahoo.com/ups/55965/sync?_origin=0&gdpr=1&uid=rgyXbaxQzTy2DcM5q17YPfhQzT62DME6qlEWAaVC&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e

Request Chain 228

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent= HTTP 302
https://ups.analytics.yahoo.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e HTTP 302
https://pr-bh.ybp.yahoo.com/sync/adtech/UP358f7f5f-969d-11ea-81ce-068dfa39526e?gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/56465/sync?uid=y-eHsfAwN1lxmtLrJYoOcaN_fnAab6W8kXfRNZ&_origin=0&nsync=0 HTTP 302
https://ups.analytics.yahoo.com/ups/56465/sync?uid=y-eHsfAwN1lxmtLrJYoOcaN_fnAab6W8kXfRNZ&_origin=0&nsync=0&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e

244 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Redirect Chain

https://threatpost.com/microsoft-onenote-sidestep-phishing-detection
https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

79 KB
21 KB

595ms
288ms

Document
text/html

35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

2207ba5c4e1793b6e26ebed40e96b48b30afde83eb5404d7146812757dcbc08b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Fri, 15 May 2020 11:14:10 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/?p=153436>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: HIT
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Fri, 15 May 2020 11:14:09 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Redirect-By: WordPress
Location: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: MISS

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 236 KB
36 KB 385ms
187ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 7d9944f6f4e2d0330ca2a9d758a404fdca5937f4a0ddf939247ca3505f9f0bbc

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:10 GMT
Content-Encoding: gzip
Last-Modified: Thu, 14 May 2020 12:37:01 GMT
Server: nginx
ETag: W/"5ebd3b6d-3b1cb"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 22 May 2020 11:14:10 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 33 KB
12 KB 76ms
25ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8643f469523dab740ec119a6fdb1d67255a80cd782567f32e8c06b3abc1da2ad

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: rk6DfqRXY8_DhSn69BoaGzYncrtEItlm
content-encoding: gzip
etag: "bcab8c33ebd92acaabc9f0bbc3bc9e32"
age: 26
x-cache: Hit from cloudfront
status: 200
content-length: 12094
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 13 May 2020 16:00:13 GMT
server: AmazonS3
date: Fri, 15 May 2020 11:13:45 GMT
content-type: application/javascript
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: KXipD09dT8-5hHXtzEj2xcYvWq8GpopMeKK8_8nKppuL3Jt0SNvgIA==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 18 KB
2 KB 568ms
538ms Script
application/javascript 2606:4700:3035::6812:2130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e00db38c7c200422a1b2604eccaee91db1aa7dd5aead5383f62b85cead19068

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 23 Mar 2020 17:20:59 GMT
server: cloudflare
status: 200
etag: W/"4871-5a188dbd16705-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 593c6f0ff9a01782-FRA
cf-request-id: 02b9a3bdfc000017829fb91200000001
expires: Fri, 15 May 2020 11:16:29 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 44 KB
15 KB 17ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44cacbceeb3043b0b7b243b9fdf224cd4bee93426f05c6b9129120a29fac9ad7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "516 / 193 of 1000 / last-modified: 1589472883"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 14885
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:10 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 218 KB
61 KB 564ms
534ms Script
application/javascript 2606:4700:3035::6812:2130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aaf45a172ec90c76bcecd61c68d998c2256fe9b1700371e80011d1161c5ab629

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 27 Sep 2019 21:07:46 GMT
server: cloudflare
status: 200
etag: W/"367ba-5938f47194c80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 593c6f0ff9a11782-FRA
cf-request-id: 02b9a3bdfc000017829fb92200000001
expires: Fri, 15 May 2020 11:16:10 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
283 B 561ms
531ms Script
application/javascript 2606:4700:3035::6812:2130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
status: 200
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 593c6f0ff9a21782-FRA
cf-request-id: 02b9a3bdfc000017829fb93200000001
expires: Fri, 15 May 2020 11:16:10 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 294 KB
87 KB 181ms
151ms Script
application/javascript 2606:4700:3035::6812:2130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f40f7297122393e1425eec62e78a75c3211f7ad3f6b09a356aa317fcedc2cf3

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:10 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 26 Feb 2020 03:30:32 GMT
server: cloudflare
status: 200
etag: W/"49929-59f723a0fd39e-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 593c6f0ff9a41782-FRA
cf-request-id: 02b9a3bdfc000017829fb94200000001
expires: Fri, 15 May 2020 11:17:19 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 16 KB
12 KB 567ms
537ms Script
application/javascript 2606:4700:3035::6812:2130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcf391dd0b006a87698ac0894d71039d610480913d24fcdaa1f2fdeeeda943e3

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 24 Nov 2019 00:06:08 GMT
server: cloudflare
status: 200
etag: W/"41f6-5980c69fe949d-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 593c6f0ff9a61782-FRA
cf-request-id: 02b9a3bdfc000017829fb95200000001
expires: Fri, 15 May 2020 11:16:10 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 77 KB
17 KB 689ms
640ms Stylesheet
text/css 2600:9000:2016:3c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=569a1c93

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:2016:3c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a9ccdefe0a821df80b8292afc4991c8f61a16a5d1b6507bc0409a50d7cd805d1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C2
x-cache: Miss from cloudfront
status: 200
content-length: 16546
x-cache-hit: HIT
last-modified: Thu, 14 May 2020 12:37:00 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: 0j5YpgLuUBZn917vDx076X2EhdLvh8beVNVbo7WmbyuvW3VbX0Pjwg==
expires: Fri, 15 May 2020 15:57:27 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 424ms
207ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 18 Dec 2019 22:32:15 GMT
Server: nginx
ETag: W/"5dfaa8ef-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 22 May 2020 11:14:10 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 175 KB
55 KB 515ms
466ms Script
application/x-javascript 2600:9000:2016:3c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=569a1c93

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:2016:3c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3dbd06bf1d690a4c0fcbfcd77c26a032558b9f9698bb7261191bfb19656bf8ca

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:10 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C2
x-cache: Miss from cloudfront
status: 200
content-length: 55954
x-cache-hit: HIT
last-modified: Thu, 14 May 2020 12:36:58 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: 5LjeuYmUZwhIKTpqcy3AArW7-AoNZ6H96ARFP3g0u1YJjKgpnnNu7Q==
expires: Fri, 15 May 2020 15:57:27 GMT

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
399 B 852ms
200ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=1212862076&back=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:11 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/javascript
x-cache-hit: MISS
Transfer-Encoding: chunked
X-Debug-Auth: off
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 OneNote.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/04120302/ 215 KB
215 KB 122ms
75ms Image
image/jpeg 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/04120302/OneNote.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e00478c25dcd91606b3dc74d065f5c5ebe48756aed82c1f049dded20eb2792fd

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 04 Mar 2020 17:49:16 GMT
via: 1.1 d7524ff4a82155dd51a24800cf39deec.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Wed, 04 Mar 2020 17:03:03 GMT
server: AmazonS3
age: 6197096
etag: "a0bdbc55d336a1b23905e3d4bd691ddf"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, HAM50-C2
accept-ranges: bytes
content-length: 219957
x-amz-cf-id: 2ctHbBUYQD8P5N4NvLqn0bczdDK-BmDB-te5-lmmk0xar2GjExYHaw==
expires: Thu, 04 Mar 2021 17:03:02 GMT

GET
H2 200 0.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/ 10 KB
11 KB 67ms
20ms Image
image/jpeg 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/0.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 17 Feb 2020 07:12:59 GMT
via: 1.1 b16802a1e349d80b7688070778305ae2.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Mon, 20 Aug 2018 15:57:19 GMT
server: AmazonS3
age: 7617673
etag: "756a0525b47f4557fdfec408731afd91"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, HAM50-C2
accept-ranges: bytes
content-length: 10662
x-amz-cf-id: XuiFMjoWe_sNzWlJeGM30Gfnxhr8iu5qTbUIDaVoSDIgGyj7BZgV0g==
expires: Tue, 20 Aug 2019 15:57:18 GMT

GET
H2 200 subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 8 KB
9 KB 62ms
16ms Image
image/jpeg 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 15 Feb 2020 06:22:32 GMT
via: 1.1 7ce1191b390045e05b9cc74f7514b77b.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Tue, 19 Feb 2019 20:14:58 GMT
server: AmazonS3
age: 7793500
etag: "5ba45563f793f39ef6baf02645651654"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, HAM50-C2
accept-ranges: bytes
content-length: 8281
x-amz-cf-id: Cy2XJXDO_57fgDRDSkXIiOyqIeZAjD6n0BOZI7x-XW9bEHrLa7NA6w==
expires: Wed, 19 Feb 2020 20:14:57 GMT

GET
H2 200 Figure-1-1200x961-300x240.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/04115915/ 12 KB
12 KB 122ms
75ms Image
image/jpeg 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/04115915/Figure-1-1200x961-300x240.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 09cc42354773abec2a57f4da338e3a13a8bf0991653838dd2073c7ebed5760c6

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Mar 2020 11:07:01 GMT
via: 1.1 1463b274b31e0310acc7c754b8b5a550.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Wed, 04 Mar 2020 16:59:17 GMT
server: AmazonS3
age: 4925231
etag: "0d601d714aba320aad222373e37b07a2"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA54, HAM50-C2
accept-ranges: bytes
content-length: 12042
x-amz-cf-id: aGS2ucv13GnIq3KT1w9aGkHM7NqZhu_HWcLia1z2_V4Vg4JHz0-mtQ==
expires: Thu, 04 Mar 2021 16:59:15 GMT

GET
H2 200 Figure-4-1200x675-300x169.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/04115938/ 10 KB
10 KB 127ms
81ms Image
image/jpeg 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/04115938/Figure-4-1200x675-300x169.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ffbc14a38fb30ded7cd945dced139f6477d773aa72a7d1b62bc049a2c79cc61a

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 12 Apr 2020 23:28:29 GMT
via: 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Wed, 04 Mar 2020 16:59:40 GMT
server: AmazonS3
age: 2807143
etag: "c1e08204cf74e2da5a2505e3d958defa"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, HAM50-C2
accept-ranges: bytes
content-length: 10249
x-amz-cf-id: B7qvtEYM69BIKhlOPSwm9AtIvqOUXmQ_BYWvDXxHHqqYqmNueiZvCg==
expires: Thu, 04 Mar 2021 16:59:38 GMT

GET
H2 200 Windows-10-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/09093818/ 20 KB
21 KB 75ms
28ms Image
image/jpeg 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/09093818/Windows-10-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 54600f9586e55f43467dcdb8c934157a25743cee119af2c034ffe81c2a1d06e8

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 14 May 2020 15:54:25 GMT
via: 1.1 efed2d5ffeb697060f4a3aa73bdf068f.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Thu, 09 Aug 2018 13:38:21 GMT
server: AmazonS3
age: 69587
etag: "f67e4fca3c703a4d3d31db5042f8d7c1"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA54, HAM50-C2
accept-ranges: bytes
content-length: 20942
x-amz-cf-id: CT0xqQgj6jfWX0_rXVruJIMaZQX7qWYJdTqTaquSro1beWsnS-QoCQ==
expires: Fri, 09 Aug 2019 13:38:18 GMT

GET
H2 200 BEC_700_420-540x270.png
media.threatpost.com/wp-content/uploads/sites/103/2019/12/24125214/ 225 KB
225 KB 32ms
31ms Image
image/png 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/12/24125214/BEC_700_420-540x270.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f6d40a7a41bff3e12e272a17dded9be71b8b5981ad0122221306ffea02926202

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 14 May 2020 12:39:10 GMT
via: 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Tue, 24 Dec 2019 17:52:18 GMT
server: AmazonS3
age: 81302
etag: "ef1e9946beace4a2e39f1e885b1e62b4"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, HAM50-C2
accept-ranges: bytes
content-length: 229944
x-amz-cf-id: huHfZ7e5Uxs1Rzisozi5KZCWbBpOqqxRmfxOvtUVqcxKjNemnHwTZg==
expires: Wed, 23 Dec 2020 17:52:14 GMT

GET
H2 200 magellan-540x270.png
media.threatpost.com/wp-content/uploads/sites/103/2020/05/13110640/ 277 KB
277 KB 63ms
62ms Image
image/png 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/05/13110640/magellan-540x270.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a4692430616d0b20d90ce3f3525ba124c9372e8a564f5d9d963971d3bfef38e1

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 13 May 2020 15:53:24 GMT
via: 1.1 821f1951140ddf83c7de719a44727403.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Wed, 13 May 2020 15:07:00 GMT
server: AmazonS3
age: 156048
etag: "843585be95fe8a94acdac3c6decc6f48"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA54, HAM50-C2
accept-ranges: bytes
content-length: 283292
x-amz-cf-id: bFjkH_nCXK2Em5K4vb4SESAhUPNozWesgGQ8wmuVzHz-BVr_5cD3eQ==
expires: Thu, 13 May 2021 15:06:57 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 674 B
595 B 15ms
14ms Script
text/javascript 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8276117bcc362352b6d3a5f09093ad1955601fbe77fc4f11cb823df7ecdbc8f4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 446
x-xss-protection: 1; mode=block
expires: Fri, 15 May 2020 11:14:11 GMT

GET
H2 200 forcepoint-vpn-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2019/09/20105955/ 2 KB
2 KB 32ms
31ms Image
image/jpeg 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/09/20105955/forcepoint-vpn-64x64.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 22bce61f4ab1cabf0df284f75cf064654e2c82fd992de9b8bd951f3bb43a87ca

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 04 May 2020 16:08:55 GMT
via: 1.1 befe3b8553d90339ecf78e5d7cefa60b.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Fri, 20 Sep 2019 14:59:58 GMT
server: AmazonS3
age: 932717
etag: "f99bca485823b84c6c1ecf501c34469c"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, HAM50-C2
accept-ranges: bytes
content-length: 1822
x-amz-cf-id: IXW2pXBh_0O9FPY45AI2UL30DrXiaCNopGF5MGIsgxRhYzSU_JHhcg==
expires: Sat, 19 Sep 2020 14:59:55 GMT

GET
H2 200 Cloud_Security-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2019/12/30144523/ 10 KB
10 KB 35ms
34ms Image
image/png 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/12/30144523/Cloud_Security-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 25cbfbe95753b2b7cc509e199271f8ab339b45f4c4b28a098e3cc7b40ae644cb

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 19:28:22 GMT
via: 1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Mon, 30 Dec 2019 19:45:26 GMT
server: AmazonS3
age: 1266350
etag: "e0c44979b2a4d9528a72a1630d5e8652"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, HAM50-C2
accept-ranges: bytes
content-length: 10225
x-amz-cf-id: -vjbMAhd-9_Bn-QXe_kSR6HE8BFGnURQIiFt3UW7LGxsZOALFfGFGg==
expires: Tue, 29 Dec 2020 19:45:23 GMT

GET
H2 200 georgia-cyberattack-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2019/10/29085447/ 2 KB
2 KB 55ms
54ms Image
image/jpeg 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/29085447/georgia-cyberattack-64x64.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c9fff884f49d2eb540f6d6d4dadd4817909c8c90d28dade868c5344baf68a2ba

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 15:28:23 GMT
via: 1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Tue, 29 Oct 2019 12:54:50 GMT
server: AmazonS3
age: 1885549
etag: "6fedc25eeb3b0b57727f204f291f52a1"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, HAM50-C2
accept-ranges: bytes
content-length: 1648
x-amz-cf-id: S7Lhi5WNUA_lX-IL0zHfWSlaLYF6uhRYMfgMb3HbfMHQwgwj4n4Ykw==
expires: Wed, 28 Oct 2020 12:54:47 GMT

GET
H2 200 Artificial-Intelligence-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/23105243/ 3 KB
3 KB 36ms
35ms Image
image/jpeg 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/23105243/Artificial-Intelligence-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c093719869fa0fa0375b76f64d9d01908527177983a0740ec475e2bf8dae79c9

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 13:26:15 GMT
via: 1.1 129372028f60828d8c084fb619a69bc0.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Thu, 23 Aug 2018 14:52:46 GMT
server: AmazonS3
age: 2065677
etag: "89110595e41b038a49ae024d66f9354e"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, HAM50-C2
accept-ranges: bytes
content-length: 2924
x-amz-cf-id: kjPK3__NFjqXpz7ve2Z1_gcSTU7xFB4iJfOJutcHZPnGlXlo-90JaA==
expires: Fri, 23 Aug 2019 14:52:43 GMT

GET
H2 200 data-center-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2020/01/15162631/ 8 KB
9 KB 74ms
74ms Image
image/png 2600:9000:2016:a800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/01/15162631/data-center-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:a800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1d36800d5a9c72e02424db4f2ee2d3e3391388e8b7e863533f73c788df14ab5e

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 16 Feb 2020 06:15:20 GMT
via: 1.1 a75b67932d84d80b40e12159613deb17.cloudfront.net (CloudFront), 1.1 94a519c8a0bf381244e89215b16b0952.cloudfront.net (CloudFront)
last-modified: Wed, 15 Jan 2020 21:26:52 GMT
server: AmazonS3
age: 7707532
etag: "93668d327fc4fcc8e57177484d96236e"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, HAM50-C2
accept-ranges: bytes
content-length: 8414
x-amz-cf-id: cy84Omgs_PN5PpWIcipCOBAB1q0cYLmns5rjCAK1qMW7hUT1zm6Y3w==
expires: Thu, 14 Jan 2021 21:26:49 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ 25 KB
8 KB 65ms
20ms Script
text/javascript 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: ed744884f2d88d2339918f907503d536a3d9bdcb0cb4ac921a0dd7979564810e

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:10 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/javascript; charset=utf-8

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 288ms
281ms Script
application/x-javascript 2600:9000:2016:3c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=569a1c93

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:2016:3c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C2
x-cache: Miss from cloudfront
status: 200
content-length: 926
x-cache-hit: HIT
last-modified: Thu, 14 May 2020 12:36:57 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: pDgd_Z_leKBIwhtFJdn1DJebZhnyk_v4GtI-_hUMCOUQRkVjZX7QPw==
expires: Fri, 15 May 2020 15:57:26 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 34 KB
12 KB 736ms
108ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 14 May 2020 12:36:56 GMT
Server: nginx
ETag: W/"5ebd3b68-88c2"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 22 May 2020 11:14:12 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 7 KB
3 KB 287ms
280ms Script
application/x-javascript 2600:9000:2016:3c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=569a1c93

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:2016:3c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C2
x-cache: Miss from cloudfront
status: 200
content-length: 2685
x-cache-hit: HIT
last-modified: Thu, 14 May 2020 12:36:57 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: 3qCALVVBkZh6S8sgCVp9d0WIPYl3vIS37J6fO7KUN2wP-jwdhePEJA==
expires: Fri, 15 May 2020 15:57:26 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 295ms
289ms Script
application/x-javascript 2600:9000:2016:3c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=569a1c93

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:2016:3c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C2
x-cache: Miss from cloudfront
status: 200
content-length: 1747
x-cache-hit: HIT
last-modified: Thu, 14 May 2020 12:36:57 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: rP-3vZmLvzcDqDkK60QHtreMZEqVnTLae8hlDk19VFxyAyhlMpzc_g==
expires: Fri, 15 May 2020 15:57:27 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 676 B
515 B 26ms
20ms Script
text/javascript 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.3.2

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f9c1c61861d1e9a7fc38e95ff08933dfd808bb8b8bcdf92f097cb329550f6a89

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 447
x-xss-protection: 1; mode=block
expires: Fri, 15 May 2020 11:14:11 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 389ms
383ms Script
application/x-javascript 2600:9000:2016:3c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=569a1c93

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:2016:3c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e2059610101cb4718d6d9cf8d6e44243838304968710f35ed7f44188a9c279

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C2
x-cache: Miss from cloudfront
status: 200
content-length: 947
x-cache-hit: HIT
last-modified: Wed, 18 Dec 2019 22:32:15 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: jwq1KDZZ1XpsWKfpZxUUGaTH8F2VVW2aHWXvxQ6mVCWpP8uaHuHndg==
expires: Fri, 15 May 2020 15:57:29 GMT

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ 36 KB
13 KB 29ms
25ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 667a53e3145f4c8b641a886082ce900423662980c5fe3d784383c3d481de2320

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 10 May 2020 07:31:34 GMT
content-encoding: gzip
age: 445358
x-cache: Hit from cloudfront
status: 200
content-length: 12549
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:15:52 GMT
server: AmazonS3
etag: "17acdbb1a7a117b8f53f3f84e0db205b"
x-amz-version-id: HwMWPPcis1b0hnhKcUJr6rhRxxqLZtvX
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: __2jrnecp6eC2yrGoXKOxKSynlvyQQgCz7c2Qg0XtEQ6I_jVk-wUUw==

GET
H2 200 bl-2a28c82-ab6585a5.js Show response
tagan.adlightning.com/math-aids-threatpost/ 98 KB
41 KB 33ms
30ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-2a28c82-ab6585a5.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7160807a4aabc44b02e210d7db4c0da4eecd75df528a951e88b350420a124391

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 13 May 2020 18:54:47 GMT
content-encoding: gzip
age: 145165
x-cache: Hit from cloudfront
status: 200
content-length: 41827
x-amz-meta-git_commit: 2a28c82
last-modified: Wed, 13 May 2020 15:59:59 GMT
server: AmazonS3
etag: "897625fc0340e2aa2beff21c3715c66d"
x-amz-version-id: n6eaLRN_ifGdojH82zaK7hd4tTAVzwBp
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: xTqADvBjLKSCUwE-u2GJTiBpCaQnqSzp718gYC5TcYxkmWd60j6Vew==

GET
H2 200 pubads_impl_2020051102.js Show response
securepubads.g.doubleclick.net/gpt/ 244 KB
88 KB 28ms
28ms Script
text/javascript 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

sffe /

Resource Hash

53d35f6abc5fec7dedb2ad111d3053486941d5d3512ef2ff64bb4a01c9c14cce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 11 May 2020 18:37:19 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89597
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:11 GMT

GET
H2 200 integrator.sync.js Show response
adservice.google.de/adsid/ 113 B
175 B 18ms
18ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 108
x-xss-protection: 0

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 263 B
2 KB 179ms
90ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=b47bbaa3-c109-4e70-9ccd-05aebe093865&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.3525614166129871
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: e5792172e9a0e72cd72edbe216e8792118ad4c2ca2f475b173d47f2f23e32f76

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:11 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=182
Content-Length: 263
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 182ms
90ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=c202643c-fbee-4191-85de-6f606d62272e&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5854810515260918
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 7d7d6c5df1b2704e97a265da471fe669ae877ec3be426c11954803655f55f8b1

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:11 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=221
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 200ms
104ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=a36afede-62c1-4643-bd40-fa063590c209&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.2983942645379891
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: bbf4d7b0b646380968cfe034aa5e1c99dd7d288e243dbc33664d6583a30dbe36

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:11 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=199
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 186ms
89ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=a36afede-62c1-4643-bd40-fa063590c209&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.501239568371223
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: e45a4f7dca7c441a8e1f9862d14232d2dc2e9845d22446adc228097d261b48c5

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:11 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=477
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 170ms
141ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Fri, 15 May 2020 11:14:11 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 25 B
988 B 190ms
140ms XHR
application/json 72.247.225.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%2211284548170fbe3%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22122fe7affde8d23%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2213ef796bd1b71fc%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%221437a0b9ee7c3b6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%7D&ac=j&sd=1&
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.98 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: fa07edc0b05d9f4233f7266cba3c6e87a4ceb3752719ace618b25a295451a8b1

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 45
Expires: Fri, 15 May 2020 11:14:11 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
712 B 53ms
16ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:13 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 726.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.137:80
AN-X-Request-Uuid: 6eff74fa-c5b7-41d6-8d72-5752e50ee519
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ADTECH;apid=1A34183e8c-969d-11ea-9985-12dcd5311714;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=451d0d2d30cd64a;misc=1589541251386 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=451d0d2d30cd64a;misc=1589541251386;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=451d0d2d30cd64a;misc=1589541251386
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A34183e8c-969d-11ea-9985-12dcd5311714;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=451d0d2d30cd64a;misc=15...

944 B
1 KB

165ms
163ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A34183e8c-969d-11ea-9985-12dcd5311714;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=451d0d2d30cd64a;misc=1589541251386
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 0f58bcef9606d6c6a8a1495d6fb1a2fef06d8f6e50cb613cf59c5f33547d0771

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 944
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A34183e8c-969d-11ea-9985-12dcd5311714;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=451d0d2d30cd64a;misc=1589541251386
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A3418aca0-969d-11ea-8e0b-124a081e334a;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=46bfe8044568b6b;misc=1589541251386 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=46bfe8044568b6b;misc=1589541251386;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=46bfe8044568b6b;misc=1589541251386
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A3418aca0-969d-11ea-8e0b-124a081e334a;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=46bfe8044568b6b;misc=15...

944 B
1 KB

157ms
155ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A3418aca0-969d-11ea-8e0b-124a081e334a;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=46bfe8044568b6b;misc=1589541251386
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 96543aefeee90324f9e94b0a81d9c9e2a03af8fbc14fcee396582aa868c85c50

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:12 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/json
content-length: 944
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A3418aca0-969d-11ea-8e0b-124a081e334a;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=46bfe8044568b6b;misc=1589541251386
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A34183342-969d-11ea-8db2-123c39a1c2a0;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=47686ddb9511477;misc=1589541251386 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=47686ddb9511477;misc=1589541251386;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=47686ddb9511477;misc=1589541251386
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A34183342-969d-11ea-8db2-123c39a1c2a0;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=47686ddb9511477;misc=15...

944 B
1 KB

174ms
174ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A34183342-969d-11ea-8db2-123c39a1c2a0;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=47686ddb9511477;misc=1589541251386
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: df61a41d3e854c170e07bf9c5813f2a1e1738d62b71089b5c2382e9cc7a1bcae

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 944
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A34183342-969d-11ea-8db2-123c39a1c2a0;cfp=1;rndc=1589541251;v=2;cmd=bid;cors=yes;alias=47686ddb9511477;misc=1589541251386
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=480dcbb5b49c037;misc=1589541251386 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=480dcbb5b49c037;misc=1589541251386;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=480dcbb5b49c037;misc=1589541251386

943 B
1 KB

162ms
161ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=480dcbb5b49c037;misc=1589541251386
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 1c34df0a1a6831ad1a6d87ba5381d48abfe4a2a2290418d078588b15c19c3f43

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 943
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1589541250;v=2;cmd=bid;cors=yes;alias=480dcbb5b49c037;misc=1589541251386
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET ADTECH;v=2;cmd=bid;cors=yes;alias=497cd67432e0518;misc=1589541251386;
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ 0
0

POST
H2 200 v2 Show response
e.serverbid.com/api/ 711 B
649 B 312ms
111ms XHR
application/json 167.172.1.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.172.1.14 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: br
status: 200
vary: Origin
content-type: application/json
access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
content-length: 372

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
712 B 51ms
18ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:13 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 726.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.109:80
AN-X-Request-Uuid: 79414a4c-4264-4f36-8d92-327a4a05b0ba
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
702 B 49ms
20ms XHR
application/json 216.52.2.30
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_3.8.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 97e206032314b9ce6176549e79f8cdbbd2a23bf6e0165d8b1ce2d980ef03051b

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 44

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 174 B
561 B 215ms
164ms XHR
application/json 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=b47bbaa3-c109-4e70-9ccd-05aebe093865%2Cb47bbaa3-c109-4e70-9ccd-05aebe093865%2Cc202643c-fbee-4191-85de-6f606d62272e%2Ca36afede-62c1-4643-bd40-fa063590c209%2Ca36afede-62c1-4643-bd40-fa063590c209&nocache=1589541251390&pubcid=61e579b2-9e30-48cd-8307-5c5fbbeec682&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720&
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.186.1 /
Resource Hash: 3d11978e2cd1da562312ff7ec34547aaf7d08b8acc4220d63e36c6f697366530

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
server: OXGW/16.186.1
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 166
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 109 KB
38 KB 17ms
14ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ba19cdcaf592f6ec56c11da9dcf9f7ec3272752af1bdf9288dcb64b7bde85511

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38413
x-xss-protection: 0
last-modified: Fri, 15 May 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 15 May 2020 11:14:11 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 11 KB
4 KB 728ms
116ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 14 May 2020 12:36:58 GMT
Server: nginx
ETag: W/"5ebd3b6a-2b9f"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 22 May 2020 11:14:12 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 11 KB
4 KB 723ms
105ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 14 May 2020 12:37:00 GMT
Server: nginx
ETag: W/"5ebd3b6c-2b9f"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 22 May 2020 11:14:12 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/JPZ52lNx97aD96bjM7KaA0bo/ 299 KB
122 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/JPZ52lNx97aD96bjM7KaA0bo/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5330600f68293b69db933eba611413ffaa46ad7c992116b06933c620d7a3c43c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 11 May 2020 21:43:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 11 May 2020 19:09:25 GMT
server: sffe
age: 307840
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124431
x-xss-protection: 0
expires: Tue, 11 May 2021 21:43:31 GMT

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 242ms
108ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:11 GMT
Last-Modified: Thu, 14 May 2020 12:36:58 GMT
Server: nginx
ETag: "5ebd3b6a-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Fri, 22 May 2020 11:14:11 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 362ms
189ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
Origin: https://threatpost.com

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:11 GMT
Last-Modified: Thu, 14 May 2020 12:37:00 GMT
Server: nginx
ETag: "5ebd3b6c-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Sat, 15 May 2021 11:14:11 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 377ms
189ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
Origin: https://threatpost.com

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:11 GMT
Last-Modified: Thu, 14 May 2020 12:37:00 GMT
Server: nginx
ETag: "5ebd3b6c-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Sat, 15 May 2021 11:14:11 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 374ms
181ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
Origin: https://threatpost.com

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:11 GMT
Last-Modified: Thu, 14 May 2020 12:37:00 GMT
Server: nginx
ETag: "5ebd3b6c-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Sat, 15 May 2021 11:14:11 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 394ms
201ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
Origin: https://threatpost.com

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:11 GMT
Last-Modified: Thu, 14 May 2020 12:37:00 GMT
Server: nginx
ETag: "5ebd3b6c-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Sat, 15 May 2021 11:14:11 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 393ms
193ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
Origin: https://threatpost.com

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:11 GMT
Last-Modified: Thu, 14 May 2020 12:36:58 GMT
Server: nginx
ETag: "5ebd3b6a-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Sat, 15 May 2021 11:14:11 GMT

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 600ms
109ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 14 May 2020 12:36:58 GMT
Server: nginx
ETag: W/"5ebd3b6a-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 22 May 2020 11:14:12 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 594ms
94ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 14 May 2020 12:37:00 GMT
Server: nginx
ETag: W/"5ebd3b6c-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 22 May 2020 11:14:12 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 99C2 2 KB
1 KB 19ms
18ms Script
text/javascript 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1589541251&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 4e68f7f022e7f83b75ca7355dcbbd76273b415f31fbcf713f2e05af734cf65f2

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/javascript; charset=utf-8

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 596ms
106ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 14 May 2020 12:36:58 GMT
Server: nginx
ETag: W/"5ebd3b6a-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 22 May 2020 11:14:12 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 404ms
106ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1589459821
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:12 GMT
Last-Modified: Thu, 14 May 2020 12:37:00 GMT
Server: nginx
ETag: "5ebd3b6c-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Fri, 22 May 2020 11:14:12 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 30 Apr 2020 21:54:13 GMT
server: Golfe2
age: 2136
date: Fri, 15 May 2020 10:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18433
expires: Fri, 15 May 2020 12:38:35 GMT

GET
H/1.1 200
OK quant.js Show response
secure.quantserve.com/ 21 KB
8 KB 89ms
24ms Script
application/x-javascript 91.228.74.217
QUANTCAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.quantserve.com/quant.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.217 , United Kingdom, ASN27281 (QUANTCAST, US),

Reverse DNS

Software

QS /

Resource Hash

b68b4d1e6d63eabb8a4f663f7755454028aa22d9a0edc88d5b77c58e932d7fa0

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Last-Modified: Fri, 15-May-2020 11:14:11 GMT
Server: QS
Etag: M0-004a9efe
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=604800
Strict-Transport-Security: max-age=86400
Content-Length: 8025
Expires: Fri, 22 May 2020 11:14:11 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 78ms
24ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
age: 40260
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19136-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1589541252.736321,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK iab_consent_sdk.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 99C2 19 KB
6 KB 17ms
15ms Script
application/javascript 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1589541251&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:10 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Feb 2020 15:01:36 GMT
Server: nginx
ETag: W/"5e441350-4be0"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 15 May 2021 11:14:10 GMT

GET
H/1.1 200
OK DetectGDPR2.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 99C2 8 KB
3 KB 36ms
18ms Script
application/javascript 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR2.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1589541251&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Jan 2020 18:48:12 GMT
Server: nginx
ETag: W/"5e2ddeec-211f"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 15 May 2021 11:14:11 GMT

GET
H/1.1 200
OK DetectGDPR.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 99C2 7 KB
3 KB 47ms
16ms Script
application/javascript 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1589541251&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Jan 2020 11:58:13 GMT
Server: nginx
ETag: W/"5e2d7ed5-1d87"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 15 May 2021 11:14:11 GMT

GET
H/1.1 200
OK hls.0.12.4_1.min.js Show response
live.sekindo.com/content/video/hls/ Frame 99C2 247 KB
85 KB 64ms
33ms Script
application/javascript 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1589541251&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Last-Modified: Mon, 06 Jan 2020 15:31:55 GMT
Server: nginx
ETag: W/"5e1352eb-3dcb9"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 15 May 2021 11:14:11 GMT

GET
H/1.1 200
OK prebidVid.2.44.3_4.min.js Show response
live.sekindo.com/content/prebid/ Frame 99C2 272 KB
101 KB 66ms
36ms Script
application/javascript 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1589541251&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 2c167f4042d1338b33e2822f3b3dca3646bffcac14747d934c50794192dc3c2b

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 May 2020 09:21:08 GMT
Server: nginx
ETag: W/"5eafde84-4415a"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 15 May 2021 11:14:11 GMT

GET
H/1.1 200
OK liveVideo.php Show response
live.sekindo.com/live/ Frame 99C2 413 KB
117 KB 64ms
34ms Script
text/html 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&debugInfo=12348808_ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069000244140625&geoLong=5.102399826049805&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1589541251&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 06834f92b4b3ccbff1358225dbace32484d2d0c37179a634d3d4d7019d3cd644

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Server: nginx
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=617734723&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ul=en-us&de=UTF-8...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=440715696.1589541252&jid=441707615&_gid=524900900.1589541252&gjid=1799385515&_v=j82&z=1952921706
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=441707615&_v=j82&z=1952921706
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=441707615&_v=j82&z=1952921706&slf_rd=1&random=1693348974

42 B
106 B

16ms
16ms

Image
image/gif

2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=441707615&_v=j82&z=1952921706&slf_rd=1&random=1693348974

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:11 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=441707615&_v=j82&z=1952921706&slf_rd=1&random=1693348974
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 178ms
130ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Fri, 15 May 2020 11:14:11 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: a508c3da7a8e571702d87f15eb52af6a
x-transaction: 003171c900be612b
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
357 B 437ms
400ms Script
application/x-javascript 2600:9000:2093:4000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:4000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:09:49 GMT
via: 1.1 6c314f9bc806736c483494e492792b33.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 274
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: YBAEQd0ciHE4tFL2NtLvuGKb_F73Up7JLOqQBB5EbzCofbTuSyOaBg==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 99C2 101 KB
26 KB 82ms
34ms Script
application/javascript 52.222.191.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&debugInfo=12348808_ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069000244140625&geoLong=5.102399826049805&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.191.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-191-80.ham50.r.cloudfront.net
Software: Server /
Resource Hash: b388addf9c8ba4bc2852132727bd9df68c99db7ca97d22fdb18ad2a426d02a5b

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:08:27 GMT
content-encoding: gzip
server: Server
age: 344
etag: 06fa05e9082ab6150f8e415571b3ff6a
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=900
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: PWh_Bjpp0ldCd6BGdDJiLaolenDa2lsC05z8UjEKi3D3lSqpuSeCuQ==
via: 1.1 0db8881d14f219a945f6f3898134012d.cloudfront.net (CloudFront)

GET
H2 200 css
fonts.googleapis.com/ Frame 9FF7 2 KB
669 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&debugInfo=12348808_ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069000244140625&geoLong=5.102399826049805&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 15 May 2020 11:14:11 GMT
server: ESF
date: Fri, 15 May 2020 11:14:11 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 15 May 2020 11:14:11 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame BED3 2 KB
669 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 15 May 2020 11:14:12 GMT
server: ESF
date: Fri, 15 May 2020 11:14:12 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 15 May 2020 11:14:12 GMT

GET
H/1.1 200
OK user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 5C8E 0
0 82ms
24ms Document
text/html 72.247.225.32
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&debugInfo=12348808_ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069000244140625&geoLong=5.102399826049805&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.32 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-32.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

Last-Modified: Tue, 14 Apr 2020 10:28:34 GMT
ETag: "1300708-2eae-5a33da96f833f"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 4169
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=131526
Expires: Sat, 16 May 2020 23:46:18 GMT
Date: Fri, 15 May 2020 11:14:12 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK placeHolder.png
live.sekindo.com/content/video/splayer/assets/ 23 KB
24 KB 24ms
18ms Image
image/png 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/content/video/splayer/assets/placeHolder.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:11 GMT
Last-Modified: Sun, 11 Jun 2017 08:03:58 GMT
Server: nginx
ETag: "593cf96e-5dbf"
Content-Type: image/png
Cache-Control: no-cache, private
Accept-Ranges: bytes
Content-Length: 23999
Expires: Fri, 15 May 2020 11:14:10 GMT

GET
H/1.1 200
OK vid5eb5cfe7530e1396936155.jpg
video.sekindo.com/uploads/cn15/video/users/converted/24485/video1523972806/ Frame BED3 19 KB
19 KB 68ms
18ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn15/video/users/converted/24485/video1523972806/vid5eb5cfe7530e1396936155.jpg?cbuster=1588973544

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

b4153138e58f8edd6dfad5d0ef015d9a1ea410e774b0f18ceeb1a94e55edbb4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Fri, 08 May 2020 21:38:29 GMT
Server: Tengine
ETag: "5eb5d155-4bf4"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 19444
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb9fa63809ee219502268.jpg
video.sekindo.com/uploads/cn15/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame BED3 21 KB
21 KB 88ms
19ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn15/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5eb9fa63809ee219502268.jpg?cbuster=1589246567

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

fd920468078f9ce3bd928870d328f15f530bd07ef49098cc310acee65e9e9284

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Tue, 12 May 2020 02:30:50 GMT
Server: Tengine
ETag: "5eba0a5a-52a0"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 21152
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb02aeb208da036543696.jpg
video.sekindo.com/uploads/cn14/video/users/converted/24485/video1523972806/ Frame BED3 17 KB
17 KB 110ms
21ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn14/video/users/converted/24485/video1523972806/vid5eb02aeb208da036543696.jpg?cbuster=1588603627

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

5d3b82774c0268a19720c53a6dc7a9e43c623cd7702e2ed8aed4afba2433a588

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Mon, 04 May 2020 14:52:12 GMT
Server: Tengine
ETag: "5eb02c1c-429c"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 17052
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb427ad3921b097296914.jpg
video.sekindo.com/uploads/cn15/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame BED3 15 KB
16 KB 132ms
16ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn15/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5eb427ad3921b097296914.jpg?cbuster=1588864944

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

683e1b018e8f26073c9d28cc27d021f3bb04a624bb12322d1c9015ae0be5561c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Thu, 07 May 2020 15:39:11 GMT
Server: Tengine
ETag: "5eb42b9f-3cf7"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 15607
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb427b0ba7bc077806379.jpg
video.sekindo.com/uploads/cn15/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame BED3 5 KB
5 KB 164ms
14ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn15/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5eb427b0ba7bc077806379.jpg?cbuster=1588864948

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

4c2e005f9c7de72cec19bb6509b4fd0289ba2c9b59c78b92751d4c60b298cfbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Thu, 07 May 2020 15:39:17 GMT
Server: Tengine
ETag: "5eb42ba5-13ae"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 5038
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eaabd1f7bddf815753064.jpg
video.sekindo.com/uploads/cn14/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame BED3 11 KB
12 KB 114ms
16ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn14/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5eaabd1f7bddf815753064.jpg?cbuster=1588247846

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

92d0171289868d45a2099f1e0507824921169d4e8048aaecdf52802adae3c939

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Thu, 30 Apr 2020 12:05:35 GMT
Server: Tengine
ETag: "5eaabf0f-2d3a"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 11578
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb2bcd97bc58215407577.jpg
video.sekindo.com/uploads/cn14/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame BED3 12 KB
13 KB 111ms
16ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn14/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5eb2bcd97bc58215407577.jpg?cbuster=1588772064

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

e4be5b94ae5d44559ee0e809b87774c6f6e3df1c523e6ab24e31977e965e76a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Wed, 06 May 2020 13:48:37 GMT
Server: Tengine
ETag: "5eb2c035-31c4"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 12740
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4c888355a8398156836.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video1523972806/ Frame BED3 32 KB
32 KB 103ms
17ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video1523972806/vid5eb4c888355a8398156836.jpg?cbuster=1588906120

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

41ecbdbfb32c9316c36377677d69082c99207ac998ee13680ed6ecf5e31d2ee6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Fri, 08 May 2020 02:53:14 GMT
Server: Tengine
ETag: "5eb4c99a-7ffa"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 32762
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eac8838dc5d3137845426.jpg
video.sekindo.com/uploads/cn13/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame BED3 14 KB
14 KB 71ms
15ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5eac8838dc5d3137845426.jpg?cbuster=1588365375

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

e3a59eba123b8a0e2cf8a54eb06a12491f840d7d4d822a5fbe02927551beb888

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Fri, 01 May 2020 20:51:25 GMT
Server: Tengine
ETag: "5eac8bcd-37d8"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 14296
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5ebc1486ce9c5672263682.jpg
video.sekindo.com/uploads/cn15/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame BED3 10 KB
11 KB 71ms
15ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn15/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5ebc1486ce9c5672263682.jpg?cbuster=1589384331

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

bf95a8ad37e83fa0207462a3fa605fce6b3542ca6a78563a75a1fca7ae084224

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Wed, 13 May 2020 15:56:55 GMT
Server: Tengine
ETag: "5ebc18c7-2894"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 10388
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

sync
x.bidswitch.net/ul_cb/ Frame 99C2
Redirect Chain

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5ebe798390995&custom_data=5ebe798390995&gdpr=1&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5ebe798390995&custom_data=5ebe798390995&gdpr=1&gdpr_consent=

43 B
379 B

33ms
33ms

Image
image/gif

52.59.163.227
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5ebe798390995&custom_data=5ebe798390995&gdpr=1&gdpr_consent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.163.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-163-227.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Fri, 15 May 2020 11:14:12 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

status: 302
date: Fri, 15 May 2020 11:14:12 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5ebe798390995&custom_data=5ebe798390995&gdpr=1&gdpr_consent=
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

liveCS.php
live.sekindo.com/live/ Frame 99C2
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=d2496298-3687-4a1b-8a77-f2052a980a8b

0
347 B

60ms
59ms

Image
text/html

194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=d2496298-3687-4a1b-8a77-f2052a980a8b
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:13 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: no-store
Content-Type: text/html; charset=utf-8

Redirect headers

status: 307
date: Fri, 15 May 2020 11:14:13 GMT
content-length: 0
location: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=d2496298-3687-4a1b-8a77-f2052a980a8b

GET
H/1.1 200
OK vid5eb5cfe7530e1396936155.jpg
video.sekindo.com/uploads/cn15/video/users/converted/24485/video1523972806/ Frame 9FF7 19 KB
19 KB 145ms
16ms Image
image/jpeg 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn15/video/users/converted/24485/video1523972806/vid5eb5cfe7530e1396936155.jpg?cbuster=1588973544

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),

Reverse DNS

Software

Tengine /

Resource Hash

b4153138e58f8edd6dfad5d0ef015d9a1ea410e774b0f18ceeb1a94e55edbb4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://amli.sekindo.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:03 GMT
Last-Modified: Fri, 08 May 2020 21:38:29 GMT
Server: Tengine
ETag: "5eb5d155-4bf4"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 19444
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ Frame 9FF7 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9FF7 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 99C2 6 KB
3 KB 1130ms
51ms XHR
application/javascript 52.222.191.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.191.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-191-80.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 06:14:48 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 17966
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 09 Apr 2020 23:46:54 GMT
server: AmazonS3
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 63c9a084de27504ef34be3673921d01e.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: OwXxrnwx46mWViTY5CVOo7hL7EiDtykbCJI2IS6LtoW0ZBtizUeEDA==

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 99C2 78 KB
4 KB 48ms
48ms XHR
application/json 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn15%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo1523972806%2Fvid5eb5cfe7530e1396936155.mp4&vid_content_id=789300&vid_content_desc=Companies+and+States+Clash+Over+How+to+Classify+a+Gig+Worker&vid_content_title=Companies+and+States+Clash+Over+How+to+Classify+a+Gig+Worker&vid_content_duration=324&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&x=400&y=225&fpl=0&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&isApp=0&geoLati=52.069000244140625&geoLong=5.102399826049805&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&cbuster=1589541252034&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&debugInfo=12348808_ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069000244140625&geoLong=5.102399826049805&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: a154f71172663cd7151a9c2bfc0f43ef0aeedceff11e0459800eb46560df4b26

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 3382

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 99C2 78 KB
4 KB 50ms
49ms XHR
application/json 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn15%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo1523972806%2Fvid5eb5cfe7530e1396936155.mp4&vid_content_id=789300&vid_content_desc=Companies+and+States+Clash+Over+How+to+Classify+a+Gig+Worker&vid_content_title=Companies+and+States+Clash+Over+How+to+Classify+a+Gig+Worker&vid_content_duration=324&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&x=320&y=180&fpl=0&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&isApp=0&geoLati=52.069000244140625&geoLong=5.102399826049805&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&cbuster=1589541252034&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&debugInfo=12348808_ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069000244140625&geoLong=5.102399826049805&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 57773418df31d691c2231074492deaa5ac8223d2d912eed396f44cb35cc1793c

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:12 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 3435

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 99C2 25 KB
2 KB 53ms
53ms XHR
application/json 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn15%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo1523972806%2Fvid5eb5cfe7530e1396936155.mp4&vid_content_id=789300&vid_content_desc=Companies+and+States+Clash+Over+How+to+Classify+a+Gig+Worker&vid_content_title=Companies+and+States+Clash+Over+How+to+Classify+a+Gig+Worker&vid_content_duration=324&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&x=400&y=225&fpl=0&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&isApp=0&geoLati=52.069000244140625&geoLong=5.102399826049805&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&cbuster=1589541252035&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&debugInfo=12348808_ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069000244140625&geoLong=5.102399826049805&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: a34c9929700618f4d6f902bc3175d89d140266742b8e042386d6a78cee3e29c5

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 1864

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 99C2 0
215 B 105ms
34ms XHR
application/json 18.184.66.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.66.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-66-147.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Server: adaptv/1.0
Connection: keep-alive
Content-Length: 0
Content-Type: application/json

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 99C2 0
59 B 16ms
16ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Fri, 15 May 2020 11:14:12 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/JPZ52lNx97aD96bjM7KaA0bo/ 299 KB
122 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/JPZ52lNx97aD96bjM7KaA0bo/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.3.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5330600f68293b69db933eba611413ffaa46ad7c992116b06933c620d7a3c43c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 11 May 2020 21:43:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 11 May 2020 19:09:25 GMT
server: sffe
age: 307841
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124431
x-xss-protection: 0
expires: Tue, 11 May 2021 21:43:31 GMT

GET
H2 200 flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 236 B
565 B 280ms
280ms Image
image/svg+xml 2600:9000:2016:3c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:3c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=569a1c93
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Fri, 15 May 2020 11:14:12 GMT
content-encoding: gzip
last-modified: Thu, 14 May 2020 12:36:57 GMT
server: nginx
x-amz-cf-pop: HAM50-C2
etag: W/"5ebd3b69-ec"
x-cache: Miss from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=604800, public
x-amz-cf-id: GiuFm7YImE-3SVLzaQbvlKxdX5KQSNhZn_tnbqb3G-HKa1xTV4n-lQ==
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
expires: Fri, 22 May 2020 11:14:12 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 319ms
286ms Font
font/woff2 2600:9000:2016:3c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2016:3c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=569a1c93
Origin: https://threatpost.com

Response headers

date: Fri, 15 May 2020 11:14:12 GMT
via: 1.1 d148104ad832292f01e6a1dab7079d58.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
x-cache: Miss from cloudfront
status: 200
content-length: 77160
pragma: public
last-modified: Thu, 14 May 2020 12:36:58 GMT
server: nginx
etag: "5ebd3b6a-12d68"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: I_eR8BdnKNCThq7vHcgGVLzrKqjR_jxBL2hRUd5qPPv8o3TmYYWjUg==
expires: Sat, 15 May 2021 11:14:12 GMT

GET
H/1.1 200
OK photo-newsletter.jpg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 83 KB
83 KB 1021ms
189ms Image
image/jpeg 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/photo-newsletter.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 940e0c3385928422aae38e1a74f1d84b462d8ce1a056c686fde505a0bf3162bb

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Fri, 15 May 2020 11:14:13 GMT
Last-Modified: Thu, 14 May 2020 12:37:00 GMT
Server: nginx
ETag: "5ebd3b6c-14c88"
Content-Type: image/jpeg
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 85128
Expires: Fri, 22 May 2020 11:14:13 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 446ms
134ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 114
pragma: no-cache
last-modified: Fri, 15 May 2020 11:14:12 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: d4b7ac6d7bdf39f4a22746570ba70b17
x-transaction: 00f087200033e10c
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 anchor
www.google.com/recaptcha/api2/ Frame 6D4B 0
0 28ms
27ms Document
text/html 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&theme=standard&size=normal&cb=ki2su0pu1l0i

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qdztuGvqsjemqS5emLw7iA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&theme=standard&size=normal&cb=ki2su0pu1l0i
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 15 May 2020 11:14:12 GMT
content-security-policy: script-src 'report-sample' 'nonce-qdztuGvqsjemqS5emLw7iA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10276
server: GSE
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 99C2 25 KB
2 KB 43ms
42ms XHR
application/json 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn15%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo1523972806%2Fvid5eb5cfe7530e1396936155.mp4&vid_content_id=789300&vid_content_desc=Companies+and+States+Clash+Over+How+to+Classify+a+Gig+Worker&vid_content_title=Companies+and+States+Clash+Over+How+to+Classify+a+Gig+Worker&vid_content_duration=324&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&x=320&y=180&fpl=0&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&isApp=0&geoLati=52.069000244140625&geoLong=5.102399826049805&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&cbuster=1589541252294&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D31355F31347D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A55494338676157397A51584277535735305A584A3259577843645763674C794179494338675A47566D5958567364413D3D7D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5ebe798390995&debugInfo=12348808_ABT+%2F+iosAppIntervalBug+%2F+2+%2F+default&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069000244140625&geoLong=5.102399826049805&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: ce73e1c733f8bc0a1fa122e9140844a28b775e0b1a9819e877297e5318ebea9b

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:11 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 1867

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 99C2 184 B
386 B 113ms
38ms XHR
application/json 35.157.88.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.88.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-88-129.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 5a56435d0be6fff52393ffe84740a70ddd82754aa7f3bc3ce8c04ee7da921e71

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:12 GMT
content-encoding: gzip
status: 200
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 173
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 99C2 19 B
711 B 15ms
15ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:14 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 726.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.82:80
AN-X-Request-Uuid: b8f8b6ea-e3d2-455d-8c2d-8fb6d5fc749b
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 99C2 0
215 B 27ms
27ms XHR
application/json 18.184.66.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.66.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-66-147.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 99C2 25 B
1 KB 112ms
112ms XHR
application/json 72.247.225.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435870&v=8.1&r=%7B%22id%22%3A%22116d18254f7a7df%22%2C%22imp%22%3A%5B%7B%22id%22%3A%221260c3102d05c57%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22320x180%22%7D%2C%22bidfloor%22%3A1.8%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22api%22%3A%5B1%2C2%5D%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22w%22%3A320%2C%22h%22%3A180%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&nf=1&
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.98 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 3793558897bd7f92932e4e5c6a35d3417dd9df3a9401b55877a3fd1edf33c057

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:12 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 45
Expires: Fri, 15 May 2020 11:14:12 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 99C2 0
59 B 17ms
17ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Fri, 15 May 2020 11:14:12 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 99C2 92 B
285 B 75ms
73ms XHR
application/json 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=168bbb04-2e4f-4444-8fe3-208555579075&nocache=1589541252312&gdpr_consent=&gdpr=1&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&skip=1&auid=540882779&vwd=320&vht=180&
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.186.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:12 GMT
via: 1.1 google
server: OXGW/16.186.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK chunklist_640.m3u8 Show response
video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/ Frame 99C2 2 KB
2 KB 789ms
437ms XHR
application/vnd.apple.mpegurl 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/chunklist_640.m3u8
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: Tengine /
Resource Hash: f415a788eac7035eb8cf4fd8785dd6f344a5ed33d0f37d51f131fbcda0eb63ff

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:04 GMT
Last-Modified: Fri, 08 May 2020 21:38:59 GMT
Server: Tengine
ETag: "5eb5d173-6fb"
Content-Type: application/vnd.apple.mpegurl
Access-Control-Allow-Origin: *
Expires: Fri, 22 May 2020 11:14:04 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 1787
X-Proxy-Cache: MISS

GET
H2 200 / Show response
graph.facebook.com/ 91 B
483 B 61ms
47ms XHR
application/json 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f55a23c5a090044e82f8619a6ddffa5e8596c29b703a59a65e223a542362b961

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
etag: "1775099ec4113f034ebf04fb1c80acad9e6f8c9c"
status: 200
x-fb-rev: 1002131623
alt-svc: h3-27=":443"; ma=3600
content-length: 91
pragma: no-cache
x-fb-debug: NzXHnerljVBFH5c6dYtonyChRWBaDu1VuvzCBfqSpRVc6Mp9Ha4Lrv0kaxmxURWOkyU0UPU9M8NKy4ymMQ6z/A==
x-fb-trace-id: EA57H7Mv75y
date: Fri, 15 May 2020 11:14:12 GMT, Fri, 15 May 2020 11:14:12 GMT
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AIwtPsEV0WH3vIHKrKr6z8a
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 224ms
176ms Script
text/html 2a05:f500:11:101::b93f:9001
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&format=jsonp&callback=jQuery112406845479175169746_1589541251401&_=1589541251402
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9001 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 4 KB
3 KB 524ms
179ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 Manchester, United Kingdom, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

294a356ae487130333b79d7de930bfcbe2cdb344f5a04edd00c33506c43769ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-allow-origin: *
x-cache: MISS
status: 200
vary: accept-encoding
content-length: 1629
x-xss-protection: 1; mode=block
x-served-by: cache-man4134-MAN
x-moose: majestic
expires: -1
server: snooserv
x-timer: S1589541253.692367,VS0,VE131
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
via: 1.1 varnish
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
x-ua-compatible: IE=edge
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 9FF7 11 KB
11 KB 18ms
18ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto&display=swap
Origin: https://threatpost.com

Response headers

date: Fri, 08 May 2020 19:19:05 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 575707
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Sat, 08 May 2021 19:19:05 GMT

GET
H2 200 anchor
www.google.com/recaptcha/api2/ Frame A2FB 0
0 38ms
37ms Document
text/html 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&theme=light&size=normal&cb=hg74c2kmyo97

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6iCElh6xb/0b53YwbxkSog' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&theme=light&size=normal&cb=hg74c2kmyo97
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 15 May 2020 11:14:12 GMT
content-security-policy: script-src 'report-sample' 'nonce-6iCElh6xb/0b53YwbxkSog' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10185
server: GSE
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK pixel;r=815618235;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F;fpan=1;fpa=P0-1682491647-1589541252401;ns=0;ce=1;qjs...
pixel.quantserve.com/ 35 B
658 B 586ms
125ms Image
image/gif 91.228.74.148
QUANTCAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=815618235;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F;fpan=1;fpa=P0-1682491647-1589541252401;ns=0;ce=1;qjs=1;qv=f473609d-20200430082408;cm=;gdpr=0;ref=;je=0;sr=1600x1200x24;enc=n;dst=1;et=1589541252401;tzo=-120;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F03%2F04120302%2FOneNo%2Ctype.article%2Ctitle.Microsoft%20OneNote%20Used%20To%20Sidestep%20Phishing%20Detection%2Cdescription.A%20recent%20phishing%20campaign%20used%20OneNote%20to%20distribute%20the%20Agent%20Tesla%20keylogger%252E%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.148 , United Kingdom, ASN27281 (QUANTCAST, US),

Reverse DNS

Software

QS /

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:12 GMT
Server: QS
Strict-Transport-Security: max-age=86400
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control: private, no-cache, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 75 KB
15 KB 461ms
460ms XHR
text/plain 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3759877639605714&correlator=1425190348305023&output=ldjh&impl=fifs&adsid=NT&eid=21061507%2C21066150%2C21065928%2C21065976&vrg=2020051102&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200515&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fmicrosoft-onenote-sidestep-phishing-detection%252F153436%252F%26urlquery%3Dgoogfc%26contentid%3D153436%26category%3Dcloud-security%26contenttags%3Dagent-tesla%252Ccredentials%252Cemail-attack%252Ckeylogger%252Cmicrosoft%252Conedrive%252Conenote%252Cphishing%252Cphishing-campaign-0&cookie_enabled=1&bc=31&abxe=1&lmt=1589541252&dt=1589541252690&dlt=1589541250523&idt=780&frm=20&biw=1585&bih=1200&oid=3&adxs=429%2C1075%2C1075%2C0&adys=10%2C257%2C1563%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&dssz=49&icsg=180401212416&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1585x2&msz=728x90%7C300x250%7C300x250%7C1585x2&ga_vid=440715696.1589541252&ga_sid=1589541253&ga_hid=617734723&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

cafe /

Resource Hash

ee69c3269e0772082a8ab8f18c00fe3dddb92dbc2037ff5d4ddd56a063b7a4e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15116
x-xss-protection: 0
google-lineitem-id: -1,5256232715,5192770279,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,138298747257,138290162637,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
a4f79a64d2fc9be411e8260fcd860c78.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 87ms
14ms Other
text/html 2a00:1450:4001:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://a4f79a64d2fc9be411e8260fcd860c78.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 48ms
46ms Other
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 bframe
www.google.com/recaptcha/api2/ Frame 7A2B 0
0 32ms
27ms Document
text/html 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=k47rlvoj9v4c

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-vKrvo6sI8TK3EXkn3USyqw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=k47rlvoj9v4c
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 15 May 2020 11:14:12 GMT
content-security-policy: script-src 'report-sample' 'nonce-vKrvo6sI8TK3EXkn3USyqw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1182
server: GSE
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bframe
www.google.com/recaptcha/api2/ Frame 282F 0
0 27ms
20ms Document
text/html 2a00:1450:4001:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=pg6uue2rbgj0

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-OOOZYGdoXwNpj3eLKD9SdA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=JPZ52lNx97aD96bjM7KaA0bo&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=pg6uue2rbgj0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 15 May 2020 11:14:13 GMT
content-security-policy: script-src 'report-sample' 'nonce-OOOZYGdoXwNpj3eLKD9SdA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1181
server: GSE
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK w_640_000.ts Show response
video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/ Frame 99C2 329 KB
330 KB 403ms
401ms XHR
video/mp2t 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/w_640_000.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 4be5c19f10d1976045562eacefa42bf91c25ec5efc5ebc1298a57214a36b314c

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:04 GMT
Last-Modified: Fri, 08 May 2020 21:38:40 GMT
Server: Tengine
ETag: "5eb5d160-52578"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 22 May 2020 11:14:04 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 337272
X-Proxy-Cache: MISS

GET
BLOB 200
OK 3c82ab30-7e32-421e-a928-a8b39f91fa34
https://threatpost.com/ Frame 99C2 63 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://threatpost.com/3c82ab30-7e32-421e-a928-a8b39f91fa34
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length: 64352
Content-Type: text/javascript

GET
H2 200 bl-2a28c82-ab6585a5.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 195F 98 KB
41 KB 29ms
28ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-2a28c82-ab6585a5.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7160807a4aabc44b02e210d7db4c0da4eecd75df528a951e88b350420a124391

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 13 May 2020 18:54:47 GMT
content-encoding: gzip
age: 145167
x-cache: Hit from cloudfront
status: 200
content-length: 41827
x-amz-meta-git_commit: 2a28c82
last-modified: Wed, 13 May 2020 15:59:59 GMT
server: AmazonS3
etag: "897625fc0340e2aa2beff21c3715c66d"
x-amz-version-id: n6eaLRN_ifGdojH82zaK7hd4tTAVzwBp
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: e596u96ce3eOidFID0hPl0ERgke9sVnFRavOU4G-B9l3du7EXoBtuw==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 195F 36 KB
13 KB 25ms
24ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 667a53e3145f4c8b641a886082ce900423662980c5fe3d784383c3d481de2320

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 10 May 2020 07:31:34 GMT
content-encoding: gzip
age: 445360
x-cache: Hit from cloudfront
status: 200
content-length: 12549
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:15:52 GMT
server: AmazonS3
etag: "17acdbb1a7a117b8f53f3f84e0db205b"
x-amz-version-id: HwMWPPcis1b0hnhKcUJr6rhRxxqLZtvX
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: aniObL_XAsIXJpPC3YJH22MGvD0UzZCOKsxrrji6l2xIVLEifQkA7w==

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012005012256000/ 21 KB
8 KB 86ms
43ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0517f76184f899b738515a124efe8f335f585847387b8889dfa7c0fb132f75a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2534
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7437
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 10:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1b9b229ae83eaa45"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 10:31:59 GMT

GET
H2 200 bl-2a28c82-ab6585a5.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame D56D 98 KB
41 KB 27ms
26ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-2a28c82-ab6585a5.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7160807a4aabc44b02e210d7db4c0da4eecd75df528a951e88b350420a124391

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 13 May 2020 18:54:47 GMT
content-encoding: gzip
age: 145167
x-cache: Hit from cloudfront
status: 200
content-length: 41827
x-amz-meta-git_commit: 2a28c82
last-modified: Wed, 13 May 2020 15:59:59 GMT
server: AmazonS3
etag: "897625fc0340e2aa2beff21c3715c66d"
x-amz-version-id: n6eaLRN_ifGdojH82zaK7hd4tTAVzwBp
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: d01xY9BmcNZb5AcOb404E7gEaTRQXpDcb62reU_QX96buJQR5Uh75A==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame D56D 36 KB
13 KB 30ms
29ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 667a53e3145f4c8b641a886082ce900423662980c5fe3d784383c3d481de2320

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 10 May 2020 07:31:34 GMT
content-encoding: gzip
age: 445360
x-cache: Hit from cloudfront
status: 200
content-length: 12549
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:15:52 GMT
server: AmazonS3
etag: "17acdbb1a7a117b8f53f3f84e0db205b"
x-amz-version-id: HwMWPPcis1b0hnhKcUJr6rhRxxqLZtvX
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: u73P59u_uyso47v1JRpx_AG0KpnQrDsgzjr4-meuGWK-cy0mQPUUFg==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D56D 107 KB
38 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f1615095a9e662d58ed44a7fc6c80c04b642ee9122a037e620680008463b3e68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 39297
x-xss-protection: 0
server: cafe
etag: 18167252803202742783
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 15 May 2020 11:14:13 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame D56D 74 KB
28 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b03b538a0dda03d3015cf894f7bc9c03ab483d21ed9d9525e79a47c3359effa6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589369616634380"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28340
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:13 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df4b376fc112266e6f1854609311b809452d452ecead88a1689693f8c2af84e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589369616634380"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27726
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:13 GMT

GET
H2 200 bl-2a28c82-ab6585a5.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame AAC5 98 KB
41 KB 24ms
23ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-2a28c82-ab6585a5.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7160807a4aabc44b02e210d7db4c0da4eecd75df528a951e88b350420a124391

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 13 May 2020 18:54:47 GMT
content-encoding: gzip
age: 145167
x-cache: Hit from cloudfront
status: 200
content-length: 41827
x-amz-meta-git_commit: 2a28c82
last-modified: Wed, 13 May 2020 15:59:59 GMT
server: AmazonS3
etag: "897625fc0340e2aa2beff21c3715c66d"
x-amz-version-id: n6eaLRN_ifGdojH82zaK7hd4tTAVzwBp
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Y9GUWnWNg7IQHMFY8KuClotHrAWyCQe3dsFbGF9CYBtBRmQ3YngeVA==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame AAC5 36 KB
13 KB 27ms
26ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 667a53e3145f4c8b641a886082ce900423662980c5fe3d784383c3d481de2320

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 10 May 2020 07:31:34 GMT
content-encoding: gzip
age: 445360
x-cache: Hit from cloudfront
status: 200
content-length: 12549
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:15:52 GMT
server: AmazonS3
etag: "17acdbb1a7a117b8f53f3f84e0db205b"
x-amz-version-id: HwMWPPcis1b0hnhKcUJr6rhRxxqLZtvX
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: CLHfInFE1__j68NMz-0meiWgJln_fPMWCrdQbVg4KDhLGe1h2_2MXQ==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame AAC5 107 KB
38 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f1615095a9e662d58ed44a7fc6c80c04b642ee9122a037e620680008463b3e68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 39297
x-xss-protection: 0
server: cafe
etag: 18167252803202742783
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 15 May 2020 11:14:13 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame AAC5 74 KB
28 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b03b538a0dda03d3015cf894f7bc9c03ab483d21ed9d9525e79a47c3359effa6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589369616634380"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28340
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:13 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
55 B 15ms
14ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&pvsid=3759877639605714&r=300x250%7C336x280&w=336&h=280&a=0

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bl-2a28c82-ab6585a5.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 4DE1 98 KB
41 KB 27ms
25ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-2a28c82-ab6585a5.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7160807a4aabc44b02e210d7db4c0da4eecd75df528a951e88b350420a124391

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 13 May 2020 18:54:47 GMT
content-encoding: gzip
age: 145167
x-cache: Hit from cloudfront
status: 200
content-length: 41827
x-amz-meta-git_commit: 2a28c82
last-modified: Wed, 13 May 2020 15:59:59 GMT
server: AmazonS3
etag: "897625fc0340e2aa2beff21c3715c66d"
x-amz-version-id: n6eaLRN_ifGdojH82zaK7hd4tTAVzwBp
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 3K9kFp6VEOraTXjrTQYyDITv-cvZro01j294NzMSzUHCi3f1hmjrYA==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 4DE1 36 KB
13 KB 24ms
22ms Script
application/javascript 52.222.182.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-71.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 667a53e3145f4c8b641a886082ce900423662980c5fe3d784383c3d481de2320

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 10 May 2020 07:31:34 GMT
content-encoding: gzip
age: 445360
x-cache: Hit from cloudfront
status: 200
content-length: 12549
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:15:52 GMT
server: AmazonS3
etag: "17acdbb1a7a117b8f53f3f84e0db205b"
x-amz-version-id: HwMWPPcis1b0hnhKcUJr6rhRxxqLZtvX
via: 1.1 19c54bffe8b0bb7f9e7501fa2c823262.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: ojMqvi66pzvtEgvkK0E8iZpuNos3cELF1O8WNXmCKn8jfkyPlSTd1A==

GET
H2

200

pd
u.openx.net/w/1.0/ Frame 3DA7
Redirect Chain

https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent=
https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=

0
0

24ms
24ms

Document
text/html

34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.186.1 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=b3d35457-8bad-4747-8359-bfbbd069e64d|1589541253
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=b3d35457-8bad-4747-8359-bfbbd069e64d|1589541253; Version=1; Expires=Sat, 15-May-2021 11:14:13 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1589541253|mOgikimWiygu; Version=1; Expires=Sat, 30-May-2020 11:14:13 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.186.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 15 May 2020 11:14:13 GMT
content-type: text/html
content-length: 375
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

status: 302
set-cookie: i=b3d35457-8bad-4747-8359-bfbbd069e64d|1589541253; Version=1; Expires=Sat, 15-May-2021 11:14:13 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.186.1
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
date: Fri, 15 May 2020 11:14:13 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 4091 0
0 85ms
85ms Document
text/html 72.247.225.32
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.32 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-32.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

Last-Modified: Tue, 14 Apr 2020 10:27:52 GMT
ETag: "13006b6-a4bb-5a33da6f1a023"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 15243
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=134875
Expires: Sun, 17 May 2020 00:42:08 GMT
Date: Fri, 15 May 2020 11:14:13 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame CACE 0
0 1111ms
23ms Document
text/html 72.247.225.17
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.17 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-17.deploy.static.akamaitechnologies.com
Software: nginx/1.9.13 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.9.13
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Sat, 15 May 2021 11:14:14 GMT
Date: Fri, 15 May 2020 11:14:14 GMT
Connection: keep-alive

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 636C 0
0 1398ms
117ms Document
text/html 104.111.230.142
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 13 May 2020 23:08:00 GMT
Content-Encoding: gzip
Content-Length: 9162
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=79063
Expires: Sat, 16 May 2020 09:11:57 GMT
Date: Fri, 15 May 2020 11:14:14 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 6591 0
0 106ms
27ms Document
text/html 72.247.225.32
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.32 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-32.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

Last-Modified: Tue, 14 Apr 2020 10:27:52 GMT
ETag: "13006b6-a4bb-5a33da6f1a023"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 15243
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=134875
Expires: Sun, 17 May 2020 00:42:08 GMT
Date: Fri, 15 May 2020 11:14:13 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

204

sync
pixel.advertising.com/ups/55953/ Frame 99C2
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=2ad09b6a-0713-4b00-8b5e-169bb78abc89&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2ad09b6a-0713-4b00-8b5e-169bb78abc89

0
124 B

87ms
30ms

Image
text/plain

52.58.138.174
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55953/sync?uid=2ad09b6a-0713-4b00-8b5e-169bb78abc89&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2ad09b6a-0713-4b00-8b5e-169bb78abc89

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.138.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-58-138-174.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Fri, 15 May 2020 11:14:14 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:13 GMT
x-aspnet-version: 4.0.30319
status: 302
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.advertising.com/ups/55953/sync?uid=2ad09b6a-0713-4b00-8b5e-169bb78abc89&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2ad09b6a-0713-4b00-8b5e-169bb78abc89
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 369

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame 99C2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEAoWKnKwhY9WTCgnUpuFwTI&google_cver=1
https://pixel.advertising.com/ups/57304/sync?uid=CAESEAoWKnKwhY9WTCgnUpuFwTI&google_cver=1&verify=true
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEAoWKnKwhY9WTCgnUpuFwTI&google_cver=1&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e

0
1 KB

131ms
34ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEAoWKnKwhY9WTCgnUpuFwTI&google_cver=1&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:14 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 15 May 2020 11:14:14 GMT
location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEAoWKnKwhY9WTCgnUpuFwTI&google_cver=1&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

410
Gone

sync
sync.adaptv.advertising.com/ Frame 99C2
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=Xr55iAAAAGTkmiTo
https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=Xr55iAAAAGTkmiTo&_test=Xr55iAAAAGTkmiTo
https://sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=Xr55iAAAAGTkmiTo&_test=Xr55iAAAAGTkmiTo

10 B
118 B

1331ms
109ms

Image
text/plain

35.168.89.112
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=Xr55iAAAAGTkmiTo&_test=Xr55iAAAAGTkmiTo
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.89.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-89-112.compute-1.amazonaws.com
Software: ribs2.0 /
Resource Hash: 42e2bdfb6f2641ab97b6a586c31e591246a5240bc86e504d6ec02c616aeb8e4e

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: ribs2.0
Connection: keep-alive
Content-Length: 10
Content-Type: text/plain

Redirect headers

Location: //sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=Xr55iAAAAGTkmiTo&_test=Xr55iAAAAGTkmiTo
Server: ribs2.0
Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame 99C2 43 B
791 B 190ms
59ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:13 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012005012256000/ Frame 195F 204 KB
57 KB 87ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/
Origin: https://threatpost.com

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1784
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57019
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 10:44:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bf14143de8659308"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 10:44:29 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012005012256000/ Frame 195F 204 KB
56 KB 7ms
4ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4156
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57019
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 10:04:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bf14143de8659308"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 10:04:57 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012005012256000/v0/ Frame 195F 16 KB
6 KB 64ms
57ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6911cdf8bbf72eff1b6ae5fa039c42f4ca431e578f4f657dd29c55a65f85fd22

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 6132
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5877
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 09:32:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "cf1fef681ae7494f"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 09:32:01 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012005012256000/v0/ Frame 195F 98 KB
30 KB 66ms
59ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd0c4ff5bc4e85bcd1ff717afc9d15b8274efe8e644542489bc31fae0346541b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4155
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30100
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 10:04:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "023298bf906f9a2c"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 10:04:58 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012005012256000/v0/ Frame 195F 4 KB
2 KB 65ms
58ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9ff4042daa13aa0766bc4854140f7a2942e4deae37d352a617b95000fa54ba

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 6132
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1637
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 09:32:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "eed6b15e1dd2165d"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 09:32:01 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012005012256000/v0/ Frame 195F 48 KB
15 KB 64ms
57ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2c5d4e6a74355f147e25b3ced1d4a66288eab711d0bd3d449ef056fa777c184

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 6138
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15361
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 09:31:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d0b45204c403cb94"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 09:31:55 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 195F 7 KB
824 B 68ms
61ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d3838febe02ee1538a1336ac01f452a6fe7682106cd21b46cda9c40092c8e3aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 15 May 2020 11:14:13 GMT
server: ESF
date: Fri, 15 May 2020 11:14:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 15 May 2020 11:14:13 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 195F 5 KB
715 B 68ms
61ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 15 May 2020 11:14:13 GMT
server: ESF
date: Fri, 15 May 2020 11:14:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 15 May 2020 11:14:13 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5149606157443036631/ Frame 195F 22 KB
22 KB 66ms
60ms Image
image/jpeg 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5149606157443036631/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qm9aYY9RPrF1XAGv8TqpSbK0LZ58g

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d74e457a64916d38dea5c5abf37912edc03ad078a8d4bd8ef6c6453aa7922f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 23:12:54 GMT
x-content-type-options: nosniff
last-modified: Mon, 02 Mar 2020 11:44:05 GMT
server: sffe
age: 1857679
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22553
x-xss-protection: 0
expires: Fri, 23 Apr 2021 23:12:54 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/16344408416117725935/ Frame 195F 22 KB
22 KB 65ms
59ms Image
image/jpeg 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16344408416117725935/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qkWuI2TFEYcZWpTAMRqava9PUWFDw

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d729a0c4be6a2d1b6cc5f6b99074c6c64bdf695b5c39371e8a69ee111258319a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 14 Apr 2020 08:09:04 GMT
x-content-type-options: nosniff
last-modified: Mon, 02 Mar 2020 11:44:05 GMT
server: sffe
age: 2689509
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22234
x-xss-protection: 0
expires: Wed, 14 Apr 2021 08:09:04 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 195F 0
0 68ms
62ms Image
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CUNJshHm-Xq7ULeOT7_UPq7mZsAHC-6HRXMuy1LCSC_uK9P0IEAEg0YfSIGCRjKCFjBigAczyx90DyAEGqQJeh_4lS197PuACAKgDAcgDCqoEmAJP0OmLN_kI0kIcAL-24lJOjyTIvZ0aoBcpEacEY1m9dIPlbJLNE3ypQ_ahk4JUim7f4SCJx6BEvVs70rNGUgtFjovxILhka_V1odJg2u4r-tS1xp9ymKBuERHsdG7DMArDiW0y3qpIKMQuNJA0-AVPphyRIj5akEhydiDFfu4sKKIrxccSLnUVy8Eye7dBn3tn0GsyI7yMXP3f_9MCvKspYvMBHYQ3X4N2hpz6ztCiFgk7qU3WUOOAIazVK2ZVylWTpmEu6YBZjFsz7WM3JAglGWxOHriLXXuuRBOZ6g_gkO6qQmq8VuJ5YqtaXun30nzpobq9tvK26KocF5lyLmaw4kMCIZpR00gvhKziYV5vOw-QW7N6BqWVwASCjOym7QLgBAGgBjeAB5yNuCKoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQxt4N0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi03MjYzNTczNDQ2ODA0MDc4gAoDyAsB2BMD&sigh=e4bMDyYLfkU&template_id=492&tpd=AGWhJmszK5BxHJz5c_A7ntBL6HWX9gxtguJB8Lp8FAoSdKBqkg
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s21-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 195F 2 KB
3 KB 63ms
59ms Image
image/png 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 315
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 16 May 2020 11:08:58 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 195F 295 B
405 B 62ms
59ms Image
image/png 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 14 May 2020 22:24:17 GMT
x-content-type-options: nosniff
server: cafe
age: 46196
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 15 May 2020 22:24:17 GMT

GET
DATA 200
OK truncated
/ Frame 195F 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7c35117ef26eb99432f5e54ca8f8dfe9e2d86ed32bf784f00d96205716d7595

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame D56D 0
0 31ms
31ms Fetch
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuUnEtanawQNpWvEfTkc7Syog-FVs5zGMigmAZn8h3zEY42EJF0VmWkt9lkpRbGSQl8trK5rXagUOo0Nq61DaZkZmoFvs4XFK_jX9DyZpoXUWzuwAOR03gX9qrXpvtQ7AIxRmbJ_AHQrYMRmYqYEkWFgwu0fP5IZmANeKRpDaoHAAMrCbLhcvBOZyiOKZNeqgPTpju3LdkmhpY3bHQk1jjVVQ5oIM72f7YnMMsuMvA74KhPjJrpcZxbAbmzmyfODWURwNHQYAChYwEbYJoGxVcy9QWC&sai=AMfl-YTfIlot393Wte7t1fcNVx4ohvdcFt2Ppv3_15PoPXatIBaQGCQTTPNpsaaItmrCRDCayZ1CtBPd7VY5bWsG1fWWjl13uNx7B1dWS64a6Q&sig=Cg0ArKJSzIRycQsjNOCIEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:13 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D56D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be6503a92da54da09dac6f101ea8b77dca074ef439b2b1370c71a9f239f2d7b3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame AAC5 43 B
472 B 489ms
410ms Other
image/gif 52.222.190.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=0&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vbWljcm9zb2Z0LW9uZW5vdGUtc2lkZXN0ZXAtcGhpc2hpbmctZGV0ZWN0aW9uLzE1MzQzNi8iLCJhZFVuaXQiOiIvMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC0zMDB4NjAwLUFURl8wIiwiYWRTZXJ2ZXJEZXRhaWxzIjp7ImFkdmVydGlzZXJJZCI6IjQ3OTgyNTUxNjciLCJjYW1wYWlnbklkIjoiMjYwODk3Mjc1NCIsImNyZWF0aXZlSWQiOiIxMzgyOTAxNjI2MzciLCJsaW5laXRlbUlkIjoiNTE5Mjc3MDI3OSIsImFkU2VydmVyIjoiZGZwIn0sIndpZHRoIjozMDAsImhlaWdodCI6MjUwLCJ3diI6IjEuMC4wKzBkNGRmY2IiLCJidiI6IjEuMC4wKzBkNGRmY2IiLCJ0YWdNYXJrdXAiOiI8aHRtbD48aGVhZD48c2NyaXB0IHNyYz1cImh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2JsLTJhMjhjODItYWI2NTg1YTUuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMtdGhyZWF0cG9zdC9iLTBkNGRmY2IuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdD53aW5kb3dbXCI3Mjg0MzQxNl9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXSA9IHdpbmRvd1tcIjcyODQzNDE2X21hdGgtYWlkcy10aHJlYXRwb3N0XCJdIHx8IHt9O3dpbmRvd1tcIjcyODQzNDE2X21hdGgtYWlkcy10aHJlYXRwb3N0XCJdLnRhZ0RldGFpbHMgPSB3aW5kb3dbXCI3Mjg0MzQxNl9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXS50YWdEZXRhaWxzIHx8IHtcInNpdGVJZFwiOlwibWF0aC1haWRzLXRocmVhdHBvc3RcIixcInd2XCI6XCIxLjAuMCswZDRkZmNiXCIsXCJ0b3BEb21haW5cIjpcImh0dHBzOi8vdGhyZWF0cG9zdC5jb20vbWljcm9zb2Z0LW9uZW5vdGUtc2lkZXN0ZXAtcGhpc2hpbmctZGV0ZWN0aW9uLzE1MzQzNi9cIixcImN1cnJlbnRUYWdJZFwiOlwiYWRsdGFnX2thODN0a21jX3h2RDJPVjE0Q1BGXCIsXCJhdVwiOlwiLzIxNzA3MTI0MzM2L1RocmVhdFBvc3QtMzAweDYwMC1BVEZfMFwiLFwiYWRTZXJ2ZXJEZXRhaWxzXCI6e1wiYWR2ZXJ0aXNlcklkXCI6XCI0Nzk4MjU1MTY3XCIsXCJjYW1wYWlnbklkXCI6XCIyNjA4OTcyNzU0XCIsXCJjcmVhdGl2ZUlkXCI6XCIxMzgyOTAxNjI2MzdcIixcImxpbmVpdGVtSWRcIjpcIjUxOTI3NzAyNzlcIixcImFkU2VydmVyXCI6XCJkZnBcIn0sXCJ3XCI6MzAwLFwiaFwiOjI1MH07d2luZG93LmJsb2NrZXIgJiYgYmxvY2tlcihcIjcyODQzNDE2X21hdGgtYWlkcy10aHJlYXRwb3N0XCIsIFwiPCEtLUFETF9XUkFQUEVELS0%2BXCIsIGZhbHNlLCB3aW5kb3csIHt9KTs8L3NjcmlwdD48L2hlYWQ%2BPC9odG1sPjwhLS0gSUZSQU1FIElOTkVSIENPTlRFTlQgLS0%2BIiwibWV0YSI6eyJwbFJhdGlvIjowLjAxfX0%3D&i=1-1&t=adltag_ka83tkmc_xvD2OV14CPF&r=51fdcf690a71f54a248cf6807b3a3a8&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.73 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-73.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
via: 1.1 a0c82b0230a7e14a68e3ce4ae3eed807.cloudfront.net (CloudFront)
etag: "6b7395c9201aa64331475fddd24d987c"
x-amz-cf-pop: HAM50-C2
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
date: Fri, 15 May 2020 11:14:15 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: 54OtaTyCeoabU3WGQR6lXltkGbaQLxDqrE3_zrknLhujYTRu5LoG0Q==

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame AAC5 0
0 72ms
72ms Fetch
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvJGCt_XimwqxvkFhOgf4SARDsl8jFnCfCJLaFT_1c76k0VX7__DfYSCzVxR9BB3CaDVS7z6jVsVwHp4VIubJzV3SHUrv9V0-olF6Tlpajw7lpPA-_77r1XcVP6o66MHO1zVwnGx3Ey3fTiR-wzXm2_oCeHciRp8zp1lpNzoDaFcTWbHmcZ-1LTUrE8Vo64plcLtdmk2Ton5reNulGEyvIiV2JyOb_2mcuOS_4YFQGNQe8ujZpqfzPwWwj8Ug-o54YjnpaldSQFnn791Tkz1dTyWzC6&sai=AMfl-YRjeuIWSZCrEdnGCXBacLumTdfDkzCIUv2VcVABN5DbNJY2mVz2ersPcHv9thPQXmM5mHnRMo_4lnTIQ8qe6Ayyw8nhz4zt8sQuahSsBQ&sig=Cg0ArKJSzEJwBwAF-VgUEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:13 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame AAC5 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 114f79946e5cf32cb0c84679a086a21148e2f29d72940b87d165b03d200de97f

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame D56D 109 B
168 B 14ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame D56D 109 B
168 B 15ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200511/r20190131/ Frame D56D 218 KB
82 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200511/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecb531bdf231039081a7a6879d73bca91d8b8c7fc671615063746454c0daaa8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 84031
x-xss-protection: 0
server: cafe
etag: 11558267481566639666
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 May 2020 11:14:13 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200511/r20190131/ Frame 195A 0
0 6ms
6ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200511/r20190131/zrt_lookup.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200511/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnREYt80Lor7yu9-5JgmrAybJBZsuIrYi1O81x0nDwhNtbDFHJxNrI7V-T_
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Tue, 12 May 2020 04:34:05 GMT
expires: Tue, 26 May 2020 04:34:05 GMT
content-type: text/html; charset=UTF-8
etag: 4094386822458569044
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4444
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 283208
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame AAC5 109 B
168 B 14ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame AAC5 109 B
168 B 17ms
17ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200511/r20190131/ Frame AAC5 218 KB
82 KB 72ms
72ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200511/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecb531bdf231039081a7a6879d73bca91d8b8c7fc671615063746454c0daaa8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 84031
x-xss-protection: 0
server: cafe
etag: 11558267481566639666
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 May 2020 11:14:13 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 195F 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
Origin: https://threatpost.com

Response headers

date: Fri, 08 May 2020 19:19:05 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 575708
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Sat, 08 May 2021 19:19:05 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 195F 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
Origin: https://threatpost.com

Response headers

date: Wed, 13 May 2020 03:42:23 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 199910
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Thu, 13 May 2021 03:42:23 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012005012256000/ Frame 4DE1 204 KB
56 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Origin: https://threatpost.com

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1784
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57019
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 10:44:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bf14143de8659308"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 10:44:29 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012005012256000/ Frame 4DE1 204 KB
56 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4156
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57019
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 10:04:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bf14143de8659308"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 10:04:57 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012005012256000/v0/ Frame 4DE1 98 KB
29 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012005012256000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd0c4ff5bc4e85bcd1ff717afc9d15b8274efe8e644542489bc31fae0346541b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4155
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30100
x-xss-protection: 0
server: sffe
date: Fri, 15 May 2020 10:04:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "023298bf906f9a2c"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 May 2021 10:04:58 GMT

GET
H2 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 4DE1 330 B
453 B 8ms
8ms Image
image/png 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 14 Apr 2020 23:20:40 GMT
x-content-type-options: nosniff
age: 2634813
x-dns-prefetch-control: off
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Apr 2021 23:20:40 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4DE1 0
45 B 30ms
30ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvqTS3kl6GZrjXIvIpVxe6Hr711bbzz5H4nAfo2u5jwCe7KxOh5xLXutPwbluwWzy1gMYzlnMKBafdeoFTYaDv6SKPHfqW3dMEzuorLReUYluuMhP1ZlKIvqsicRCZxDQ4YLhWTOHqE5_jENkdOMyjBZ79Y6YHma4EIOXYufitIvHLEIK2gZX2BwK0BPg-N0ICoPtlBZwij2BiY3pWQMmVBJ4ODrDtA4kNCvOtqT_D3MvSRDV4BRmr534Mt5fO6vXAjZ22Gh--0lqvN-SwOFA&sai=AMfl-YTbH9SwJh-tAayVYt6aH-T8DjI3AjfP86QRdLSsR25u2BCULLr883yyuQldzWU2o-af7SgrycqEHY999YTm_jXXYTYPs58-ICl8xFzUMQ&sig=Cg0ArKJSzB--QftWsXO4EAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:13 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4DE1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8bb43ebc332df9ed85f4d8ebca035290d29c9d09dd1dae152e2a1e4f00486865

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 195F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

88ms
88ms

Image
text/html

2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date: Fri, 15 May 2020 11:14:14 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame CF62 0
0 351ms
350ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186313&w=336&psa=0&guci=1.2.0.0.2.2.0.0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1589541253810&bpp=51&bdt=536&idt=550&shv=r20200511&cbv=r20190131&ptt=9&saldr=aa&correlator=6579499086307&frm=23&ife=4&pv=2&ga_vid=210511827.1589541254&ga_sid=1589541254&ga_hid=2033927661&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1057&ady=417&biw=1585&bih=1200&isw=336&ish=280&ifk=4091218536&scr_x=0&scr_y=0&eid=21066085%2C44718965&oid=3&pvsid=465538954321845&pem=952&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.k83hq1vo9kmp&fsb=1&dtd=574

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186313&w=336&psa=0&guci=1.2.0.0.2.2.0.0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1589541253810&bpp=51&bdt=536&idt=550&shv=r20200511&cbv=r20190131&ptt=9&saldr=aa&correlator=6579499086307&frm=23&ife=4&pv=2&ga_vid=210511827.1589541254&ga_sid=1589541254&ga_hid=2033927661&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1057&ady=417&biw=1585&bih=1200&isw=336&ish=280&ifk=4091218536&scr_x=0&scr_y=0&eid=21066085%2C44718965&oid=3&pvsid=465538954321845&pem=952&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.k83hq1vo9kmp&fsb=1&dtd=574
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnREYt80Lor7yu9-5JgmrAybJBZsuIrYi1O81x0nDwhNtbDFHJxNrI7V-T_
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 15 May 2020 11:14:14 GMT
server: cafe
content-length: 19602
x-xss-protection: 0
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame D56D 73 KB
27 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df4b376fc112266e6f1854609311b809452d452ecead88a1689693f8c2af84e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589369616634380"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27726
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:14 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 3D35 0
0 349ms
347ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186312&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1589541253885&bpp=2&bdt=602&idt=515&shv=r20200511&cbv=r20190131&ptt=9&saldr=aa&correlator=6579499086307&frm=23&ife=4&pv=1&ga_vid=984826920.1589541254&ga_sid=1589541254&ga_hid=255358665&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1075&ady=1753&biw=1585&bih=1200&isw=300&ish=600&ifk=2889418091&scr_x=0&scr_y=0&eid=21066085%2C44718965&oid=3&pvsid=1861385180437502&pem=952&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.f04zrv61m7tk&btvi=1&fsb=1&dtd=573

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186312&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1589541253885&bpp=2&bdt=602&idt=515&shv=r20200511&cbv=r20190131&ptt=9&saldr=aa&correlator=6579499086307&frm=23&ife=4&pv=1&ga_vid=984826920.1589541254&ga_sid=1589541254&ga_hid=255358665&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1075&ady=1753&biw=1585&bih=1200&isw=300&ish=600&ifk=2889418091&scr_x=0&scr_y=0&eid=21066085%2C44718965&oid=3&pvsid=1861385180437502&pem=952&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.f04zrv61m7tk&btvi=1&fsb=1&dtd=573
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnREYt80Lor7yu9-5JgmrAybJBZsuIrYi1O81x0nDwhNtbDFHJxNrI7V-T_
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 15 May 2020 11:14:14 GMT
server: cafe
content-length: 19606
x-xss-protection: 0
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame AAC5 73 KB
27 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df4b376fc112266e6f1854609311b809452d452ecead88a1689693f8c2af84e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1589369616634380"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27726
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:14 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5149606157443036631/ Frame 195F 22 KB
22 KB 12ms
6ms Image
image/jpeg 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d74e457a64916d38dea5c5abf37912edc03ad078a8d4bd8ef6c6453aa7922f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 23:12:54 GMT
x-content-type-options: nosniff
last-modified: Mon, 02 Mar 2020 11:44:05 GMT
server: sffe
age: 1857680
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22553
x-xss-protection: 0
expires: Fri, 23 Apr 2021 23:12:54 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/16344408416117725935/ Frame 195F 22 KB
22 KB 13ms
10ms Image
image/jpeg 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d729a0c4be6a2d1b6cc5f6b99074c6c64bdf695b5c39371e8a69ee111258319a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 14 Apr 2020 08:09:04 GMT
x-content-type-options: nosniff
last-modified: Mon, 02 Mar 2020 11:44:05 GMT
server: sffe
age: 2689510
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22234
x-xss-protection: 0
expires: Wed, 14 Apr 2021 08:09:04 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 195F 2 KB
3 KB 11ms
8ms Image
image/png 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 316
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 16 May 2020 11:08:58 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 195F 295 B
364 B 10ms
7ms Image
image/png 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 14 May 2020 22:24:17 GMT
x-content-type-options: nosniff
server: cafe
age: 46197
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 15 May 2020 22:24:17 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame BED3 0
379 B 20ms
19ms Image
text/html 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=36&serverTime=1589541251&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20iosAppIntervalBug%20%2F%202%20%2F%20default&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5ebe798390995&contentFileId=0&mediaPlayListId=0&cbuster=1589541254575&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:13 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H2 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 4DE1 330 B
403 B 10ms
6ms Image
image/png 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 14 Apr 2020 23:20:40 GMT
x-content-type-options: nosniff
age: 2634814
x-dns-prefetch-control: off
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Apr 2021 23:20:40 GMT

GET
H/1.1 200
OK w_640_001.ts Show response
video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/ Frame 99C2 443 KB
444 KB 394ms
393ms XHR
video/mp2t 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/w_640_001.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 3571d689234e34d75e0421120b8542dd1923f968606664d510691f39144094a6

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:06 GMT
Last-Modified: Fri, 08 May 2020 21:38:41 GMT
Server: Tengine
ETag: "5eb5d161-6ecc8"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 22 May 2020 11:14:06 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 453832
X-Proxy-Cache: MISS

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame BED3 0
379 B 18ms
18ms Image
text/html 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=16&serverTime=1589541251&s=0&sta=12348808&x=320&y=180&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20iosAppIntervalBug%20%2F%202%20%2F%20default&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5ebe798390995&contentFileId=789300&mediaPlayListId=5946&playerVer=3.0.0&contentMatchType=&isExcludeFromOpt=0&cbuster=1589541254875&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:13 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D56D 7 KB
6 KB 23ms
22ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200511&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200511/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6711ec4f945f371e30bdb6f1b803d194cddd66b32965dcc1f73884bd2c955c6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5573
x-xss-protection: 0

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame AAC5 43 B
477 B 81ms
79ms Other
image/gif 52.222.190.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vbWljcm9zb2Z0LW9uZW5vdGUtc2lkZXN0ZXAtcGhpc2hpbmctZGV0ZWN0aW9uLzE1MzQzNi8iLCJhZFVuaXQiOiIvMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC0zMDB4NjAwLUFURl8wIiwiYWRTZXJ2ZXJEZXRhaWxzIjp7ImFkdmVydGlzZXJJZCI6IjQ3OTgyNTUxNjciLCJjYW1wYWlnbklkIjoiMjYwODk3Mjc1NCIsImNyZWF0aXZlSWQiOiIxMzgyOTAxNjI2MzciLCJsaW5laXRlbUlkIjoiNTE5Mjc3MDI3OSIsImFkU2VydmVyIjoiZGZwIn0sIndpZHRoIjozMDAsImhlaWdodCI6MjUwLCJ3diI6IjEuMC4wKzBkNGRmY2IiLCJidiI6IjEuMC4wKzBkNGRmY2IiLCJ0YWdNYXJrdXAiOiI8aHRtbD48aGVhZD48c2NyaXB0IHNyYz1cImh0dHBzOi8vd3d3Lmdvb2dsZXRhZ3NlcnZpY2VzLmNvbS9hY3RpdmV2aWV3L2pzL2N1cnJlbnQvb3NkLmpzP2NiPSUyRnIyMDEwMDEwMVwiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvanMvcjIwMjAwNTExL3IyMDE5MDEzMS9zaG93X2Fkc19pbXBsX2Z5MjAxOS5qc1wiIGlkPVwiZ29vZ2xlX3NoaW1wbFwiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYmwtMmEyOGM4Mi1hYjY1ODVhNS5qc1wiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD48c2NyaXB0IHNyYz1cImh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2ItMGQ0ZGZjYi5qc1wiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD48c2NyaXB0PndpbmRvd1tcIjcyODQzNDE2X21hdGgtYWlkcy10aHJlYXRwb3N0XCJdID0gd2luZG93W1wiNzI4NDM0MTZfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0gfHwge307d2luZG93W1wiNzI4NDM0MTZfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0udGFnRGV0YWlscyA9IHdpbmRvd1tcIjcyODQzNDE2X21hdGgtYWlkcy10aHJlYXRwb3N0XCJdLnRhZ0RldGFpbHMgfHwge1wic2l0ZUlkXCI6XCJtYXRoLWFpZHMtdGhyZWF0cG9zdFwiLFwid3ZcIjpcIjEuMC4wKzBkNGRmY2JcIixcInRvcERvbWFpblwiOlwiaHR0cHM6Ly90aHJlYXRwb3N0LmNvbS9taWNyb3NvZnQtb25lbm90ZS1zaWRlc3RlcC1waGlzaGluZy1kZXRlY3Rpb24vMTUzNDM2L1wiLFwiY3VycmVudFRhZ0lkXCI6XCJhZGx0YWdfa2E4M3RrbWNfeHZEMk9WMTRDUEZcIixcImF1XCI6XCIvMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC0zMDB4NjAwLUFURl8wXCIsXCJhZFNlcnZlckRldGFpbHNcIjp7XCJhZHZlcnRpc2VySWRcIjpcIjQ3OTgyNTUxNjdcIixcImNhbXBhaWduSWRcIjpcIjI2MDg5NzI3NTRcIixcImNyZWF0aXZlSWRcIjpcIjEzODI5MDE2MjYzN1wiLFwibGluZWl0ZW1JZFwiOlwiNTE5Mjc3MDI3OVwiLFwiYWRTZXJ2ZXJcIjpcImRmcFwifSxcIndcIjozMDAsXCJoXCI6MjUwfTt3aW5kb3cuYmxvY2tlciAmJiBibG9ja2VyKFwiNzI4NDM0MTZfbWF0aC1haWRzLXRocmVhdHBvc3RcIiwgXCI8IS0tQURMX1dSQVBQRUQtLT5cIiwgZmFsc2UsIHdpbmRvdywge30pOzwvc2NyaXB0PjxzY3JpcHQ%2BdmFyIGluRGFwSUY9dHJ1ZSxpbkdwdElGPXRydWU7PC9zY3JpcHQ%2BPGxpbmsgcmVsPVwicHJlbG9hZFwiIGhyZWY9XCJodHRwczovL2Fkc2VydmljZS5nb29nbGUuZGUvYWRzaWQvaW50ZWdyYXRvci5qcz9kb21haW49dGhyZWF0cG9zdC5jb21cIiBhcz1cInNjcmlwdFwiPjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIHNyYz1cImh0dHBzOi8vYWRzZXJ2aWNlLmdvb2dsZS5kZS9hZHNpZC9pbnRlZ3JhdG9yLmpzP2RvbWFpbj10aHJlYXRwb3N0LmNvbVwiPjwvc2NyaXB0PjxsaW5rIHJlbD1cInByZWxvYWRcIiBocmVmPVwiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbS9hZHNpZC9pbnRlZ3JhdG9yLmpzP2RvbWFpbj10aHJlYXRwb3N0LmNvbVwiIGFzPVwic2NyaXB0XCI%2BPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgc3JjPVwiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbS9hZHNpZC9pbnRlZ3JhdG9yLmpzP2RvbWFpbj10aHJlYXRwb3N0LmNvbVwiPjwvc2NyaXB0PjwvaGVhZD48Ym9keSBsZWZ0bWFyZ2luPVwiMFwiIHRvcG1hcmdpbj1cIjBcIiBtYXJnaW53aWR0aD1cIjBcIiBtYXJnaW5oZWlnaHQ9XCIwXCI%2BPHNjcmlwdD53aW5kb3cuZGljbmYgPSB7fTs8L3NjcmlwdD48c2NyaXB0IGRhdGEtamM9XCI0MlwiIGRhdGEtamMtdmVyc2lvbj1cInIyMDIwMDUxMVwiPihmdW5jdGlvbigpey8qICBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMCAqLyAndXNlIHN0cmljdCc7d2luZG93LnZpZXdSZXE9W107Y29uc3QgYz1hPT57ZmV0Y2goYSx7a2VlcGFsaXZlOiEwLGNyZWRlbnRpYWxzOlwiaW5jbHVkZVwiLHJlZGlyZWN0OlwiZm9sbG93XCIsbWV0aG9kOlwiZ2V0XCIsbW9kZTpcIm5vLWNvcnNcIn0pLmNhdGNoKCgpPT57e2NvbnN0IGI9bmV3IEltYWdlO2Iuc3JjPWEucmVwbGFjZShcIiZhbXA7XCIsXCImXCIpO3ZpZXdSZXEucHVzaChiKX19KX07d2luZG93LnZ1PWE9PntpZih3aW5kb3cuZmV0Y2gpYyhhKTtlbHNle3tjb25zdCBiPW5ldyBJbWFnZTtiLnNyYz1hLnJlcGxhY2UoXCImYW1wO1wiLFwiJlwiKTt2aWV3UmVxLnB1c2goYil9fX07fSkuY2FsbCh0aGlzKTs8L3NjcmlwdD48c2NyaXB0PnZ1KFwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvcGNzL3ZpZXc%2FeGFpXFx4M2RBS0FPanN2SkdDdF9YaW13cXh2a0ZoT2dmNFNBUkRzbDhqRm5DZkNKTGFGVF8xYzc2azBWWDdfX0RmWVNDelZ4UjlCQjNDYURWUzd6NmpWc1Z3SHA0Vkl1Ykp6VjNTSFVydjlWMC1vbEY2VGxwYWp3N2xwUEEtXzc3cjFYY1ZQNm82Nk1ITzF6VnduR3gzRXkzZlRpUi13elhtMl9vQ2VIY2lScDh6cDFscE56b0RhRmNUV2JIbWNaLTFMVFVyRThWbzY0cGxjTHRkbWsyVG9uNXJlTnVsR0V5dklpVjJKeU9iXzJtY3VPU180WUZRR05RZTh1alpwcWZ6UHdXd2o4VWctbzU0WWpucGFsZFNRRm5uNzkxVGt6MWRUeVd6QzZcXHgyNnNhaVxceDNkQU1mbC1ZUmpldUlXU1pDckVkbkdDWEJhY0x1bVRkZkRrekNJVXYyVmNWQUJONURiTkpZMm1WejJlcnNQY0h2OXRoUFFYbU01bUhuUk1vXzRsblRJUThxZTZBeXl3OG5oejR6dDhzUXVhaFNzQlFcXHgyNnNpZ1xceDNkQ2cwQXJLSlN6RUp3QndBRi1WZ1VFQUVcXHgyNnVybGZpeFxceDNkMVxceDI2YWR1cmxcXHgzZFwiKTwvc2NyaXB0PjxkaXYgY2xhc3M9XCJHb29nbGVBY3RpdmVWaWV3SW5uZXJDb250YWluZXJcIiBzdHlsZT1cImxlZnQ6MHB4O3RvcDowcHg7d2lkdGg6MTAwJTtoZWlnaHQ6MTAwJTtwb3NpdGlvbjpmaXhlZDtwb2ludGVyLWV2ZW50czpub25lO3otaW5kZXg6LTk5OTk7XCI%2BPC9kaXY%2BPGRpdiBzdHlsZT1cImRpc3BsYXk6aW5saW5lXCIgY2xhc3M9XCJHb29nbGVBY3RpdmVWaWV3RWxlbWVudFwiIGRhdGEtZ29vZ2xlLWF2LWN4bj1cImh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGNzL2FjdGl2ZXZpZXc%2FeGFpPUFLQU9qc3VtOEUweGQ3eXRlYzlxSmp0ZVJyM0VrNXd1eXlpZkdOSnRjUmQzTV82Vk1vZTBFVXgxRTVwUzVMQzJ6V24yVXRWR3FrQkRtV2t2Y1E3N293MTBFZm1FcDYxS0YtZDhHUVpCWVR1aXhWRSZhbXA7c2lnPUNnMEFyS0pTek95XzZOVkdEdUtqRUFFXCIgZGF0YS1nb29nbGUtYXYtYWRrPVwiMzc1Mzg5ODEyXCIgZGF0YS1nb29nbGUtYXYtbWV0YWRhdGE9XCJsYT0wJmFtcDt4ZGk9MCZhbXA7XCIgZGF0YS1nb29nbGUtYXYtb3ZlcnJpZGU9XCItMVwiIGRhdGEtZ29vZ2xlLWF2LWRtPVwiMlwiIGRhdGEtZ29vZ2xlLWF2LWltbWVkaWF0ZT1cIlwiIGRhdGEtZ29vZ2xlLWF2LWFpZD1cIjBcIiBkYXRhLWdvb2dsZS1hdi1uYWlkPVwiMVwiIGRhdGEtZ29vZ2xlLWF2LXNsaWZ0PVwiXCIgZGF0YS1nb29nbGUtYXYtY3BtYXY9XCJcIiBkYXRhLWdvb2dsZS1hdi1idHI9XCJcIiBkYXRhLWdvb2dsZS1hdi1pdHBsPVwiMTlcIiBkYXRhLWdvb2dsZS1hdi1ycz1cIjRcIj48c2NyaXB0IGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvanMvYWRzYnlnb29nbGUuanNcIj48L3NjcmlwdD5cbjwhLS0gMzAweDYwMC1BVEYgLS0%2BXG48aW5zIGNsYXNzPVwiYWRzYnlnb29nbGVcIiBzdHlsZT1cImRpc3BsYXk6aW5saW5lLWJsb2NrO3dpZHRoOjMwMHB4O2hlaWdodDo2MDBweFwiIGRhdGEtYWQtY2xpZW50PVwiY2EtcHViLTc1MDA1OTMyMzY3MDczMjVcIiBkYXRhLWFkLXNsb3Q9XCI3Nzg1NjUyNzY2XCIgZGF0YS1hZHNieWdvb2dsZS1zdGF0dXM9XCJkb25lXCI%2BPGlucyBpZD1cImFzd2lmdF8wX2V4cGFuZFwiIHN0eWxlPVwiZGlzcGxheTppbmxpbmUtdGFibGU7Ym9yZGVyOm5vbmU7aGVpZ2h0OjYwMHB4O21hcmdpbjowO3BhZGRpbmc6MDtwb3NpdGlvbjpyZWxhdGl2ZTt2aXNpYmlsaXR5OnZpc2libGU7d2lkdGg6MzAwcHg7YmFja2dyb3VuZC1jb2xvcjp0cmFuc3BhcmVudDtcIj48aW5zIGlkPVwiYXN3aWZ0XzBfYW5jaG9yXCIgc3R5bGU9XCJkaXNwbGF5OmJsb2NrO2JvcmRlcjpub25lO2hlaWdodDo2MDBweDttYXJnaW46MDtwYWRkaW5nOjA7cG9zaXRpb246cmVsYXRpdmU7dmlzaWJpbGl0eTp2aXNpYmxlO3dpZHRoOjMwMHB4O2JhY2tncm91bmQtY29sb3I6dHJhbnNwYXJlbnQ7XCI%2BPGlmcmFtZSBpZD1cImFzd2lmdF8wXCIgbmFtZT1cImFzd2lmdF8wXCIgc3R5bGU9XCJsZWZ0OjA7cG9zaXRpb246YWJzb2x1dGU7dG9wOjA7Ym9yZGVyOjA7d2lkdGg6MzAwcHg7aGVpZ2h0OjYwMHB4O1wiIHNhbmRib3g9XCJhbGxvdy1mb3JtcyBhbGxvdy1wb2ludGVyLWxvY2sgYWxsb3ctcG9wdXBzIGFsbG93LXBvcHVwcy10by1lc2NhcGUtc2FuZGJveCBhbGxvdy1zYW1lLW9yaWdpbiBhbGxvdy1zY3JpcHRzIGFsbG93LXRvcC1uYXZpZ2F0aW9uLWJ5LXVzZXItYWN0aXZhdGlvblwiIHdpZHRoPVwiMzAwXCIgaGVpZ2h0PVwiNjAwXCIgZnJhbWVib3JkZXI9XCIwXCIgc3JjPVwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2Fkcz9jbGllbnQ9Y2EtcHViLTc1MDA1OTMyMzY3MDczMjUmYW1wO291dHB1dD1odG1sJmFtcDtoPTYwMCZhbXA7c2xvdG5hbWU9Nzc4NTY1Mjc2NiZhbXA7YWRrPTIyNDg4MTAzNjUmYW1wO2FkZj03NzYxODYzMTImYW1wO3c9MzAwJmFtcDtwc2E9MCZhbXA7Z3VjaT0xLjIuMC4wLjIuMi4wLjAmYW1wO2Zvcm1hdD0zMDB4NjAwJmFtcDt1cmw9aHR0cHMlM0ElMkYlMkZ0aHJlYXRwb3N0LmNvbSUyRm1pY3Jvc29mdC1vbmVub3RlLXNpZGVzdGVwLXBoaXNoaW5nLWRldGVjdGlvbiUyRjE1MzQzNiUyRiZhbXA7ZWE9MCZhbXA7Zmxhc2g9MCZhbXA7d2dsPTEmYW1wO2Fkc2lkPU5UJmFtcDtkdD0xNTg5NTQxMjUzODg1JmFtcDticHA9MiZhbXA7YmR0PTYwMiZhbXA7aWR0PTUxNSZhbXA7c2h2PXIyMDIwMDUxMSZhbXA7Y2J2PXIyMDE5MDEzMSZhbXA7cHR0PTkmYW1wO3NhbGRyPWFhJmFtcDtjb3JyZWxhdG9yPTY1Nzk0OTkwODYzMDcmYW1wO2ZybT0yMyZhbXA7aWZlPTQmYW1wO3B2PTEmYW1wO2dhX3ZpZD05ODQ4MjY5MjAuMTU4OTU0MTI1NCZhbXA7Z2Ffc2lkPTE1ODk1NDEyNTQmYW1wO2dhX2hpZD0yNTUzNTg2NjUmYW1wO2dhX2ZjPTAmYW1wO2lhZz0zJmFtcDtpY3NnPTgzNjImYW1wO25oZD0xJmFtcDtkc3N6PTE0JmFtcDttZG89MCZhbXA7bXNvPTAmYW1wO3VfdHo9MTIwJmFtcDt1X2hpcz0yJmFtcDt1X2phdmE9MCZhbXA7dV9oPTEyMDAmYW1wO3Vfdz0xNjAwJmFtcDt1X2FoPTEyMDAmYW1wO3VfYXc9MTYwMCZhbXA7dV9jZD0yNCZhbXA7dV9ucGx1Zz0wJmFtcDt1X25taW1lPTAmYW1wO2FkeD0xMDc1JmFtcDthZH&i=1-2&t=adltag_ka83tkmc_xvD2OV14CPF&r=5a5152b73e3312dad5e8651dade1962&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.73 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-73.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
via: 1.1 a0c82b0230a7e14a68e3ce4ae3eed807.cloudfront.net (CloudFront)
etag: "6b7395c9201aa64331475fddd24d987c"
age: 1
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
date: Fri, 15 May 2020 11:14:15 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: UbDQzHRBoznJMic8QcfOe0J9bQA33lp2v_4jMxgYc0ujJEAt7D9qtA==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame AAC5 43 B
478 B 80ms
79ms Other
image/gif 52.222.190.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=k9MTc1MyZhbXA7Yml3PTE1ODUmYW1wO2JpaD0xMjAwJmFtcDtpc3c9MzAwJmFtcDtpc2g9NjAwJmFtcDtpZms9Mjg4OTQxODA5MSZhbXA7c2NyX3g9MCZhbXA7c2NyX3k9MCZhbXA7ZWlkPTIxMDY2MDg1JTJDNDQ3MTg5NjUmYW1wO29pZD0zJmFtcDtwdnNpZD0xODYxMzg1MTgwNDM3NTAyJmFtcDtwZW09OTUyJmFtcDtyeD0wJmFtcDtlYWU9MiZhbXA7ZmM9NjQwJmFtcDticmRpbT0wJTJDMCUyQzAlMkMwJTJDMTYwMCUyQzAlMkMxNjAwJTJDMTIwMCUyQzMwMCUyQzYwMCZhbXA7dmlzPTEmYW1wO3Jzej0lN0MlN0NlRWJyJTdDJmFtcDthYmw9Q1MmYW1wO3BmeD0wJmFtcDtmdT04MjEyJmFtcDtiYz0zMSZhbXA7aWZpPTEmYW1wO3VjaT0xLmYwNHpydjYxbTd0ayZhbXA7YnR2aT0xJmFtcDtmc2I9MSZhbXA7ZHRkPTU3M1wiIG1hcmdpbndpZHRoPVwiMFwiIG1hcmdpbmhlaWdodD1cIjBcIiB2c3BhY2U9XCIwXCIgaHNwYWNlPVwiMFwiIGFsbG93dHJhbnNwYXJlbmN5PVwidHJ1ZVwiIHNjcm9sbGluZz1cIm5vXCIgYWxsb3dmdWxsc2NyZWVuPVwidHJ1ZVwiIGRhdGEtZ29vZ2xlLWNvbnRhaW5lci1pZD1cIjEuZjA0enJ2NjFtN3RrXCIgZGF0YS1nb29nbGUtcXVlcnktaWQ9XCJDT3oxME03ZXRla0NGYW5hdXdnZFVkWVB3Z1wiIGRhdGEtbG9hZC1jb21wbGV0ZT1cInRydWVcIj48L2lmcmFtZT48L2lucz48L2lucz48L2lucz5cbjxzY3JpcHQ%2BXG4gICAgIChhZHNieWdvb2dsZSA9IHdpbmRvdy5hZHNieWdvb2dsZSB8fCBbXSkucHVzaCh7fSk7XG48L3NjcmlwdD48L2Rpdj48c2NyaXB0IHNyYz1cImh0dHBzOi8vd3d3Lmdvb2dsZXRhZ3NlcnZpY2VzLmNvbS9hY3RpdmV2aWV3L2pzL2N1cnJlbnQvb3NkX2xpc3RlbmVyLmpzP2NhY2hlPXIyMDExMDkxNFwiPjwvc2NyaXB0PjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPm9zZGxmbSgtMSwnJywnQjBlMUJoSG0tWHBqSExPT1Q3X1VQcTdtWnNBRUFBQUFBRUFFNEFjZ0JDY0FDQXVBQ0FPQUVBYUFHRnRJSUJ3aUE0WUFRRUFFJywnJywzNzUzODk4MTIsdHJ1ZSwnbGFcXHgzZDBcXHgyNnhkaVxceDNkMFxceDI2JywzLCdDQUFTQk9SbzJVcycsJ2h0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGNzL2FjdGl2ZXZpZXc%2FeGFpXFx4M2RBS0FPanN1bThFMHhkN3l0ZWM5cUpqdGVScjNFazV3dXl5aWZHTkp0Y1JkM01fNlZNb2UwRVV4MUU1cFM1TEMyelduMlV0Vkdxa0JEbVdrdmNRNzdvdzEwRWZtRXA2MUtGLWQ4R1FaQllUdWl4VkVcXHgyNnNpZ1xceDNkQ2cwQXJLSlN6T3lfNk5WR0R1S2pFQUUnLCcnKTs8L3NjcmlwdD48ZGl2IHN0eWxlPVwiYm90dG9tOjA7cmlnaHQ6MDt3aWR0aDozMDBweDtoZWlnaHQ6NjAwcHg7YmFja2dyb3VuZDppbml0aWFsICFpbXBvcnRhbnQ7cG9zaXRpb246YWJzb2x1dGUgIWltcG9ydGFudDttYXgtd2lkdGg6MTAwJSAhaW1wb3J0YW50O21heC1oZWlnaHQ6MTAwJSAhaW1wb3J0YW50O3BvaW50ZXItZXZlbnRzOm5vbmUgIWltcG9ydGFudDtpbWFnZS1yZW5kZXJpbmc6cGl4ZWxhdGVkICFpbXBvcnRhbnQ7ei1pbmRleDoyMTQ3NDgzNjQ3O2JhY2tncm91bmQtaW1hZ2U6dXJsKCdkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUNzQUFBQVdCQU1BQUFDcmwzaUFBQUFBQmxCTVZFVUFBQUQrQWNpV21aeldBQUFBQW5SU1RsTUFBcGlkckJRQUFBQitTVVJCVkJqVGJaQlpEZ1JCQ0VMeEJ0ei90QlBCcmJ1blBxeVFnRDRGL3Ivdyt5aEtNMzl5VktRRHNiK3FmSGJSR2F2amVyblJHYTdxMmRQL2NObVJKTXVkcmRJd25XWFc0QUZoN1JEbFZLeWkxUk84ekwycUU3YzhTV3BTWnBmYkNFTXkxS2plY3AvNTdiNFhORW52c0RmcjBQdUNBcUVQY3k0WXJZRWZnamNHRDlLaHNUMEFBQUFBU1VWT1JLNUNZSUk9JykgIWltcG9ydGFudDtcIj48L2Rpdj48aWZyYW1lIGlkPVwiZ29vZ2xlX29zZF9zdGF0aWNfZnJhbWVfMTYzNzQzMjg1MjI3M1wiIG5hbWU9XCJnb29nbGVfb3NkX3N0YXRpY19mcmFtZVwiIHN0eWxlPVwiZGlzcGxheTogbm9uZTsgd2lkdGg6IDBweDsgaGVpZ2h0OiAwcHg7XCI%2BPC9pZnJhbWU%2BPC9ib2R5PjwvaHRtbD48IS0tIElGUkFNRSBJTk5FUiBDT05URU5UIC0tPjxpZnJhbWUgaWQ9XCJnb29nbGVfb3NkX3N0YXRpY19mcmFtZV8xNjM3NDMyODUyMjczXCIgbmFtZT1cImdvb2dsZV9vc2Rfc3RhdGljX2ZyYW1lXCIgc3R5bGU9XCJkaXNwbGF5OiBub25lOyB3aWR0aDogMHB4OyBoZWlnaHQ6IDBweDtcIj48aGVhZD48L2hlYWQ%2BPGJvZHk%2BPC9ib2R5PjwvaWZyYW1lPiIsIm1ldGEiOnsicGxSYXRpbyI6MC4wMX19&i=2-2&t=adltag_ka83tkmc_xvD2OV14CPF&r=5a5152b73e3312dad5e8651dade1962&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.73 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-73.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
via: 1.1 a0c82b0230a7e14a68e3ce4ae3eed807.cloudfront.net (CloudFront)
etag: "6b7395c9201aa64331475fddd24d987c"
age: 1
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
date: Fri, 15 May 2020 11:14:15 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: snXtoALWd6aXGhtbiqY45CmQOMpyKpvJnAsjjp_KFqzenXGo8G95bQ==

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame AAC5 7 KB
6 KB 16ms
16ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200511&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200511/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f83251b5cb8531ca9e75f1e9c28f995835ef5e7064b6855b1515135b86565bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5563
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
5 KB 17ms
17ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020051102&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020051102.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

45e00c63de64bdb286415fa7c74b9b8c169609082a8578b22d1007ec83719b4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 15 May 2020 11:14:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5558
x-xss-protection: 0

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=617734723&t=timing&_s=2&dl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ul=en-us&de=UTF-8&d...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=440715696.1589541252&jid=2098670199&_gid=524900900.1589541252&gjid=1253405002&_v=j82&z=1225844530
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=2098670199&_v=j82&z=1225844530
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=2098670199&_v=j82&z=1225844530&slf_rd=1&random=2832635875

42 B
106 B

17ms
16ms

Image
image/gif

2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=2098670199&_v=j82&z=1225844530&slf_rd=1&random=2832635875

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=440715696.1589541252&jid=2098670199&_v=j82&z=1225844530&slf_rd=1&random=2832635875
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D56D 14 KB
5 KB 63ms
63ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:15 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame AAC5 14 KB
5 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:15 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 20ms
14ms Script
text/javascript 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 11:14:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 15 May 2020 11:14:15 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame BC57 0
0 9ms
6ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 15 May 2020 10:47:52 GMT
expires: Sat, 15 May 2021 10:47:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1583
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 34BE 0
0 9ms
5ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 15 May 2020 10:47:52 GMT
expires: Sat, 15 May 2021 10:47:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1583
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 09C6 0
0 6ms
5ms Document
text/html 2a00:1450:4001:81a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 15 May 2020 10:47:52 GMT
expires: Sat, 15 May 2021 10:47:52 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1583
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame D56D 42 B
107 B 14ms
14ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuaSFoOGrlYitDZFyIpeZ_a5ELeKXww4xiKNsoKWoTAhLlyUIINmkawrGs_6_BZNzl3G-8mAsHCsgnIrw3YdXLnYz8eccwcgJj-1BF7m8I&sig=Cg0ArKJSzBqBYwIr8NyCEAE&adk=654286612&tt=-1&bs=1585%2C1200&mtos=1090,1090,1090,1090,1090&tos=1090,0,0,0,0&p=417,1057,697,1393&mcvt=1090&rs=0&ht=0&tfs=610&tls=1690&mc=1&lte=0&bas=0&bac=0&met=ie&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1589541253280&dlt&rpt=732&isd=0&msd=0&ext&xdi=0&ps=1585%2C5067&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-10-32-9-9-0-0-0&tvt=1662&is=336%2C280&iframe_loc=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&r=v&id=osdim&vs=4&uc=10&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200513

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK w_640_002.ts Show response
video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/ Frame 99C2 405 KB
405 KB 398ms
396ms XHR
video/mp2t 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/w_640_002.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 78480a3e13e59847ff5abca2692aab447f08d7e6c2b1c6f7ec0119559a548700

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:06 GMT
Last-Modified: Fri, 08 May 2020 21:38:41 GMT
Server: Tengine
ETag: "5eb5d161-6534c"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 22 May 2020 11:14:06 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 414540
X-Proxy-Cache: MISS

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D56D 0
55 B 19ms
14ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200511&jk=465538954321845&bg=!QEOlQ1tYqhIs9Zopnw8CAAAA3FIAAAAxmQF8OMYJAFptaQvDYpy9a1Ui9CQjN5cPXxPbJjRpOqNnecF9AKThZM36XqMoVgiXbaBS0v4GusSzqKgEFJBILAuQx2zr5Tp4-vPAM6gaEL1knUJtXE9OSwzm9Fl4iVcAU4Pjo_iWGTcWefCkkbxHFTNARYgg77npPuitJx3hIJLx8Ub7QTnjZrYD9U4Gt2_9d8fUYVkahh_7eu2renhbyt8AwHwSgy-ga_E5-zDQyF1qS48fez0LBxbNPsjnNZ3P8iYHEcVXt19TdhgoMmPgnkzF64WShs8AgfCsiNH-7CB90IQOzvR-fMyKhED1lhYCqrQ5VUyf174rUsrf8qDK9gjYiqppaYzmZGWf9g7jb21_3J14FtLXcznTssWUTe8W6kpC4aNm3lKgyvTTlc0C32-zDNHMLWseJ1Jz6GUu9XQn36T4iVkn1tN8qDWJOd55uY0VZ1SkzMymYTur-9bxWVDW4KXqH08YzUVqBgMoxCmifE29WW3QNPrYcDZruvA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AAC5 0
55 B 14ms
14ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200511&jk=1861385180437502&bg=!TE-lT1dYDzIUU30UonECAAAAz1IAAAA7mQF8xmNutYE9igIsPFffAIuFmdCO5YiFD8oEgbwDOPM4DYgjxfMrku-2uDvkQtFa5_HdTLzcCm2pPkcXiee4xd_ypLUV1f4bWp4cUtfXkba6NZRFdYTNB0_nJo8vd9BzU408VouzNk-nPWhqCs3Pz1Kt9f_W44Nuu312vFh8vyFouGEM8tfq-mIQgJCpbZDtvvk63ycpo0ZzD7nEsbmqiHoTavWt8ay2pBELUVDlgBmfqKgdqEGiFjSdH7wHH13phh9R-4WZJfxsPRIIwvn0IkHSS0ELs-kU-nwbb0kUgB6CMOk-iOmUfOm6Qy5m9puxhch9sGFXu1E9WvvYNK2vlXnWBcYG-zRPRGdhfH6CIWK1N7el3ZDRs1tl5r0OYUrXdvDTKbQVIa_U9GyvvXzpjOpLmqJa3czybNoNwKDKNLmfqCXcA9ah96kTLOrFw-4wxej2aWyfA83Z6XrUNYNjCcRDeBViul5F95MsisG83mSp4OFIECmAtrGSZdz3qFQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
55 B 15ms
14ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020051102&jk=3759877639605714&bg=!Dg2lDRVY6nTXq8EMrEYCAAAAvlIAAAAfmQF2m6EUxtpjRfnIhN4vIlPEzZXzsSaAj2OkFAup2bc9rd8QeILKEVJXVwHY-zhqQozSVqAzKb3UZCxR9CVpPCfGKo7EOr9D4ELXlk1KfXwv8Reyhb7YnaZHhLdC4moBUIYxQYbs1sgzKfUXKbmFJtSg2sWdIgnUol0aAcaLRQdZGhYg3GAMI3T2AuX9NY8C2XZo2eIEYPd_n4sl1_QivJpmAO1iCCfASX5QqWUV7Dr5lIWmW9aNbaVBSK3bV9nmoLgB5KwXvvXYWvW74u3gLIczswJ6nWyIWhx-21gngY3RqCK08pWCws2O1NLH-heZySQHr7ivvffHN2Y_EOIQDbQp1g77JdL188FdsSu4pN-Gb9DxwP5CvhQrk-8wZghLKlZGjBv_hV4QEJ_z6dDEKiV239ktw_9TIodnpKritu0visQ74uV0QcskJbKi9mAKi198XHQOdMQt4kDR4CCMVdzQA_cIKcy3THpwiv2tSA26Bod37Nof-Xg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 24EC 0
0 36ms
35ms Document
text/html 72.247.225.17
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.17 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-17.deploy.static.akamaitechnologies.com
Software: nginx/1.9.13 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.9.13
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Sat, 15 May 2021 11:14:15 GMT
Date: Fri, 15 May 2020 11:14:15 GMT
Connection: keep-alive

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 5753 0
0 39ms
39ms Document
text/html 72.247.225.32
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.32 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-32.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; pi=156858:2; KADUSERCOOKIE=3DD30C12-4175-4DC2-B781-9A29525940D3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

Last-Modified: Tue, 14 Apr 2020 10:27:52 GMT
ETag: "13006b6-a4bb-5a33da6f1a023"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 15243
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=134873
Expires: Sun, 17 May 2020 00:42:08 GMT
Date: Fri, 15 May 2020 11:14:15 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame E14A 0
0 126ms
125ms Document
text/html 104.111.230.142
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 13 May 2020 23:08:00 GMT
Content-Encoding: gzip
Content-Length: 9162
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=79062
Expires: Sat, 16 May 2020 09:11:57 GMT
Date: Fri, 15 May 2020 11:14:15 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 1FAD
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

70ms
14ms

Document
text/html

205.185.216.42
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

Date: Fri, 15 May 2020 11:14:16 GMT
Connection: Keep-Alive
Accept-Ranges: bytes
Cache-Control: max-age=63384
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx00000000000001f1eeb15-005ebe1fa0-3523c7a-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1589541256.dop125.am5.t,1589541256.cds130.am5.shn,1589541256.cds130.am5.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame B404 0
0 31ms
31ms Document
text/html 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.186.1 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=b3d35457-8bad-4747-8359-bfbbd069e64d|1589541253; pd=v2|1589541253|mOgikimWiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=b3d35457-8bad-4747-8359-bfbbd069e64d|1589541253; Version=1; Expires=Sat, 15-May-2021 11:14:15 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1589541253.2|kimWiymOgugi.fcgqsLomgen0; Version=1; Expires=Sat, 30-May-2020 11:14:15 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.186.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 15 May 2020 11:14:15 GMT
content-type: text/html
content-length: 356
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 117ms
66ms Image
text/plain 2a02:fa8:8806:16::1400
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A34183e8c-969d-11ea-9985-12dcd5311714&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1400 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=rgyXbaxQzTy2DcM5q17YPfhQzT62DME6qlEWAaVC
https://ups.analytics.yahoo.com/ups/55965/sync?_origin=0&gdpr=1&uid=rgyXbaxQzTy2DcM5q17YPfhQzT62DME6qlEWAaVC&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e

0
1 KB

27ms
27ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55965/sync?_origin=0&gdpr=1&uid=rgyXbaxQzTy2DcM5q17YPfhQzT62DME6qlEWAaVC&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:15 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 15 May 2020 11:14:15 GMT
location: https://ups.analytics.yahoo.com/ups/55965/sync?_origin=0&gdpr=1&uid=rgyXbaxQzTy2DcM5q17YPfhQzT62DME6qlEWAaVC&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/56465/
Redirect Chain

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=
https://ups.analytics.yahoo.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e
https://pr-bh.ybp.yahoo.com/sync/adtech/UP358f7f5f-969d-11ea-81ce-068dfa39526e?gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/56465/sync?uid=y-eHsfAwN1lxmtLrJYoOcaN_fnAab6W8kXfRNZ&_origin=0&nsync=0
https://ups.analytics.yahoo.com/ups/56465/sync?uid=y-eHsfAwN1lxmtLrJYoOcaN_fnAab6W8kXfRNZ&_origin=0&nsync=0&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e

0
1 KB

27ms
27ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/56465/sync?uid=y-eHsfAwN1lxmtLrJYoOcaN_fnAab6W8kXfRNZ&_origin=0&nsync=0&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:16 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 15 May 2020 11:14:15 GMT
location: https://ups.analytics.yahoo.com/ups/56465/sync?uid=y-eHsfAwN1lxmtLrJYoOcaN_fnAab6W8kXfRNZ&_origin=0&nsync=0&apid=UP358f7f5f-969d-11ea-81ce-068dfa39526e
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 35ms
34ms Image
image/gif 52.51.104.248
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.104.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-104-248.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 195F 0
0 41ms
40ms Image
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CG32uhHm-Xq7ULeOT7_UPq7mZsAHC-6HRXMuy1LCSC_uK9P0IEAEg0YfSIGCRjKCFjBigAczyx90DyAEGqQJeh_4lS197PuACAKgDAaoEmAJP0OmLN_kI0kIcAL-24lJOjyTIvZ0aoBcpEacEY1m9dIPlbJLNE3ypQ_ahk4JUim7f4SCJx6BEvVs70rNGUgtFjovxILhka_V1odJg2u4r-tS1xp9ymKBuERHsdG7DMArDiW0y3qpIKMQuNJA0-AVPphyRIj5akEhydiDFfu4sKKIrxccSLnUVy8Eye7dBn3tn0GsyI7yMXP3f_9MCvKspYvMBHYQ3X4N2hpz6ztCiFgk7qU3WUOOAIazVK2ZVylWTpmEu6YBZjFsz7WM3JAglGWxOHriLXXuuRBOZ6g_gkO6qQmq8VuJ5YqtaXun30nzpobq9tvK26KocF5lyLmaw4kMCIZpR00gvhKziYV5vOw-QW7N6BqWVwASCjOym7QLgBAGgBjeAB5yNuCKoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQxt4N0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi03MjYzNTczNDQ2ODA0MDc4gAoDyAsB2BMD&sigh=Wfr3QyEsx1o&vt=1&template_id=492
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s21-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 195F 42 B
107 B 23ms
14ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssxTKIcX0bQCdyecQYxAkX45sUhvCPJ3hXu6SoLccPdQG_jmHgb1fQkHeKoWaB8wrzY9daWR0l_c-loAwv_lMdxunc524MA6O3qbCFRVFzq5moTnfyxbCetj5FyYQ&sai=AMfl-YSUIY_AOagGhee2O2_-503ULTgT3uTMldtxOo8ZA3ya3cD5BX1_2gNYWdpvq8O6iqBtYSGVjm5gpdQs2nlV1m6E9do8W01_JmeQTlbXAQ&sig=Cg0ArKJSzOHNIOMEEL0HEAE&id=ampim&o=308,10&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,0,1001,1001&tos=0,0,0,1001,0&tfs=699&tls=1700&g=100&h=100&tt=1700&r=v&avms=ampa&adk=1015519800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 4DE1 42 B
107 B 28ms
14ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssoG1ba4zc2WNGoXE1DqJmNWkpio_5DMzVBz6G_U_NBDlcYHAk9QTfTKabizL_HJvEhuj_882a7oC2fmWYanJ56HZ0zphjf2z9YjppSRes&sig=Cg0ArKJSzD8KFAW76zo0EAE&id=ampim&o=0,0&d=2,2&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,1002,1002,1002&tos=0,0,1002,0,0&tfs=239&tls=1241&g=100&h=100&tt=1241&r=v&avms=ampa&adk=3385906655

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK w_640_003.ts Show response
video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/ Frame 99C2 378 KB
378 KB 398ms
398ms XHR
video/mp2t 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/w_640_003.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 8a56e99f3aa3e88bbbfecf90c63aca1047e45b96597cd8458f9bbcd2b06e984b

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:07 GMT
Last-Modified: Fri, 08 May 2020 21:38:41 GMT
Server: Tengine
ETag: "5eb5d161-5e69c"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 22 May 2020 11:14:07 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 386716
X-Proxy-Cache: MISS

GET
H/1.1 200
OK w_640_004.ts Show response
video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/ Frame 99C2 284 KB
285 KB 393ms
393ms XHR
video/mp2t 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/w_640_004.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 9d1be609660c2fe307885631ef76ce6899b940f7d4095f68aedaa8cc7e1d0407

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:07 GMT
Last-Modified: Fri, 08 May 2020 21:38:42 GMT
Server: Tengine
ETag: "5eb5d162-4718c"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 22 May 2020 11:14:07 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 291212
X-Proxy-Cache: MISS

GET
H/1.1 200
OK w_640_005.ts Show response
video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/ Frame 99C2 402 KB
403 KB 794ms
794ms XHR
video/mp2t 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/w_640_005.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 93bf2657d87af8437737c2de5f840fd9ea5de20bc31ff6c36e02abd37d40f161

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:08 GMT
Last-Modified: Fri, 08 May 2020 21:38:42 GMT
Server: Tengine
ETag: "5eb5d162-649c0"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 22 May 2020 11:14:08 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 412096
X-Proxy-Cache: MISS

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame BED3 0
379 B 17ms
17ms Image
text/html 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1589541251&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20iosAppIntervalBug%20%2F%202%20%2F%20default&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5ebe798390995&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1589541257329&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:16 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_006.ts Show response
video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/ Frame 99C2 332 KB
333 KB 395ms
395ms XHR
video/mp2t 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/w_640_006.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 7ae85aaa53e527c0c32fe278fe2de8bd5c65f16d93f4d15d7193a8de3ff1562a

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:12 GMT
Last-Modified: Fri, 08 May 2020 21:38:42 GMT
Server: Tengine
ETag: "5eb5d162-531f4"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 22 May 2020 11:14:12 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 340468
X-Proxy-Cache: MISS

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame BED3 0
379 B 46ms
46ms Image
text/html 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1589541251&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20iosAppIntervalBug%20%2F%202%20%2F%20default&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5ebe798390995&contentFileId=0&mediaPlayListId=0&dur=1000&cbuster=1589541262007&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:21 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame BED3 0
379 B 19ms
18ms Image
text/html 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1589541251&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20iosAppIntervalBug%20%2F%202%20%2F%20default&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5ebe798390995&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1589541262327&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:21 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 99C2 0
59 B 17ms
17ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Fri, 15 May 2020 11:14:26 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 99C2 25 B
988 B 107ms
107ms XHR
application/json 72.247.225.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435870&v=8.1&r=%7B%22id%22%3A%2224a06c984d8b3d8%22%2C%22imp%22%3A%5B%7B%22id%22%3A%222501884eb6b813e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22320x180%22%7D%2C%22bidfloor%22%3A1.8%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22api%22%3A%5B1%2C2%5D%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22w%22%3A320%2C%22h%22%3A180%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&nf=1&
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.98 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: acc42bbbaa146e8a3ec2720eeb43cabb9176f0f4d86c5479e5b96d5be06255b6

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:26 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 45
Expires: Fri, 15 May 2020 11:14:26 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 99C2 0
215 B 30ms
29ms XHR
application/json 18.184.66.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.66.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-66-147.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 99C2 92 B
282 B 89ms
89ms XHR
application/json 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-onenote-sidestep-phishing-detection%2F153436%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=1d351579-eee6-42e2-b5de-3a34f19e02e6&nocache=1589541266475&gdpr_consent=&gdpr=1&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&skip=1&auid=540882779&vwd=320&vht=180&
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.186.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:26 GMT
via: 1.1 google
server: OXGW/16.186.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 99C2 185 B
386 B 110ms
110ms XHR
application/json 35.157.88.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.88.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-88-129.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 8f2a7bf484e1e14ffc7f14e9cd6df62b27b34360e56214784d1000cfffb3210c

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 May 2020 11:14:26 GMT
content-encoding: gzip
status: 200
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 173
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 99C2 19 B
711 B 15ms
15ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:28 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 726.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.45:80
AN-X-Request-Uuid: 377506a3-72a6-4eb1-a9a3-3d3a69ddd1bc
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame BED3 43 B
463 B 18ms
17ms Image
image/gif 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=6&serverTime=1589541252&s=58057&sta=12381400&x=320&y=180&msta=12348808&vid_vastType=3&vid_viewabilityState=1&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20iosAppIntervalBug%20%2F%202%20%2F%20default&playbackMethod=auto&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5ebe798390995&rvn=${VP_RVN_MACRO}&attemptMultiplier=10&contentFileId=0&mediaPlayListId=0&playerVer=3.0.0&cbuster=1589541266466&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:26 GMT
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000
Content-Disposition: inline; filename="pixel.gif"
Content-Type: image/gif
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK w_640_007.ts Show response
video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/ Frame 99C2 348 KB
348 KB 398ms
397ms XHR
video/mp2t 185.167.98.14
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn15/video/users/hls/24485/video1523972806/vid5eb5cfe7530e1396936155.mp4/w_640_007.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.167.98.14 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: Tengine /
Resource Hash: eb24388c985ff17181304ef0374427710cd8a9a61f55cd9f4721ccaadf4f8424

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 11:14:18 GMT
Last-Modified: Fri, 08 May 2020 21:38:43 GMT
Server: Tengine
ETag: "5eb5d163-57060"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 22 May 2020 11:14:18 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 356448
X-Proxy-Cache: MISS

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame BED3 0
379 B 18ms
17ms Image
text/html 194.146.38.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1589541251&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20iosAppIntervalBug%20%2F%202%20%2F%20default&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5ebe798390995&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1589541267327&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.146.38.23 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 May 2020 11:14:27 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=497cd67432e0518;misc=1589541251386;

Verdicts & Comments Add Verdict or Comment

262 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 09:32:24	Name: DSID Value: NO_DATA
.pubmatic.com/	1970-01-19 11:41:57	Name: KADUSERCOOKIE Value: 3DD30C12-4175-4DC2-B781-9A29525940D3
.doubleclick.net/	1970-01-19 18:53:57	Name: IDE Value: AHWqTUnREYt80Lor7yu9-5JgmrAybJBZsuIrYi1O81x0nDwhNtbDFHJxNrI7V-T_
.pubmatic.com/	1970-01-19 09:33:47	Name: pi Value: 156858:2
.ads.pubmatic.com/	1970-01-19 09:33:47	Name: KCCH Value: YES
.openx.net/	1970-01-19 18:17:57	Name: i Value: b3d35457-8bad-4747-8359-bfbbd069e64d\|1589541253
.threatpost.com/	1970-01-20 03:03:33	Name: __gads Value: ID=9676ab3839e07370:T=1589541252:S=ALNI_MZ-taoluiIIqQC8k8dCOSj6posFMw
.pubmatic.com/	1970-01-19 11:41:57	Name: KTPCACOOKIE Value: YES
.openx.net/	1970-01-19 09:53:57	Name: pd Value: v2\|1589541253\|mOgikimWiygu
.threatpost.com/	1970-01-19 18:56:50	Name: __qca Value: P0-1682491647-1589541252401

27 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 315) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 340) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 340) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 340) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 340) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 3) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 3) Message: GDPR is not applicable, skipping initialization of CMP
console-api	log	(Line 3) Message: Not calling apstag.init() typeof(kAmazonPublisherID)=undefined
console-api	log	(Line 3) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	(Line 3) Message: Initial Ad Load
console-api	log	(Line 3) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	(Line 3) Message: pbjs bids returned
console-api	log	(Line 3) Message: gPBJSTimeoutTimer cleared
console-api	log	(Line 3) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	(Line 3) Message: sendAdserverRequest()
console-api	log	(Line 3) Message: Not calling apstag.setDisplayBids() gAmazonBidsBack=false
console-api	log	(Line 3) Message: pbjs.getAdserverTargeting: >> Prebid
console-api	log	(Line 3) Message: [object Object]
console-api	log	(Line 3) Message: pbjs.getBidResponses:
console-api	log	(Line 3) Message: [object Object]
console-api	log	(Line 3) Message: gThisRefreshSlots=
console-api	log	(Line 3) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	(Line 3) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	(Line 3) Message: console.groupEnd
console-api	info	URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js(Line 418) Message: Powered by AMP ⚡ HTML – Version 2005012256000 https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
console-api	info	URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js(Line 418) Message: Powered by AMP ⚡ HTML – Version 2005012256000 https://threatpost.com/microsoft-onenote-sidestep-phishing-detection/153436/
console-api	warning	URL: https://cdn.ampproject.org/rtv/012005012256000/amp4ads-v0.js(Line 22) Message: [amp-analytics/transport] Response unparseable or failed to send image request https://securepubads.g.doubleclick.net/pagead/adview?ai=CG32uhHm-Xq7ULeOT7_UPq7mZsAHC-6HRXMuy1LCSC_uK9P0IEAEg0YfSIGCRjKCFjBigAczyx90DyAEGqQJeh_4lS197PuACAKgDAaoEmAJP0OmLN_kI0kIcAL-24lJOjyTIvZ0aoBcpEacEY1m9dIPlbJLNE3ypQ_ahk4JUim7f4SCJx6BEvVs70rNGUgtFjovxILhka_V1odJg2u4r-tS1xp9ymKBuERHsdG7DMArDiW0y3qpIKMQuNJA0-AVPphyRIj5akEhydiDFfu4sKKIrxccSLnUVy8Eye7dBn3tn0GsyI7yMXP3f_9MCvKspYvMBHYQ3X4N2hpz6ztCiFgk7qU3WUOOAIazVK2ZVylWTpmEu6YBZjFsz7WM3JAglGWxOHriLXXuuRBOZ6g_gkO6qQmq8VuJ5YqtaXun30nzpobq9tvK26KocF5lyLmaw4kMCIZpR00gvhKziYV5vOw-QW7N6BqWVwASCjOym7QLgBAGgBjeAB5yNuCKoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQxt4N0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi03MjYzNTczNDQ2ODA0MDc4gAoDyAsB2BMD&sigh=Wfr3QyEsx1o&vt=1&template_id=492

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a4f79a64d2fc9be411e8260fcd860c78.safeframe.googlesyndication.com
acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
aol-match.dotomi.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
cdn.ampproject.org
cm.g.doubleclick.net
csync.loopme.me
e.serverbid.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
ib.adnxs.com
kasperskycontenthub.com
live.sekindo.com
match.adsrvr.org
math-aids-threatpost-tagan.adlightning.com
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid-server.rubiconproject.com
qd.admetricspro.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.adap.tv
sync.adaptv.advertising.com
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
video.sekindo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
x.bidswitch.net
adserver-us.adtech.advertising.com
104.111.230.142
104.244.42.133
104.244.42.67
148.251.129.84
151.101.12.157
151.101.14.49
167.172.1.14
172.217.23.162
18.156.0.31
18.184.66.147
185.167.98.14
185.33.221.88
185.64.189.112
194.146.38.23
199.232.53.140
205.185.216.42
216.52.2.30
216.58.212.130
2600:9000:2016:3c00:2:9275:3d40:93a1
2600:9000:2016:a800:0:5c46:4f40:93a1
2600:9000:2093:4000:6:44e3:f8c0:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:3035::6812:2130
2a00:1288:110:c305::8000
2a00:1450:4001:800::2001
2a00:1450:4001:800::2003
2a00:1450:4001:801::2002
2a00:1450:4001:809::2002
2a00:1450:4001:814::2003
2a00:1450:4001:819::200e
2a00:1450:4001:81a::2001
2a00:1450:4001:81a::2003
2a00:1450:4001:81d::2008
2a00:1450:4001:81e::2004
2a00:1450:4001:821::2001
2a00:1450:4001:821::200a
2a00:1450:4001:825::2002
2a00:1450:400c:c00::9b
2a02:fa8:8806:16::1400
2a03:2880:f01c:800e:face:b00c:0:2
2a05:f500:11:101::b93f:9001
34.95.120.147
35.157.88.129
35.168.89.112
35.173.160.135
52.203.99.84
52.222.182.71
52.222.190.73
52.222.191.80
52.51.104.248
52.58.138.174
52.59.163.227
69.173.144.141
72.247.225.17
72.247.225.32
72.247.225.98
91.228.74.148
91.228.74.217
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06834f92b4b3ccbff1358225dbace32484d2d0c37179a634d3d4d7019d3cd644
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
09cc42354773abec2a57f4da338e3a13a8bf0991653838dd2073c7ebed5760c6
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0f58bcef9606d6c6a8a1495d6fb1a2fef06d8f6e50cb613cf59c5f33547d0771
0f9ff4042daa13aa0766bc4854140f7a2942e4deae37d352a617b95000fa54ba
114f79946e5cf32cb0c84679a086a21148e2f29d72940b87d165b03d200de97f
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
1c34df0a1a6831ad1a6d87ba5381d48abfe4a2a2290418d078588b15c19c3f43
1d36800d5a9c72e02424db4f2ee2d3e3391388e8b7e863533f73c788df14ab5e
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2207ba5c4e1793b6e26ebed40e96b48b30afde83eb5404d7146812757dcbc08b
22bce61f4ab1cabf0df284f75cf064654e2c82fd992de9b8bd951f3bb43a87ca
25cbfbe95753b2b7cc509e199271f8ab339b45f4c4b28a098e3cc7b40ae644cb
294a356ae487130333b79d7de930bfcbe2cdb344f5a04edd00c33506c43769ef
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c167f4042d1338b33e2822f3b3dca3646bffcac14747d934c50794192dc3c2b
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
3571d689234e34d75e0421120b8542dd1923f968606664d510691f39144094a6
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3793558897bd7f92932e4e5c6a35d3417dd9df3a9401b55877a3fd1edf33c057
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3d11978e2cd1da562312ff7ec34547aaf7d08b8acc4220d63e36c6f697366530
3dbd06bf1d690a4c0fcbfcd77c26a032558b9f9698bb7261191bfb19656bf8ca
41ecbdbfb32c9316c36377677d69082c99207ac998ee13680ed6ecf5e31d2ee6
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
42e2bdfb6f2641ab97b6a586c31e591246a5240bc86e504d6ec02c616aeb8e4e
44cacbceeb3043b0b7b243b9fdf224cd4bee93426f05c6b9129120a29fac9ad7
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
45e00c63de64bdb286415fa7c74b9b8c169609082a8578b22d1007ec83719b4c
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4be5c19f10d1976045562eacefa42bf91c25ec5efc5ebc1298a57214a36b314c
4c2e005f9c7de72cec19bb6509b4fd0289ba2c9b59c78b92751d4c60b298cfbb
4e68f7f022e7f83b75ca7355dcbbd76273b415f31fbcf713f2e05af734cf65f2
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
5330600f68293b69db933eba611413ffaa46ad7c992116b06933c620d7a3c43c
53d35f6abc5fec7dedb2ad111d3053486941d5d3512ef2ff64bb4a01c9c14cce
54600f9586e55f43467dcdb8c934157a25743cee119af2c034ffe81c2a1d06e8
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
57773418df31d691c2231074492deaa5ac8223d2d912eed396f44cb35cc1793c
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a56435d0be6fff52393ffe84740a70ddd82754aa7f3bc3ce8c04ee7da921e71
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5d3b82774c0268a19720c53a6dc7a9e43c623cd7702e2ed8aed4afba2433a588
5e00db38c7c200422a1b2604eccaee91db1aa7dd5aead5383f62b85cead19068
667a53e3145f4c8b641a886082ce900423662980c5fe3d784383c3d481de2320
6711ec4f945f371e30bdb6f1b803d194cddd66b32965dcc1f73884bd2c955c6c
683e1b018e8f26073c9d28cc27d021f3bb04a624bb12322d1c9015ae0be5561c
6911cdf8bbf72eff1b6ae5fa039c42f4ca431e578f4f657dd29c55a65f85fd22
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6d74e457a64916d38dea5c5abf37912edc03ad078a8d4bd8ef6c6453aa7922f7
6f83251b5cb8531ca9e75f1e9c28f995835ef5e7064b6855b1515135b86565bf
7160807a4aabc44b02e210d7db4c0da4eecd75df528a951e88b350420a124391
76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e
76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099
78480a3e13e59847ff5abca2692aab447f08d7e6c2b1c6f7ec0119559a548700
7ae85aaa53e527c0c32fe278fe2de8bd5c65f16d93f4d15d7193a8de3ff1562a
7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb
7d7d6c5df1b2704e97a265da471fe669ae877ec3be426c11954803655f55f8b1
7d9944f6f4e2d0330ca2a9d758a404fdca5937f4a0ddf939247ca3505f9f0bbc
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8276117bcc362352b6d3a5f09093ad1955601fbe77fc4f11cb823df7ecdbc8f4
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
8643f469523dab740ec119a6fdb1d67255a80cd782567f32e8c06b3abc1da2ad
8a56e99f3aa3e88bbbfecf90c63aca1047e45b96597cd8458f9bbcd2b06e984b
8bb43ebc332df9ed85f4d8ebca035290d29c9d09dd1dae152e2a1e4f00486865
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f2a7bf484e1e14ffc7f14e9cd6df62b27b34360e56214784d1000cfffb3210c
92d0171289868d45a2099f1e0507824921169d4e8048aaecdf52802adae3c939
93bf2657d87af8437737c2de5f840fd9ea5de20bc31ff6c36e02abd37d40f161
940e0c3385928422aae38e1a74f1d84b462d8ce1a056c686fde505a0bf3162bb
96543aefeee90324f9e94b0a81d9c9e2a03af8fbc14fcee396582aa868c85c50
97e206032314b9ce6176549e79f8cdbbd2a23bf6e0165d8b1ce2d980ef03051b
993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9d1be609660c2fe307885631ef76ce6899b940f7d4095f68aedaa8cc7e1d0407
9f40f7297122393e1425eec62e78a75c3211f7ad3f6b09a356aa317fcedc2cf3
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a154f71172663cd7151a9c2bfc0f43ef0aeedceff11e0459800eb46560df4b26
a2c5d4e6a74355f147e25b3ced1d4a66288eab711d0bd3d449ef056fa777c184
a2e2059610101cb4718d6d9cf8d6e44243838304968710f35ed7f44188a9c279
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd
a34c9929700618f4d6f902bc3175d89d140266742b8e042386d6a78cee3e29c5
a4692430616d0b20d90ce3f3525ba124c9372e8a564f5d9d963971d3bfef38e1
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a9ccdefe0a821df80b8292afc4991c8f61a16a5d1b6507bc0409a50d7cd805d1
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
aaf45a172ec90c76bcecd61c68d998c2256fe9b1700371e80011d1161c5ab629
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acc42bbbaa146e8a3ec2720eeb43cabb9176f0f4d86c5479e5b96d5be06255b6
ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
b03b538a0dda03d3015cf894f7bc9c03ab483d21ed9d9525e79a47c3359effa6
b388addf9c8ba4bc2852132727bd9df68c99db7ca97d22fdb18ad2a426d02a5b
b4153138e58f8edd6dfad5d0ef015d9a1ea410e774b0f18ceeb1a94e55edbb4a
b68b4d1e6d63eabb8a4f663f7755454028aa22d9a0edc88d5b77c58e932d7fa0
ba19cdcaf592f6ec56c11da9dcf9f7ec3272752af1bdf9288dcb64b7bde85511
bbf4d7b0b646380968cfe034aa5e1c99dd7d288e243dbc33664d6583a30dbe36
bcf391dd0b006a87698ac0894d71039d610480913d24fcdaa1f2fdeeeda943e3
be6503a92da54da09dac6f101ea8b77dca074ef439b2b1370c71a9f239f2d7b3
bf95a8ad37e83fa0207462a3fa605fce6b3542ca6a78563a75a1fca7ae084224
c093719869fa0fa0375b76f64d9d01908527177983a0740ec475e2bf8dae79c9
c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc
c9fff884f49d2eb540f6d6d4dadd4817909c8c90d28dade868c5344baf68a2ba
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce73e1c733f8bc0a1fa122e9140844a28b775e0b1a9819e877297e5318ebea9b
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d2b891e379840927eaf16ac1147b0e270c409d7a9e2655dd866a175b996dea9c
d3838febe02ee1538a1336ac01f452a6fe7682106cd21b46cda9c40092c8e3aa
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a
d729a0c4be6a2d1b6cc5f6b99074c6c64bdf695b5c39371e8a69ee111258319a
dd0c4ff5bc4e85bcd1ff717afc9d15b8274efe8e644542489bc31fae0346541b
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df4b376fc112266e6f1854609311b809452d452ecead88a1689693f8c2af84e7
df61a41d3e854c170e07bf9c5813f2a1e1738d62b71089b5c2382e9cc7a1bcae
e00478c25dcd91606b3dc74d065f5c5ebe48756aed82c1f049dded20eb2792fd
e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796
e3a59eba123b8a0e2cf8a54eb06a12491f840d7d4d822a5fbe02927551beb888
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e45a4f7dca7c441a8e1f9862d14232d2dc2e9845d22446adc228097d261b48c5
e4be5b94ae5d44559ee0e809b87774c6f6e3df1c523e6ab24e31977e965e76a8
e5792172e9a0e72cd72edbe216e8792118ad4c2ca2f475b173d47f2f23e32f76
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
eb24388c985ff17181304ef0374427710cd8a9a61f55cd9f4721ccaadf4f8424
ecb531bdf231039081a7a6879d73bca91d8b8c7fc671615063746454c0daaa8c
ed744884f2d88d2339918f907503d536a3d9bdcb0cb4ac921a0dd7979564810e
ee69c3269e0772082a8ab8f18c00fe3dddb92dbc2037ff5d4ddd56a063b7a4e7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0517f76184f899b738515a124efe8f335f585847387b8889dfa7c0fb132f75a
f1615095a9e662d58ed44a7fc6c80c04b642ee9122a037e620680008463b3e68
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f415a788eac7035eb8cf4fd8785dd6f344a5ed33d0f37d51f131fbcda0eb63ff
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea
f55a23c5a090044e82f8619a6ddffa5e8596c29b703a59a65e223a542362b961
f6d40a7a41bff3e12e272a17dded9be71b8b5981ad0122221306ffea02926202
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
f7c35117ef26eb99432f5e54ca8f8dfe9e2d86ed32bf784f00d96205716d7595
f9c1c61861d1e9a7fc38e95ff08933dfd808bb8b8bcdf92f097cb329550f6a89
fa07edc0b05d9f4233f7266cba3c6e87a4ceb3752719ace618b25a295451a8b1
fd920468078f9ce3bd928870d328f15f530bd07ef49098cc310acee65e9e9284
ffbc14a38fb30ded7cd945dced139f6477d773aa72a7d1b62bc049a2c79cc61a

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

244 Requests

99 %HTTPS

40 %IPv6

40 Domains

64 Subdomains

54 IPs

8 Countries

6552 kBTransfer

11048 kBSize

10 Cookies

19 Outgoing links

Page URL History

Redirected requests

244 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

244
Requests

99 %
HTTPS

40 %
IPv6

40
Domains

64
Subdomains

54
IPs

8
Countries

6552 kB
Transfer

11048 kB
Size

10
Cookies

244 HTTP transactions
6 data transactions