forums.juniper.net Open in urlscan Pro
208.74.207.25 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Submission: On February 20 via api (February 20th 2020, 8:14:50 am UTC) from DE

Summary HTTP 161 Redirects Links 115 Behaviour Indicators

Summary

This website contacted 43 IPs in 8 countries across 33 domains to perform 161 HTTP transactions. The main IP is 208.74.207.25, located in United States and belongs to LITHIUM, US. The main domain is forums.juniper.net.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on August 16th 2019. Valid for: a year.

This is the only time forums.juniper.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	208.74.207.25 208.74.207.25	40402 (LITHIUM) (LITHIUM)
21	23.210.248.45 23.210.248.45	16625 (AKAMAI-AS) (AKAMAI-AS)
3	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
1	2a00:1450:400... 2a00:1450:4001:815::200a	15169 (GOOGLE) (GOOGLE)
2	2001:4de0:ac1... 2001:4de0:ac19::1:b:1a	20446 (HIGHWINDS3) (HIGHWINDS3)
27	93.184.220.97 93.184.220.97	15133 (EDGECAST) (EDGECAST)
1 13	2a02:26f0:6c0... 2a02:26f0:6c00:185::720	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	93.184.220.41 93.184.220.41	15133 (EDGECAST) (EDGECAST)
2	34.249.192.36 34.249.192.36	16509 (AMAZON-02) (AMAZON-02)
2	13.35.253.107 13.35.253.107	16509 (AMAZON-02) (AMAZON-02)
1	13.35.253.91 13.35.253.91	16509 (AMAZON-02) (AMAZON-02)
2	208.74.205.254 208.74.205.254	40402 (LITHIUM) (LITHIUM)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
2	18.138.216.223 18.138.216.223	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	65.52.62.25 65.52.62.25	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	34.253.43.81 34.253.43.81	16509 (AMAZON-02) (AMAZON-02)
1	66.117.29.6 66.117.29.6	15224 (OMNITURE) (OMNITURE)
6	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 5	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	37.252.172.250 37.252.172.250	29990 (ASN-APPNEX) (ASN-APPNEX)
1	13.35.253.77 13.35.253.77	16509 (AMAZON-02) (AMAZON-02)
7	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
3	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE)
7	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	104.103.106.126 104.103.106.126	16625 (AKAMAI-AS) (AKAMAI-AS)
4	13.35.253.94 13.35.253.94	16509 (AMAZON-02) (AMAZON-02)
1 2	172.217.22.38 172.217.22.38	15169 (GOOGLE) (GOOGLE)
1 2	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE)
2 2	209.167.231.17 209.167.231.17	7160 (NETDYNAMICS) (NETDYNAMICS)
1	23.45.237.36 23.45.237.36	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	13.35.253.53 13.35.253.53	16509 (AMAZON-02) (AMAZON-02)
2 2	52.214.123.193 52.214.123.193	16509 (AMAZON-02) (AMAZON-02)
1 2	143.204.202.106 143.204.202.106	16509 (AMAZON-02) (AMAZON-02)
1 2	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
1 5	2a00:1450:400... 2a00:1450:4001:814::2004	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:820::2003	15169 (GOOGLE) (GOOGLE)
3	52.72.180.134 52.72.180.134	14618 (AMAZON-AES) (AMAZON-AES)
5	143.204.202.79 143.204.202.79	16509 (AMAZON-02) (AMAZON-02)
2	143.204.202.47 143.204.202.47	16509 (AMAZON-02) (AMAZON-02)
2	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
1 3	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
4	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
1 1	2a05:f500:11:... 2a05:f500:11:101::b93f:9001	14413 (LINKEDIN) (LINKEDIN)
161	43

5 208.74.207.25 (United States)

ASN40402 (LITHIUM, US)
PTR: jnet.lithium.com

forums.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 23.210.248.45 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-45.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 93.184.220.97 (London, United Kingdom)

ASN15133 (EDGECAST, US)

jnet.i.lithium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a02:26f0:6c00:185::720 (Ascension Island) 1 redirects

ASN20940 (AKAMAI-ASN1, US)

www.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 93.184.220.41 (London, United Kingdom)

ASN15133 (EDGECAST, US)

cloud.webtype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.249.192.36 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-192-36.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.253.107 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-107.fra6.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.253.91 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-91.fra6.r.cloudfront.net

api.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 208.74.205.254 (United States)

ASN40402 (LITHIUM, US)
PTR: sjc1-secure06.stage.lithium.com

forumstage.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.138.216.223 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-138-216-223.ap-southeast-1.compute.amazonaws.com

junipernetworks.d2.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.52.62.25 (Chicago, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

pls.webtype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.253.43.81 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-43-81.eu-west-1.compute.amazonaws.com

junipernetworks.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.29.6 (United States)

ASN15224 (OMNITURE, US)

junipernetworks.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.12.157 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.172.250 (Ascension Island) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.253.77 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-77.fra6.r.cloudfront.net

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.103.106.126 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-103-106-126.deploy.static.akamaitechnologies.com

img.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.35.253.94 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-94.fra6.r.cloudfront.net

secure.rmulus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.38 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s16-in-f38.1e100.net

5922977.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f134.1e100.net

3872718.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.167.231.17 (United States) 2 redirects

ASN7160 (NETDYNAMICS, US)
PTR: e017.en25.com

s1229.t.eloqua.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.237.36 (United States)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-237-36.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.253.53 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-53.fra6.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.214.123.193 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-123-193.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.202.106 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-106.fra53.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9d (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:814::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:820::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.72.180.134 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-180-134.compute-1.amazonaws.com

lookups.rmulus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 143.204.202.79 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-79.fra53.r.cloudfront.net

research.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.202.47 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-47.fra53.r.cloudfront.net

collect.rmulus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:11:101::b93f:9001 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	lithium.com jnet.i.lithium.com	2 MB
25	juniper.net 1 redirects forums.juniper.net www.juniper.net forumstage.juniper.net research.juniper.net	2 MB
21	adobedtm.com assets.adobedtm.com	107 KB
10	doubleclick.net 3 redirects 5922977.fls.doubleclick.net 3872718.fls.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	8 KB
9	rmulus.com secure.rmulus.com lookups.rmulus.com collect.rmulus.com	30 KB
8	twitter.com 1 redirects platform.twitter.com analytics.twitter.com	2 KB
7	t.co t.co	944 B
6	facebook.net connect.facebook.net	427 KB
5	google.de www.google.de	549 B
5	google.com 1 redirects www.google.com	620 B
4	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	5 KB
4	company-target.com 1 redirects api.company-target.com segments.company-target.com	3 KB
4	google-analytics.com www.google-analytics.com	18 KB
4	ads-twitter.com static.ads-twitter.com	8 KB
3	googletagmanager.com www.googletagmanager.com	103 KB
3	facebook.com www.facebook.com	380 B
3	omtrdc.net junipernetworks.d2.sc.omtrdc.net junipernetworks.tt.omtrdc.net	1 KB
3	demandbase.com scripts.demandbase.com api.demandbase.com	62 KB
3	demdex.net dpm.demdex.net junipernetworks.demdex.net	2 KB
3	webtype.com cloud.webtype.com pls.webtype.com	65 KB
3	fontawesome.com use.fontawesome.com	13 KB
2	googleadservices.com www.googleadservices.com	20 KB
2	bidr.io 2 redirects match.prod.bidr.io	1019 B
2	eloqua.com 2 redirects s1229.t.eloqua.com	2 KB
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	29 KB
2	googleapis.com ajax.googleapis.com fonts.googleapis.com	30 KB
1	bluekai.com tags.bluekai.com	745 B
1	en25.com img.en25.com	3 KB
1	gstatic.com fonts.gstatic.com	14 KB
1	ml-api.io attr.ml-api.io	484 B
1	ml-attr.com 1 redirects s.ml-attr.com	277 B
1	everesttech.net 1 redirects cm.everesttech.net	554 B
161	33

	Domain	Requested by
27	jnet.i.lithium.com	forums.juniper.net use.fontawesome.com
21	assets.adobedtm.com	forums.juniper.net assets.adobedtm.com
13	www.juniper.net	1 redirects forums.juniper.net forumstage.juniper.net
7	analytics.twitter.com	static.ads-twitter.com
7	t.co	forums.juniper.net static.ads-twitter.com
6	connect.facebook.net	assets.adobedtm.com connect.facebook.net forums.juniper.net
5	research.juniper.net	secure.rmulus.com research.juniper.net
5	www.google.de	forums.juniper.net research.juniper.net
5	www.google.com	1 redirects forums.juniper.net research.juniper.net
5	forums.juniper.net	forums.juniper.net jnet.i.lithium.com
4	googleads.g.doubleclick.net	www.googleadservices.com
4	www.google-analytics.com	forums.juniper.net
4	secure.rmulus.com	assets.adobedtm.com secure.rmulus.com
4	static.ads-twitter.com	assets.adobedtm.com forums.juniper.net
3	px.ads.linkedin.com	1 redirects research.juniper.net forums.juniper.net
3	lookups.rmulus.com	secure.rmulus.com
3	www.googletagmanager.com	forums.juniper.net research.juniper.net
3	www.facebook.com	forums.juniper.net connect.facebook.net
3	use.fontawesome.com	forums.juniper.net use.fontawesome.com
2	www.googleadservices.com	www.googletagmanager.com
2	collect.rmulus.com	forums.juniper.net research.juniper.net
2	stats.g.doubleclick.net	1 redirects forums.juniper.net
2	segments.company-target.com	1 redirects forums.juniper.net
2	match.prod.bidr.io	2 redirects
2	api.company-target.com	scripts.demandbase.com
2	s1229.t.eloqua.com	2 redirects
2	3872718.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	5922977.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	secure.adnxs.com	2 redirects
2	junipernetworks.d2.sc.omtrdc.net	assets.adobedtm.com forums.juniper.net
2	forumstage.juniper.net	forums.juniper.net
2	scripts.demandbase.com	assets.adobedtm.com
2	dpm.demdex.net	assets.adobedtm.com forums.juniper.net
2	cloud.webtype.com	forums.juniper.net
2	maxcdn.bootstrapcdn.com	forums.juniper.net
1	www.linkedin.com	1 redirects
1	tags.bluekai.com	forums.juniper.net
1	img.en25.com	forums.juniper.net
1	fonts.gstatic.com	jnet.i.lithium.com
1	attr.ml-api.io	forums.juniper.net
1	s.ml-attr.com	1 redirects
1	platform.twitter.com	1 redirects
1	junipernetworks.tt.omtrdc.net	assets.adobedtm.com
1	junipernetworks.demdex.net	assets.adobedtm.com
1	pls.webtype.com	forums.juniper.net
1	cm.everesttech.net	1 redirects
1	fonts.googleapis.com	forums.juniper.net
1	api.demandbase.com	assets.adobedtm.com
1	ajax.googleapis.com	forums.juniper.net
161	49

This site contains links to these domains. Also see Links.

Domain
www.juniper.net
support.juniper.net
my.juniper.net
license.juniper.net
entitlementsearch.juniper.net
kb.juniper.net
prsearch.juniper.net
apps.juniper.net
learningportal.juniper.net
openlearning.juniper.net
cloud.contentraven.com
www.certmetrics.com
iam-signin.juniper.net
userregistration.juniper.net
www.facebook.com
twitter.com
plus.google.com
www.linkedin.com
foo.net
www.rfidjournal.com
blog.avast.com
arstechnica.com
www.joesandbox.com
www.hybrid-analysis.com
khoros.com
investor.juniper.net
newsroom.juniper.net
events.juniper.net
partners.juniper.net
www.youtube.com
www.instagram.com

Subject Issuer	Validity	Valid
secure07.lithium.com DigiCert SHA2 High Assurance Server CA	`2019-08-16` - `2020-09-02`	a year	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
*.i.lithium.com Go Daddy Secure Certificate Authority - G2	`2019-11-28` - `2022-01-28`	2 years	crt.sh
www.juniper.net DigiCert SHA2 Secure Server CA	`2019-05-17` - `2020-08-15`	a year	crt.sh
s1.wac.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2018-11-05` - `2020-11-20`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.demandbase.com Go Daddy Secure Certificate Authority - G2	`2018-09-20` - `2020-11-19`	2 years	crt.sh
secure06.stage.lithium.com DigiCert SHA2 High Assurance Server CA	`2019-12-11` - `2020-03-19`	3 months	crt.sh
*.d2.sc.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2019-04-23` - `2020-04-14`	a year	crt.sh
*.webtype.com Sectigo RSA Domain Validation Secure Server CA	`2019-06-30` - `2021-07-12`	2 years	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-01-16` - `2020-04-15`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
*.ml-api.io Amazon	`2020-02-06` - `2021-03-06`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
*.en25.com DigiCert SHA2 Secure Server CA	`2019-06-21` - `2020-08-19`	a year	crt.sh
rmulus.com Amazon	`2019-04-23` - `2020-05-23`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
odc-prod-01.oracle.com DigiCert ECC Secure Server CA	`2018-12-10` - `2020-03-10`	a year	crt.sh
*.company-target.com Go Daddy Secure Certificate Authority - G2	`2019-06-19` - `2021-08-18`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Frame ID: F2CE1E2572E613A5FBE02C4C6949EDA6
Requests: 119 HTTP requests in this frame

Frame: https://junipernetworks.demdex.net/dest5.html?d_nsid=0
Frame ID: 6BD97B9CA111971D635EAD42EBF67D15
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5caeb27864746d4fde0010d0.html
Frame ID: DEE9C3C0D6726AF3C5ABA4D291C1AFDF
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5d487bc864746d25bd00073a.html
Frame ID: AD1BF0F9994B7114B7D9C96EE6672287
Requests: 1 HTTP requests in this frame

Frame: https://5922977.fls.doubleclick.net/activityi;dc_pre=CIz71fTX3-cCFXXluwgdfnYA0A;src=5922977;type=pageview;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6639682050090.881
Frame ID: 9A79845A9836B56C2EE0EAD90EABE1CA
Requests: 1 HTTP requests in this frame

Frame: https://3872718.fls.doubleclick.net/activityi;dc_pre=CJKD1vTX3-cCFYTDuwgd7G4Bmg;src=3872718;type=gojpnet;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6392541218947.796
Frame ID: 745DEDE653EBA6569FE4DD98162C83AA
Requests: 1 HTTP requests in this frame

Frame: https://secure.rmulus.com/?_pevId=vSR4xvEtVHgDRpld9mNYTORIb9skv3i5-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=enabled&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dpgvw%26_pdataSource%3Dweb%26_pqStr%3Denabled%26jnpr_vID%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&jnpr_vID=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pidSource=secure.rmulus.com&_pidName=rmulusId&_pclIp=disabled&_plkpPrfl=disabled
Frame ID: F79F0974C7C42B18B7039380F6FDC841
Requests: 1 HTTP requests in this frame

Frame: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
Frame ID: 6D4B7ACEE5D266B997B7FE4D8567B494
Requests: 19 HTTP requests in this frame

Frame: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
Frame ID: 1CC91DD3F6A592DA7D88E14A3301AC5A
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<script[^>]* src=[^>]+fontawesome(?:\.js)?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

161
Requests

100 %
HTTPS

31 %
IPv6

33
Domains

49
Subdomains

43
IPs

8
Countries

5014 kB
Transfer

12270 kB
Size

0
Cookies

115 Outgoing links

These are links going to different origins than the main page.

URL: https://www.juniper.net/us/en/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/
Title:

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/why-juniper/
Title: Why Juniper?

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/case-studies-customer-success/
Title: Customer Success

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/partners/
Title: Partnership

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/insights/
Title: Thought Leadership

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/how-to-buy/
Title: How to Buy

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/
Title: Products & Solutions

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/ipc/
Title: Identity & Policy Control

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/network-edge-services/
Title: Network Edge Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/nos/
Title: Network Operating System

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/packet-optical/
Title: Packet Optical

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/routing/
Title: Routers

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/management-operations-sdn/
Title: SDN, Management & Operations

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/switching/
Title: Switches

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/wireless/
Title: Wireless

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/a-z/
Title: All Products A-Z

Search URL Search Domain Scan URL

URL: https://www.juniper.net/support/eol/
Title: End of Life

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/
Title: Solutions

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/enterprise/
Title: Enterprise

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/cloud/
Title: Cloud Provider

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/service-provider/
Title: Service Provider

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/automation/
Title: Automation

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/metro/
Title: Metro

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/multicloud/
Title: Multicloud

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/segment-routing/
Title: Segment Routing

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/sd-wan/
Title: SD-WAN

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/cable/
Title: Cable

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/financial/
Title: Financial Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/federal-government/
Title: Federal Government

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/healthcare/
Title: Healthcare

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/mobile-provider/
Title: Mobile Provider

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/nfv/telco-cloud/
Title: Telco

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/
Title: Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/advisory-services/
Title: Advisory Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/implementation-services/
Title: Implementation Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/maintenance-services/
Title: Maintenance Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/managed-services/
Title: Managed Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/onsite-technical-services/
Title: Onsite Technical Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/remote-operational-services/
Title: Remote Operational Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/taas/
Title: Testing as a Service

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/
Title: Support

Search URL Search Domain Scan URL

URL: https://my.juniper.net/#dashboard/overview
Title: MyJuniper

Search URL Search Domain Scan URL

URL: https://my.juniper.net/#dashboard/servicerequests
Title: Service Request Management

Search URL Search Domain Scan URL

URL: https://my.juniper.net/#dashboard/rmas
Title: RMA Management

Search URL Search Domain Scan URL

URL: https://license.juniper.net/licensemanage/
Title: Product License Keys

Search URL Search Domain Scan URL

URL: https://entitlementsearch.juniper.net/entitlementsearch/
Title: Product Entitlement Search

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/uib/index.page
Title: Update Install Base

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/requesting-support/
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=ex
Title: EX Series

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=mx
Title: MX Series

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=srx
Title: SRX Series

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=space
Title: Junos Space

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=ssg
Title: SSG Series

Search URL Search Domain Scan URL

URL: https://kb.juniper.net/
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: https://www.juniper.net/documentation/
Title: TechLibrary

Search URL Search Domain Scan URL

URL: https://prsearch.juniper.net/InfoCenter/index?page=prsearch
Title: Problem Report Search

Search URL Search Domain Scan URL

URL: https://apps.juniper.net/home/
Title: Pathfinder

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/security/
Title: Security Intelligence

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/security/report-vulnerability/
Title: Report a Vulnerability

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/
Title: Training

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=10735
Title: Schedule of Classes

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=EDU-JUN-ALL-HOME
Title: All Access Training Pass

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=10072
Title: On-demand Courses

Search URL Search Domain Scan URL

URL: https://openlearning.juniper.net/
Title: Open Learning

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=EDU-JUN-LPATHS-HOME
Title: Learning Paths

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=5798
Title: Getting Started

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/
Title: Certification

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/getting-started/
Title: Getting Started

Search URL Search Domain Scan URL

URL: https://cloud.contentraven.com/junosgenius/login
Title: Practice Tests

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/exam_registration.page
Title: Exam Registration

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/recertification/
Title: Recertification

Search URL Search Domain Scan URL

URL: https://www.certmetrics.com/juniper/login.aspx?ReturnUrl=%2fjuniper%2f
Title: Manage My Certs

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/try/
Title: Try Now Risk Free

Search URL Search Domain Scan URL

URL: https://iam-signin.juniper.net/home/junipernetworksinc_forumsjnetlithium_1/0oa1i80jjeoOXVFbx0h8/aln1i80l72sYQypO60h8?RelayState=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478
Title: Sign In

Search URL Search Domain Scan URL

URL: https://userregistration.juniper.net/entitlement/setupAccountInfo.do
Title: Register

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/legal-notices/j-net-terms/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/legal-notices/j-net-guidelines/
Title: User Guidelines

Search URL Search Domain Scan URL

URL: https://www.juniper.net/customers/support/
Title: Support

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer/sharer.php?u=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/share?url=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478&text=Dota3:%20Is%20your%20Internet%20of%20Things%20device%20moonlighting?via=%3CUSERNAME%3E
Title:

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Title:

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?url=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478&title=Dota3:%20Is%20your%20Internet%20of%20Things%20device%20moonlighting?&summary=Dissecting%20the%20evolution%20of%20malware%20gives%20researchers%20insights%20into%20the%20knowledge%20of,%20and%20development%20processes%20used%20by,%20malware%20authors.%20Dota3,%20active%20in%20the%20wild,%20offers%20a%20unique%20opportunity%20to%20examine%20a%20strain%20of%20malware%20during%20what%20appears%20to%20be...
Title:

Search URL Search Domain Scan URL

URL: http://foo.net/zhyux22843/rss/message?board.id=threatresearch&message.id=473478
Title:

Search URL Search Domain Scan URL

URL: https://www.rfidjournal.com/articles/view?4986
Title: until around 1999

Search URL Search Domain Scan URL

URL: https://blog.avast.com/iot-devices-around-the-world
Title: Avast provided statistics

Search URL Search Domain Scan URL

URL: https://arstechnica.com/science/2020/01/a-deep-dive-into-the-apollo-guidance-computer-and-the-hack-that-saved-apollo-14/
Title: land Apollo astronauts on the moon

Search URL Search Domain Scan URL

URL: https://www.joesandbox.com/analysis/180632/0/html
Title: is available

Search URL Search Domain Scan URL

URL: https://www.hybrid-analysis.com/sample/0f754eab280e5ff0b65c46bdd1cc16e8aff944c834379df2632cd5f261afe3bb?environmentId=300
Title: reported

Search URL Search Domain Scan URL

URL: https://iam-signin.juniper.net/home/junipernetworksinc_forumsjnetlithium_1/0oa1i80jjeoOXVFbx0h8/aln1i80l72sYQypO60h8?redirectreason=permissiondenied&RelayState=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%23comment-on-this
Title: Comment

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/dm/day-one-million/
Title: Day One Million! Update your Library with our Day One Book Bundles!

Search URL Search Domain Scan URL

URL: https://khoros.com/powered-by-khoros

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/corporate-responsibility/
Title: Corporate Responsibility

Search URL Search Domain Scan URL

URL: https://investor.juniper.net/investor-relations/default.aspx
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://newsroom.juniper.net/
Title: Newsroom

Search URL Search Domain Scan URL

URL: https://events.juniper.net/
Title: Events

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/press-center/images/
Title: Image Library

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/partners/locator/
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/partners/sell-juniper/
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://partners.juniper.net/partnercenter/index.page
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/forms/opt-in-knowledge-preferences/?utm_medium=website&utm_source=juniper&cid=subscriptionspage
Title: Sign up

Search URL Search Domain Scan URL

URL: https://www.facebook.com/JuniperNetworks/
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/JuniperNetworks/
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/junipernetworks
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/juniper-networks
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/junipernetworks/
Title:

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/feedback/
Title: Feedback

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/site-map/
Title: Site Map

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/legal-notices/
Title: Legal Notices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://www.juniper.net/techpubs/assets/css/style/style.min.css HTTP 301
https://www.juniper.net/documentation/assets/css/style/style.min.css

Request Chain 48

https://cm.everesttech.net/cm/dd?d_uuid=23599674941329425930449889934371689051 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk4-5gAAAc8zrC3-

Request Chain 63

https://platform.twitter.com/oct.js HTTP 301
https://static.ads-twitter.com/oct.js

Request Chain 64

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253djuniper.net%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=juniper.net&pId=2124767708950603175

Request Chain 103

https://5922977.fls.doubleclick.net/activityi;src=5922977;type=pageview;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6639682050090.881 HTTP 302
https://5922977.fls.doubleclick.net/activityi;dc_pre=CIz71fTX3-cCFXXluwgdfnYA0A;src=5922977;type=pageview;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6639682050090.881

Request Chain 104

https://3872718.fls.doubleclick.net/activityi;src=3872718;type=gojpnet;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6392541218947.796 HTTP 302
https://3872718.fls.doubleclick.net/activityi;dc_pre=CJKD1vTX3-cCFYTDuwgd7G4Bmg;src=3872718;type=gojpnet;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6392541218947.796

Request Chain 108

https://s1229.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=225&optin=disabled HTTP 302
https://s1229.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=225&optin=disabled&elqCookie=1 HTTP 302
https://tags.bluekai.com/site/37366?vid=e932dafe1c8e4dd1994d30b664a6ff74

Request Chain 111

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AAE5TU68nIAAAC8IZbYKVg HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAE5TU68nIAAAC8IZbYKVg&verifyHash=c6c4ecc99ce5c3fa07c59e0bf1e013ba82642585

Request Chain 115

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2343305-1&cid=1009817513.1582186471&jid=2110321050&gjid=1503267803&_gid=1275773075.1582186471&_u=YGDAgEAB~&z=1163844290 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1009817513.1582186471&jid=2110321050&_v=j81&z=1163844290 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1009817513.1582186471&jid=2110321050&_v=j81&z=1163844290&slf_rd=1&random=3237983594

Request Chain 156

https://px.ads.linkedin.com/collect/?time=1582186472558&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pcityName%3DBrussels%26_pcompanyName%3DM247%2520Ltd%26_pcontinentCode%3DEU%26_pcontinentName%3DEurope%26_pcountryISOCode%3DBE%26_pcountryName%3DBelgium%26_platitude%3D50.8847%26_plongitude%3D4.5049%26_pmatchedIP%3D82.102.19.134%26_ppostalCode%3D1930%26_pstateISOCode%3DBRU%26_pstateName%3DBrussels%2520Capital%26_ptimeZone%3DEurope%252FBrussels%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472&fmt=js&s=1 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1582186472558%26pid%3D4751%26url%3Dhttps%253A%252F%252Fresearch.juniper.net%252F%253F_pevId%253DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%2526_pdLoc%253Dhttps%25253A%25252F%25252Fforums.juniper.net%25252Ft5%25252FThreat-Research%25252FDota3-Is-your-Internet-of-Things-device-moonlighting%25252Fba-p%25252F473478%2526_pdHash%253DUnavailable%2526_pqStr%253Dactive%2526_psqStr%253D%25253F_pclientId%25253Djnpr%252526_peventName%25253Dlkps%252526_pdataSource%25253Dweb%252526_pqStr%25253Denabled%252526_pgetId%25253Dtrue%252526_plkpTblId%25253Djnpr_audiences_targetaccounts_ip%252526_plkpKey%25253D_pclIp._pmatchedIP%252526_plkpPrfl%25253Dactive%252526_pclIp%25253Dactive%252526_pqStr%25253Dactive%252526_pidName%25253DrmulusId%252526_pidSource%25253Dresearch.juniper.net%252526_ptwAids%25253Do1oeb%252526_pfbAids%25253D340159566928684%252526_pliPids%25253D4751%252526_pawAids%25253DAW-956680084%252526jnpr_vId%25253DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%2526_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253D%25257B%252522not%252520found%252522%25253A%252522not%252520found%252522%25257D%2526_pcityName%253DBrussels%2526_pcompanyName%253DM247%252520Ltd%2526_pcontinentCode%253DEU%2526_pcontinentName%253DEurope%2526_pcountryISOCode%253DBE%2526_pcountryName%253DBelgium%2526_platitude%253D50.8847%2526_plongitude%253D4.5049%2526_pmatchedIP%253D82.102.19.134%2526_ppostalCode%253D1930%2526_pstateISOCode%253DBRU%2526_pstateName%253DBrussels%252520Capital%2526_ptimeZone%253DEurope%25252FBrussels%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%2526_pclId%253DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472%26fmt%3Djs%26s%3D1%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect/?time=1582186472558&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pcityName%3DBrussels%26_pcompanyName%3DM247%2520Ltd%26_pcontinentCode%3DEU%26_pcontinentName%3DEurope%26_pcountryISOCode%3DBE%26_pcountryName%3DBelgium%26_platitude%3D50.8847%26_plongitude%3D4.5049%26_pmatchedIP%3D82.102.19.134%26_ppostalCode%3D1930%26_pstateISOCode%3DBRU%26_pstateName%3DBrussels%2520Capital%26_ptimeZone%3DEurope%252FBrussels%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472&fmt=js&s=1&liSync=true

161 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set 473478 Show response
forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/ 239 KB
49 KB 815ms
337ms Document
text/html 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

68b59cc00ec1508f1c08e46c340c9802cdb23ec0b99d0099adaea9f8bb49528a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Host: forums.juniper.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Thu, 20 Feb 2020 08:14:29 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000;includeSubDomains
Set-Cookie: LiSESSIONID=C0D08985E5831F6FD7F1B5763A6DE7A9; Path=/; Secure; HttpOnly LithiumUserInfo=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ LithiumUserSecure=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ LithiumVisitor=~2wii3HySjaT4ig1FP~5JBBkmrJ06Ei-_HPdeeMnG7nOrKuVCZ2l7bnfiJUm-yb76JZ1Hq3-4VRpN4sSX7xuQjn-6AAQ22lek6MrN_cmA..; Expires=Sun, 17-Feb-2030 08:14:29 GMT; Path=/; HttpOnly
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, private
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 49599
Connection: close
Content-Type: text/html;charset=UTF-8

GET
H2 200 satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/ 220 KB
56 KB 77ms
24ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7c9a167fcb4f690dc41db9f58f3ee6a20d3bba39316f2b46c8031c6d8ca300f1

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:22 GMT
server: AkamaiNetStorage
etag: "0857b856340d83f6f1ce4a9b3c416da7:1582139302.127986"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 56773
expires: Thu, 20 Feb 2020 09:14:29 GMT

GET
H2 200 878544ee83.js Show response
use.fontawesome.com/ 9 KB
4 KB 82ms
23ms Script
text/javascript 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/878544ee83.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 79e16119ceda988947279eb9addd1869b4270af3967b69ec9e09713ae4b6572b

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Thu, 06 Jul 2017 20:04:23 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 8516237B55A1345E
etag: W/"734c7204bf19e6c6fe89c31ce2ed51a6"
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=0, private, must-revalidate
x-amz-id-2: 7hG4Mt7S1IVbL2byDpZiYCLZME3I6GwctNcdteUIXRNH0RX7D9+4yS+G/7grac9V1ybJ0lWb4Zk=

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.1.4/ 82 KB
29 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 01 Feb 2020 08:31:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1640554
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29725
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 31 Jan 2021 08:31:55 GMT

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
20 KB 36ms
8ms Stylesheet
text/css 2001:4de0:ac19::1:b:1a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: style
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:34:07 GMT
access-control-allow-origin: *
etag: "1544639647"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 19740

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 36 KB
10 KB 40ms
13ms Script
text/javascript 2001:4de0:ac19::1:b:1a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:33:51 GMT
access-control-allow-origin: *
etag: "1544639631"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 9832

GET
H2 200 juniperresponsive.css
jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/ 2 MB
248 KB 110ms
18ms Stylesheet
text/css 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BB8) /

Resource Hash

85d9f9ab745f8b1dd6c6dc27722498c9eaf0f1e864242b01c7f396a5fb3aa3dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Mon, 25 Nov 2019 08:21:03 GMT
server: ECS (amb/6BB8)
age: 473634
vary: Accept-Encoding
x-cache: HIT
content-type: text/css;charset=UTF-8
status: 200
cache-control: s-maxage=1408554
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 253467
expires: Fri, 19 Feb 2021 08:14:29 GMT

GET
H2 200 vtoolkit-extras.css
www.juniper.net/us/en/community/css/ 4 KB
2 KB 52ms
16ms Stylesheet
text/css 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/us/en/community/css/vtoolkit-extras.css

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

626ef4978a3758ced595afe37b89812432ef49fe3f967d2cd8e1321459b3a9b8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
content-length: 1365
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 16 Sep 2014 23:06:53 GMT
server: Apache
date: Thu, 20 Feb 2020 08:14:29 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=153662
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 grunticon.loader.js Show response
www.juniper.net/assets/svg/ 804 B
1001 B 58ms
23ms Script
application/javascript 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/svg/grunticon.loader.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

b1110f2c7ae9f0a22977c4df6431fdfef92d1e8223f9734713e57aeb2ee96fcf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
content-length: 514
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 02 Oct 2017 07:57:28 GMT
server: Apache
date: Thu, 20 Feb 2020 08:14:29 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=137045
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 lib.min.js Show response
www.juniper.net/assets/library/ 202 KB
65 KB 61ms
26ms Script
application/javascript 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/library/lib.min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

eec3860fdc0bff086a73a04051948c4e76ea29a6b61eaa870083739555b83f64

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
content-length: 66076
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 02 Oct 2017 07:57:27 GMT
server: Apache
date: Thu, 20 Feb 2020 08:14:29 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=26468
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr.min.js Show response
www.juniper.net/assets/scripts/ 339 KB
103 KB 69ms
34ms Script
application/javascript 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.juniper.net/assets/scripts/jnpr.min.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43 /
Resource Hash: 2c9f1c57bc31c65cdb84a1c44c0c91fc88799512fd87c5bc6e52b21f69abd5d0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Fri, 09 Nov 2018 18:57:29 GMT
server: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: application/javascript
status: 200
access-control-max-age: 1000
cache-control: public, max-age=140010
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
content-length: 104943
x-ua-compatible: IE=edge,chrome=1

GET
H2

200

style.min.css
www.juniper.net/documentation/assets/css/style/
Redirect Chain

https://www.juniper.net/techpubs/assets/css/style/style.min.css
https://www.juniper.net/documentation/assets/css/style/style.min.css

2 MB
404 KB

341ms
340ms

Stylesheet
text/css

2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/documentation/assets/css/style/style.min.css

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

79340c32d5422c3331db60c78f9854b0d9c0a9bd0f9c454b7398734c1b990658

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 17 Oct 2016 23:30:57 GMT
server: Apache
date: Thu, 20 Feb 2020 08:14:30 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=259200, public
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

Redirect headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
status: 301
access-control-max-age: 1000
content-length: 275
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
server: Apache
location: https://www.juniper.net/documentation/assets/css/style/style.min.css
date: Thu, 20 Feb 2020 08:14:29 GMT
strict-transport-security: max-age=31536000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: *
cache-control: max-age=5
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
expires: Thu, 20 Feb 2020 08:14:34 GMT

GET
H2 200 05cb80fc-3221-476f-983d-76dfa0b1370c.css
cloud.webtype.com/css/ 38 KB
9 KB 81ms
18ms Stylesheet
text/css 93.184.220.41
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.webtype.com/css/05cb80fc-3221-476f-983d-76dfa0b1370c.css
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.41 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BC8) /
Resource Hash: 3eadffc329fb1c32ee10e809962cb4114a71d92b0f30db0b9ba9bef6abc91015

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 31 Jan 2018 08:43:22 GMT
server: ECS (amb/6BC8)
age: 225330
etag: "870837579"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
status: 200
cache-control: max-age=604800
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8995
expires: Thu, 27 Feb 2020 08:14:29 GMT

GET
H2 200 lia-scripts-head-min.js Show response
jnet.i.lithium.com/t5/scripts/EF7B13D9B64EB8BBD9C87DD3095E9284/ 12 KB
4 KB 109ms
18ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/EF7B13D9B64EB8BBD9C87DD3095E9284/lia-scripts-head-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B89) /

Resource Hash

01eb8f5a91c70faa5681a3048eab75e78f30b4c4e0c04f8afbb46bfa98371ec0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:14:14 GMT
server: ECS (amb/6B89)
age: 368
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=2364
strict-transport-security: max-age=31536000;includeSubDomains
content-length: 4316
expires: Thu, 18 Feb 2021 11:37:24 GMT

GET
H2 200 lia-scripts-head-min.js Show response
jnet.i.lithium.com/t5/scripts/211F6EC4D6F385A1FE3DDCF161E416CD/ 4 KB
2 KB 140ms
51ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/211F6EC4D6F385A1FE3DDCF161E416CD/lia-scripts-head-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BA6) /

Resource Hash

8febd8b0e9b817a31d401574d8f8aaeb5003d76c2c1afa9da932fa0990685b53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:13:41 GMT
server: ECS (amb/6BA6)
age: 368
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=2371
strict-transport-security: max-age=31536000;includeSubDomains
content-length: 1464
expires: Thu, 18 Feb 2021 11:37:24 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 374 B
1 KB 164ms
48ms XHR
application/json 34.249.192.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=D206123F524450F50A490D45%40AdobeOrg&d_nsid=0&ts=1582186469685

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.192.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-192-36.eu-west-1.compute.amazonaws.com

Software

Resource Hash

9fe23bd043e18d262b1ee628108185e934ef555f4711f5149d4ffac94c117de5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v061-0f7fdc12a.edge-irl1.demdex.com 5.65.0.20200212140016 3ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: tfBmfwnFQmg=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://forums.juniper.net
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 310
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/ 74 KB
27 KB 25ms
25ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9912c03b52a7cb0fc11bde58e200010eca671219552929b31be4c2e26c0e10c3

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:23 GMT
server: AkamaiNetStorage
etag: "b8f6521187f987f1e079c5d7031aabec:1582139303.304738"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 27369
expires: Thu, 20 Feb 2020 09:14:29 GMT

GET
H2 200 satellite-57b12a8364746d4d41000291.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 3 KB
1 KB 27ms
27ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12a8364746d4d41000291.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e8a8cd48f7f93a8c8d708eda1f3f9c6ddd886c3f6c38eee67aeac98897b09510

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:42 GMT
server: AkamaiNetStorage
etag: "3b522f8dca2496b57a53408a29d518bb:1582139322.471537"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 984
expires: Thu, 20 Feb 2020 09:14:29 GMT

GET
H2 200 wRPiG49f.min.js Show response
scripts.demandbase.com/adobeanalytics/ 5 KB
2 KB 65ms
20ms Script
application/javascript 13.35.253.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/adobeanalytics/wRPiG49f.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.107 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-107.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c30c04eb35d4ff5c75690016858f8678b3c5ee7c68ec4cd76b71573b50a23943

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: AzsFJIGyGDhT_pDrBVxBwyrIy6KuSZqJ
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 22:00:33 GMT
server: AmazonS3
age: 70956
date: Wed, 19 Feb 2020 12:31:54 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: NMaAWycrO8oluL0K6Db8bW-moe8RFRjgYiw2kZI87miU2doY6CNTrg==
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)

GET
H/1.1 200
OK ip.json Show response
api.demandbase.com/api/v2/ 462 B
922 B 135ms
56ms Script
application/javascript 13.35.253.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.demandbase.com/api/v2/ip.json?key=364bbfa27ca300ef9638e9d163c1fb03&callback=Dmdbase_CDC.callback
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.91 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-91.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: abeaf4a2dde5b673ce9957f08cb803a54d6b82b90bc1fa958a8335168d501c8b

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 20 Feb 2020 08:14:29 GMT
Identification-Source: CENTRAL
X-Amz-Cf-Pop: FRA6-C1
Transfer-Encoding: chunked
X-Cache: Miss from cloudfront
Connection: keep-alive
Request-ID: c2e422ce-dc1e-4e16-af8a-b9f4416ee6b3
Content-Encoding: gzip
Pragma: no-cache
Server: nginx
Vary: Accept-Encoding, Origin
Content-Type: application/javascript;charset=utf-8
Via: 1.1 baa5702f7bd64fcbae1e3bd950d9a245.cloudfront.net (CloudFront)
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Api-Version: v2
X-Amz-Cf-Id: QI-6AkqcyZNAFcVcZBgh49AUKEKxX3dKIiILGrF84FdEz4JCQik5WA==
Expires: Wed, 19 Feb 2020 08:14:29 GMT

GET
H2 200 satellite-5bd31e9364746d6b860045a0.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 883 B
679 B 26ms
26ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5bd31e9364746d6b860045a0.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 179f42988ae4cab77687b27656fc69ab3fa07efbcf6279ac1bef85ac0688e69d

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:37 GMT
server: AkamaiNetStorage
etag: "b3998ca07afe5ed1d91aa042d31218db:1582139317.320586"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 434
expires: Thu, 20 Feb 2020 09:14:29 GMT

GET
H2 200 satellite-57d9c57464746d4d3e010a86.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 2 KB
1001 B 27ms
26ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57d9c57464746d4d3e010a86.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7ee39e6b76207efc841a6882a2af5241490e1a2161c4e13790f78fb4dbfdde28

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 15:13:07 GMT
server: AkamaiNetStorage
etag: "458ad1cb95d004fd440d76d56ca277df:1582125187.473863"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 755
expires: Thu, 20 Feb 2020 09:14:29 GMT

GET
H2 200 satellite-58a48a3864746d025c00d79f.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 156 B
373 B 27ms
26ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-58a48a3864746d025c00d79f.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7da66ec546c027bfe5b9ca59aa2225cfaa5f0d68f96801f31186878c0fa853f8

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:37 GMT
server: AkamaiNetStorage
etag: "bbf4e24515459a70357a852ca14861ff:1582139317.03016"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 129
expires: Thu, 20 Feb 2020 09:14:29 GMT

GET
H2 200 satellite-5cb8c2a664746d2308000a38.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 628 B
672 B 40ms
37ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5cb8c2a664746d2308000a38.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c74679537a89890b260d93e19aad5f4cc95a230623a945ffcc3d981fc13a1adf

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:34 GMT
server: AkamaiNetStorage
etag: "d0c9f868e386e1a9e35ae77ce39994c4:1582139314.935187"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 427
expires: Thu, 20 Feb 2020 09:14:30 GMT

GET
H2 200 satellite-5ced369c64746d5ad2000705.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 802 B
663 B 41ms
39ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5ced369c64746d5ad2000705.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3e84bcc6469e170029339c0b60b522671ca5d4298578308ec882df95f7badd9c

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:35 GMT
server: AkamaiNetStorage
etag: "95e1885cf743f564cb30ce957416ea37:1582139315.859817"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 417
expires: Thu, 20 Feb 2020 09:14:30 GMT

GET
H2 200 satellite-5da0c41564746d1a08001540.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 421 B
515 B 42ms
40ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5da0c41564746d1a08001540.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e28195ef556c2e1f2d22ff939f487f10a32e608255bbd541be3eda5883b414c3

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 12:36:54 GMT
server: AkamaiNetStorage
etag: "c6bf9762b7fcef23638a4087e99a0057:1581683814.317035"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 270
expires: Thu, 20 Feb 2020 09:14:30 GMT

GET
H2 200 0%2C1%2C366%2C367
jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/150x150/image-coordinates/ 37 KB
37 KB 21ms
19ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/150x150/image-coordinates/0%2C1%2C366%2C367?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BAF) /

Resource Hash

272a2861dab52511f662603420b847ab73e6e13e75e8973c3091bdaa44c51706

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Sat, 15 Feb 2020 00:11:23 GMT
server: ECS (amb/6BAF)
age: 831
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="jesselands.png"; filename*=UTF-8''jesselands.png
accept-ranges: bytes
content-length: 37498
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 684x486
jnet.i.lithium.com/t5/image/serverpage/image-id/20779i3539FA8C153F6E73/image-dimensions/ 533 KB
533 KB 30ms
27ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20779i3539FA8C153F6E73/image-dimensions/684x486?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B94) /

Resource Hash

70c2868114f52cb3b41e70e017c88ee5f5495639db9d495574e8ced55e7b272f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Wed, 12 Feb 2020 13:27:51 GMT
server: ECS (amb/6B94)
age: 831
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3.png"; filename*=UTF-8''dota3.png
accept-ranges: bytes
content-length: 545543
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 503x331
jnet.i.lithium.com/t5/image/serverpage/image-id/20797iC53A9D84A3C97460/image-dimensions/ 115 KB
116 KB 22ms
20ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20797iC53A9D84A3C97460/image-dimensions/503x331?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B93) /

Resource Hash

ec895e944daf4d8226fe560ff1d95437497215d33885fe2d0db0e54ce3db6d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Wed, 19 Feb 2020 13:08:54 GMT
server: ECS (amb/6B93)
age: 831
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="Distribution.png"; filename*=UTF-8''Distribution.png
accept-ranges: bytes
content-length: 118086
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 large
jnet.i.lithium.com/t5/image/serverpage/image-id/20782i42844564DAEF47B7/image-size/ 32 KB
32 KB 26ms
24ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20782i42844564DAEF47B7/image-size/large?v=1.0&px=999

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B95) /

Resource Hash

506339130f152becadfa3ab2fbdbab5261035e4f9c343440ec23bc178cdc164a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Wed, 12 Feb 2020 16:32:43 GMT
server: ECS (amb/6B95)
age: 831
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3-3.png"; filename*=UTF-8''dota3-3.png
accept-ranges: bytes
content-length: 32975
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 large
jnet.i.lithium.com/t5/image/serverpage/image-id/20783i20520A6CAC9212AE/image-size/ 24 KB
24 KB 27ms
25ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20783i20520A6CAC9212AE/image-size/large?v=1.0&px=999

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BBE) /

Resource Hash

4c5ed401667661bca33d013a7bc790e2079bbe0300a1a1d5ad5e5780ae259a4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Wed, 12 Feb 2020 16:34:08 GMT
server: ECS (amb/6BBE)
age: 831
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3-4.png"; filename*=UTF-8''dota3-4.png
accept-ranges: bytes
content-length: 24746
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 large
jnet.i.lithium.com/t5/image/serverpage/image-id/20784i599AEA1C8ECD5925/image-size/ 30 KB
30 KB 28ms
26ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20784i599AEA1C8ECD5925/image-size/large?v=1.0&px=999

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B94) /

Resource Hash

e61de02b5fa3204c2ed29bd12fcdceaff8d33d4e9be52ff1a6c02a03a407baea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Wed, 12 Feb 2020 16:34:19 GMT
server: ECS (amb/6B94)
age: 831
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3-5.png"; filename*=UTF-8''dota3-5.png
accept-ranges: bytes
content-length: 30545
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 755x496
jnet.i.lithium.com/t5/image/serverpage/image-id/20796i80B748112082D58C/image-dimensions/ 246 KB
247 KB 47ms
44ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20796i80B748112082D58C/image-dimensions/755x496?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B93) /

Resource Hash

4a3d7f509f217225975b98891f41fde0b216552b35f9a76460e86aaf52454733

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Wed, 19 Feb 2020 13:07:15 GMT
server: ECS (amb/6B93)
age: 831
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="Distribution.png"; filename*=UTF-8''Distribution.png
accept-ranges: bytes
content-length: 252266
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 0%2C64%2C512%2C576
jnet.i.lithium.com/t5/image/serverpage/image-id/17154i981F324E669B8EEF/image-dimensions/40x40/image-coordinates/ 788 B
931 B 47ms
45ms Image
image/jpeg 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/17154i981F324E669B8EEF/image-dimensions/40x40/image-coordinates/0%2C64%2C512%2C576?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B90) /

Resource Hash

1d111313a277d37912be5ec29e0d77426d991feb85a04106694b72f66739885b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Mon, 16 Oct 2017 18:18:34 GMT
server: ECS (amb/6B90)
age: 831
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/jpeg;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="Mounir.jpg"; filename*=UTF-8''Mounir.jpg
accept-ranges: bytes
content-length: 788
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 avatar-17x17.gif
jnet.i.lithium.com/html/images/ 1 KB
1 KB 47ms
45ms Image
image/gif 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/html/images/avatar-17x17.gif

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B9A) /

Resource Hash

bacc031e0bfe9a4084bb166f88193dcdc3498aab6b1d14ebedbb75045afce823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Tue, 19 Sep 2017 14:30:17 GMT
server: ECS (amb/6B9A)
age: 223618
etag: W/"1089-1505831417000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/gif
status: 200
accept-ranges: bytes
content-length: 1089

GET
H2 200 2%2C0%2C368%2C366
jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/40x40/image-coordinates/ 5 KB
5 KB 47ms
45ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/40x40/image-coordinates/2%2C0%2C368%2C366?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B9A) /

Resource Hash

92dc916bc3b1001de758bc7fa95b57046ab5a80f1da16558fe8c8051d331f211

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Sat, 15 Feb 2020 00:11:23 GMT
server: ECS (amb/6B9A)
age: 662
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="jesselands.png"; filename*=UTF-8''jesselands.png
accept-ranges: bytes
content-length: 4777
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 0%2C12%2C398%2C410
jnet.i.lithium.com/t5/image/serverpage/image-id/17505i1378C151B2E2CB8F/image-dimensions/40x40/image-coordinates/ 4 KB
5 KB 52ms
50ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/17505i1378C151B2E2CB8F/image-dimensions/40x40/image-coordinates/0%2C12%2C398%2C410?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BAC) /

Resource Hash

30e3f5a97af46d8cb43bf62c9875a8eacfc02c00826ea47549d4e33d0e1aa446

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Fri, 05 Jan 2018 21:00:31 GMT
server: ECS (amb/6BAC)
age: 831
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="paulkimayong.png"; filename*=UTF-8''paulkimayong.png
accept-ranges: bytes
content-length: 4533
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H2 200 powered_by_khoros.svg
jnet.i.lithium.com/skins/images/E0872AD914481B6897B132EA77B54EA2/responsive_peak/images/ 5 KB
2 KB 52ms
50ms Image
image/svg+xml 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/skins/images/E0872AD914481B6897B132EA77B54EA2/responsive_peak/images/powered_by_khoros.svg

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B89) /

Resource Hash

44c53106498ced14c80aab52391120b380216ce24de07bb5a91e659fd3ba8aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 20:27:33 GMT
server: ECS (amb/6B89)
age: 26117
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml;charset=UTF-8
status: 200
cache-control: s-maxage=89731
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1759
expires: Fri, 19 Feb 2021 08:14:30 GMT

GET
H/1.1 200
OK global-nav.js Show response
forumstage.juniper.net/html/assets/ 218 KB
61 KB 950ms
169ms Script
text/javascript 208.74.205.254
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forumstage.juniper.net/html/assets/global-nav.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.205.254 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

sjc1-secure06.stage.lithium.com

Software

Apache /

Resource Hash

1451b7c400c9e305f589883bbe1b45139abc74e3c977a8b91fa353dda6a642cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 20 Feb 2020 08:14:30 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 Nov 2019 19:39:15 GMT
Server: Apache
ETag: W/"223725-1574451555000-gzip"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age,Accept-Encoding
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: close
Accept-Ranges: bytes

GET
H2 200 lia-scripts-angularjs-min.js Show response
jnet.i.lithium.com/t5/scripts/30B7B7689E52F3255F63CF558D0B2099/ 170 KB
59 KB 18ms
18ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/30B7B7689E52F3255F63CF558D0B2099/lia-scripts-angularjs-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BC1) /

Resource Hash

18b4b83afed32c0ec228e62a5f1080fbad1ca25addd958a4fc8b30c281fcc031

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:13:46 GMT
server: ECS (amb/6BC1)
age: 4007
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=6754
strict-transport-security: max-age=31536000;includeSubDomains
content-length: 60495
expires: Thu, 18 Feb 2021 18:43:28 GMT

GET
H2 200 lia-scripts-angularjsModules-min.js Show response
jnet.i.lithium.com/t5/scripts/C44E419D0E33CF45E26475BACEAD7B0A/ 399 KB
107 KB 18ms
18ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/C44E419D0E33CF45E26475BACEAD7B0A/lia-scripts-angularjsModules-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BAD) /

Resource Hash

ed3a677654473b8329f8d886993e734d6cef36c4273263b767be878c9ff8ff44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 20:34:35 GMT
server: ECS (amb/6BAD)
age: 830
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=886
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 109772
expires: Sat, 13 Feb 2021 22:02:15 GMT

GET
H2 200 lia-scripts-common-min.js Show response
jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/ 329 KB
89 KB 338ms
338ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/lia-scripts-common-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

9c3e9a35283d074cbf4f873b077e78b5a8cbd9a8bb4caa5ccc09e0142962a65a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:16:17 GMT
server: Apache
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=5
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 91306
expires: Thu, 18 Feb 2021 08:16:46 GMT

GET
H2 200 lia-scripts-body-min.js Show response
jnet.i.lithium.com/t5/scripts/017CCF1E185FD02333D9F6BBEFAD643F/ 45 KB
12 KB 322ms
322ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/017CCF1E185FD02333D9F6BBEFAD643F/lia-scripts-body-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

5b6b9462f29599d5332fa41d67010d03aa0aadb939144caad40e341bd3a2939a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:17:14 GMT
server: Apache
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=789
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 12285
expires: Thu, 18 Feb 2021 09:23:01 GMT

GET
H2 200 878544ee83.css
use.fontawesome.com/ 1 KB
686 B 23ms
23ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/878544ee83.css
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/878544ee83.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 9e5b8d4ced66c172dc84f16051eee4bac1e0fc60781c1ea05d73072b3cc7ddf1

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Thu, 06 Jul 2017 20:04:23 GMT
server: NetDNA-cache/2.2
x-amz-request-id: EC1778A208C64F6D
etag: W/"44b78b10e53fb4ffb2d9c54f11d4eb0f"
x-cache: HIT
content-type: text/css
status: 200
cache-control: max-age=0, private, must-revalidate
x-amz-id-2: T2klv9ma2j25ViD4AF26CrPqAlJVK+CNLfLjR7WzUde9VDdZ0YjB6rGKnxH2lCYWPXWyWMzjW/8=

GET
H2 200 css
fonts.googleapis.com/ 2 KB
562 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 08:14:29 GMT
server: ESF
date: Thu, 20 Feb 2020 08:14:29 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 20 Feb 2020 08:14:29 GMT

GET
H2 200 font-awesome-css.min.css
use.fontawesome.com/releases/v4.7.0/css/ 30 KB
8 KB 25ms
24ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v4.7.0/css/font-awesome-css.min.css
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
content-encoding: gzip
last-modified: Tue, 25 Oct 2016 17:21:58 GMT
server: NetDNA-cache/2.2
access-control-allow-origin: *
etag: W/"36082410df2ef7f83932219089dc1443"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 fontawesome-webfont.woff2
jnet.i.lithium.com/html/assets/fonts/ 55 KB
56 KB 71ms
18ms Font
application/octet-stream 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/fonts/fontawesome-webfont.woff2?v=4.3.0

Requested by

Host: use.fontawesome.com
URL: https://use.fontawesome.com/878544ee83.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B7C) /

Resource Hash

aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:29 GMT
last-modified: Wed, 05 Feb 2020 08:30:01 GMT
server: ECS (amb/6B7C)
age: 516263
etag: W/"56780-1580891401000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/octet-stream
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56780

GET
H2 404 fontawesome.woff
jnet.i.lithium.com/skins/4081847/fonts/ 0
0 363ms
310ms Font
text/html 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/skins/4081847/fonts/fontawesome.woff

Requested by

Host: use.fontawesome.com
URL: https://use.fontawesome.com/878544ee83.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 20 Feb 2020 08:14:30 GMT
server: Apache
access-control-allow-origin: *
content-length: 866
strict-transport-security: max-age=31536000;includeSubDomains
content-type: text/html;charset=utf-8

GET
H2 200 id Show response
junipernetworks.d2.sc.omtrdc.net/ 2 B
320 B 720ms
181ms XHR
application/x-javascript 18.138.216.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://junipernetworks.d2.sc.omtrdc.net/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=D206123F524450F50A490D45%40AdobeOrg&mid=29655759245099169021142167160330775484&ts=1582186469860

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.138.216.223 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-138-216-223.ap-southeast-1.compute.amazonaws.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Thu, 20 Feb 2020 08:14:30 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-665bcdccf8-2b4fs
vary: Origin
x-c: master-1169.Ie4359b.M0-349
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://forums.juniper.net
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 2
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Xk4-5gAAAc8zrC3-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=23599674941329425930449889934371689051
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk4-5gAAAc8zrC3-

42 B
915 B

38ms
38ms

Image
image/gif

34.249.192.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk4-5gAAAc8zrC3-

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.192.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-192-36.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v061-0b4668c3d.edge-irl1.demdex.com 5.65.0.20200212140016 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: AsYB3LNXSX0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Thu, 20 Feb 2020 08:14:30 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk4-5gAAAc8zrC3-
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 404 fontawesome.ttf
jnet.i.lithium.com/skins/4081847/fonts/ 0
0 300ms
300ms Font
text/html 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/skins/4081847/fonts/fontawesome.ttf

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 20 Feb 2020 08:14:30 GMT
server: Apache
access-control-allow-origin: *
content-length: 866
strict-transport-security: max-age=31536000;includeSubDomains
content-type: text/html;charset=utf-8

GET
H/1.1 200
OK BBBthreatresearchportal.jpeg
forums.juniper.net/html/assets/ 105 KB
105 KB 495ms
167ms Image
image/jpeg 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forums.juniper.net/html/assets/BBBthreatresearchportal.jpeg

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

ad9e90d9b2ef8c8af06afa88f231a5cf0dff89eb5c47a948dfbde3c856c7db39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 20 Feb 2020 08:14:30 GMT
Last-Modified: Mon, 12 Mar 2018 23:05:28 GMT
Server: Apache
ETag: W/"107422-1520895928000"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age
Content-Type: image/jpeg
Connection: close
Strict-Transport-Security: max-age=31536000;includeSubDomains
Accept-Ranges: bytes
Content-Length: 107422

GET
H/1.1 200
OK v.gif
pls.webtype.com/ 807 B
1 KB 1341ms
334ms Image
image/gif 65.52.62.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pls.webtype.com/v.gif?ct=182296,182293,182299,182294,182298,182295,182297,182293,182294,182298,182295,182297,182299,182296,182299,182298,182293,182296,182295,182294,182297,182296,182297,182295,182294,182298,182293,182299&r=71911&p=68690&h=Hzc0I5MIWElYX3SnOIHSGw%3d%3d
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 65.52.62.25 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Referer: https://cloud.webtype.com/css/05cb80fc-3221-476f-983d-76dfa0b1370c.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 20 Feb 2020 08:14:31 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: no-cache
Content-Length: 807
Expires: -1

GET
H2 200 Lato-Regular.woff2
jnet.i.lithium.com/html/assets/ 178 KB
179 KB 18ms
18ms Font
application/octet-stream 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/Lato-Regular.woff2

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B97) /

Resource Hash

983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Tue, 25 Sep 2018 18:37:35 GMT
server: ECS (amb/6B97)
age: 224042
etag: W/"182708-1537900655000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/octet-stream
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 182708

GET
H/1.1 200
OK Cookie set dest5.html
junipernetworks.demdex.net/ Frame 6BD9 0
0 202ms
41ms Document
text/html 34.253.43.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://junipernetworks.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.253.43.81 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-253-43-81.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: junipernetworks.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=23599674941329425930449889934371689051
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 19 Feb 2020 10:21:25 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=23599674941329425930449889934371689051;Path=/;Domain=.demdex.net;Expires=Tue, 18-Aug-2020 08:14:30 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: zFbWK733RVM=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 search.png
jnet.i.lithium.com/html/assets/ 1 KB
1 KB 18ms
18ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/html/assets/search.png

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BC3) /

Resource Hash

847ad7d2d327222488e06177809a66d0517d53362838b94dfd3f1961d209d8b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Tue, 19 Sep 2017 14:30:17 GMT
server: ECS (amb/6BC3)
age: 224041
etag: W/"1135-1505831417000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 1135

GET
H/1.1 200
OK DayOneMillionBanner.png
forumstage.juniper.net/html/assets/ 970 KB
970 KB 488ms
162ms Image
image/png 208.74.205.254
LITHIUM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forumstage.juniper.net/html/assets/DayOneMillionBanner.png

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.205.254 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

sjc1-secure06.stage.lithium.com

Software

Apache /

Resource Hash

3928a8be3b073b7b4272b3863934222d52f00e782a0d157b9b7edfd7acf1bfbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 20 Feb 2020 08:14:31 GMT
Strict-Transport-Security: max-age=31536000;includeSubDomains
Last-Modified: Fri, 26 Apr 2019 21:22:32 GMT
Server: Apache
ETag: W/"992924-1556313752000"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 992924

GET
H2 200 AcceptedSolutionsBanner.png
jnet.i.lithium.com/html/assets/ 188 KB
188 KB 18ms
18ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/html/assets/AcceptedSolutionsBanner.png

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BBE) /

Resource Hash

cac7a767eecdd70123f853d74d1fb29d15cb89dfd93215b57dce2606b4cd1c23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Thu, 03 May 2018 22:11:29 GMT
server: ECS (amb/6BBE)
age: 176960
etag: W/"192650-1525385489000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 192650

GET
H2 200 Lato-Bold.woff2
jnet.i.lithium.com/html/assets/ 181 KB
181 KB 20ms
20ms Font
application/octet-stream 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/Lato-Bold.woff2

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B84) /

Resource Hash

ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Tue, 25 Sep 2018 18:21:34 GMT
server: ECS (amb/6B84)
age: 224039
etag: W/"184912-1537899694000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/octet-stream
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 184912

GET
H2 200 FontAwesome.otf
jnet.i.lithium.com/html/assets/ 48 KB
48 KB 18ms
18ms Font
application/x-font-otf 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/FontAwesome.otf

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BA0) /

Resource Hash

e5d717d2c24e52afc0e139b41d817580583acad2e3c9d725d1bd46f0f7e5cb1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Tue, 19 Sep 2017 14:30:17 GMT
server: ECS (amb/6BA0)
age: 221700
etag: W/"48748-1505831417000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/x-font-otf
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48748

GET
H2 200 a0cedc3e-6840-426e-97b1-3c84003749db
cloud.webtype.com/webtype/ff2/3/ 55 KB
55 KB 73ms
18ms Font
application/octet-stream 93.184.220.41
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.webtype.com/webtype/ff2/3/a0cedc3e-6840-426e-97b1-3c84003749db?ec_token=8f7c4c4997246fd7fa920371cd943b561cc1376e933e830d08e6b0683939639d404785f456ee32575101d725923746fca6e69ff51fcfe5b050225f7c73898261a8782877c56c75752b53bd7904d2031d391fe58f03b9699949fd97a6a2ff0e846b9b5f7b238ef0e3e218f881633f84a6df8f6e3c42389b1f2ede2dd7cf99517d94747b6b1931154fae658ce8ed6ce4ae462da9a2caf5829564405b9a4734ebc0468dd1924c31ed0fbbcc1f8f3738b30362a8434fa1f27b11671762c5ca8e3dc1215a83fb6889348f3eb94edaa393481a20d66c33d733092de1f6e0d3d8f7bdc0195d51e35058fd4bd2cd093b03b5bb12f6144c99d0aff4&ec_token=8f7c4c4997246fd7fa920376cc943b5654522473d8a897cacca97149c4e47f6f58194b50d81812299938889f52af0c1606db01f5be73b0deef52167fa79f12b243aff40a15ac84109f59783d30e511148a6dae4a711358f22b6206a2f996042606d5449df7366ee850657c2e998ae60e1825a00958d3ce1c5e7085a3d6eb82a8614189a4023ff9c5bdd7b05a25fe732e7b1b66d3387e3b492e8886adbde3cfee77939e8d1f63817ab735b2504ec31754c9241fa74730508eca7af76aeb3c0a684994a21e0356e79ee6b3bb4ab55048106ca56cd7bb487524c384b9adf60e1944e2450c73f7e1b30ae197ac26
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.41 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BB5) /
Resource Hash: 4ded81a3d2fd6dd9c1240d80be198e98eb78db7dc4e3e525fd21ffc0c05efbcd

Request headers

Referer: https://cloud.webtype.com/css/05cb80fc-3221-476f-983d-76dfa0b1370c.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Fri, 23 Oct 2015 21:28:48 GMT
server: ECS (amb/6BB5)
age: 222531
etag: "657538501"
x-cache: HIT
content-type: application/octet-stream
status: 200
cache-control: max-age=604800
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56080
expires: Thu, 27 Feb 2020 08:14:30 GMT

GET
H2 200 json Show response
junipernetworks.tt.omtrdc.net/m2/junipernetworks/mbox/ 537 B
799 B 145ms
70ms XHR
application/json 66.117.29.6
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://junipernetworks.tt.omtrdc.net/m2/junipernetworks/mbox/json?mbox=target-global-mbox&mboxSession=8bc62a27dfef4a14af4301a793374005&mboxPC=&mboxPage=e59fdeb251de4d0784e5972cb4d9c7ae&mboxRid=cfb4db06ba4a4991b7b2b1665f3e0b69&mboxVersion=1.6.2&mboxCount=1&mboxTime=1582190069878&mboxHost=forums.juniper.net&mboxURL=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=60&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&profile.isp=true&profile.audience=Bot&profile.audience_segment=&at_property=731b0e75-98c0-3152-d94c-88331af4fd48&mboxMCSDID=291A17710B9F48D4-6953C3587F910B1D&vst.trk=junipernetworks.d2.sc.omtrdc.net&vst.trks=junipernetworks.d2.sc.omtrdc.net&mboxMCGVID=29655759245099169021142167160330775484&mboxAAMB=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&mboxMCGLH=6
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.117.29.6 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: /
Resource Hash: f084c102586ae8b161379d7b96d20408bab4577337e96829fb88576e0f9b075d

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:30 GMT
status: 200
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://forums.juniper.net
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 537
x-request-id: cfb4db06ba4a4991b7b2b1665f3e0b69

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 126 KB
30 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5cb8c2a664746d2308000a38.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: raUFI/o6CJPg70nfZsFaPgrH9qPowb5wextIB3x7tdmToFj6reh/QQ058oE/ulJLnlHEYgZhlsK3gRtQ2I+/mQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:14:30 GMT, Thu, 20 Feb 2020 08:14:30 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 22ms
22ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5ced369c64746d5ad2000705.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
age: 14
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19173-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582186471.689041,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2

200

oct.js Show response
static.ads-twitter.com/
Redirect Chain

https://platform.twitter.com/oct.js
https://static.ads-twitter.com/oct.js

5 KB
2 KB

22ms
22ms

Script
application/javascript

151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/oct.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
age: 10
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19173-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582186471.783632,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

Redirect headers

date: Thu, 20 Feb 2020 08:14:30 GMT
location: https://static.ads-twitter.com/oct.js
vary
x-cache: HIT
tw-cdn: FT
status: 301
accept-ranges: bytes
content-length: 0
retry-after: 0
x-served-by: cache-fra19129-FRA

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253djuniper.net%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=juniper.net&pId=2124767708950603175

4 B
484 B

285ms
187ms

Image
image/jpeg

13.35.253.77
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=juniper.net&pId=2124767708950603175
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.77 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-77.fra6.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 08:14:31 GMT
Via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
x-amzn-RequestId: ff343de1-64f7-47da-b2f5-1279c9d2ab63
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5e4e3fe7-855c653098d474f8ac1f8420;Sampled=0
Connection: keep-alive
x-amz-apigw-id: IL7sKFgcoAMFmJg=
Content-Length: 4
X-Amz-Cf-Id: 5M_vps7EF4HaD0IsuMjASR6f-Vukft5juw0hTYQQcY_r6th8BLOi8A==

Redirect headers

Pragma: no-cache
Date: Thu, 20 Feb 2020 08:14:33 GMT
AN-X-Request-Uuid: 8746c816-53d8-448b-a7ac-f710207cf75b
Content-Type: text/html; charset=utf-8
Server: nginx/1.13.4
Location: https://attr.ml-api.io/?domain=juniper.net&pId=2124767708950603175
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 82.102.19.134; 82.102.19.134; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.204:80
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 437764526963678 Show response
connect.facebook.net/signals/config/ 447 KB
113 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/437764526963678?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bef8b6a5f4399be5da990490ceee7525da2698723a003af12b7095f03a78a34f

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 114931
x-xss-protection: 0
pragma: public
x-fb-debug: Zu8EcC8qhcn4dbzmIcB99gPet9GW9kjKL+wXDlNRFWv+o/WaQ7pit2Xsc/n60f1Y9wOkngjafakr3QVYImV8TA==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:14:30 GMT, Thu, 20 Feb 2020 08:14:30 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
124 B 146ms
145ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1lnh&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 117
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: df7c4b07c03a8537760e314c0f07c829
x-transaction: 00569cb6000806a1
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
170 B 140ms
139ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: df7c4b07c03a8537760e314c0f07c829
x-transaction: 000985d300413e80
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
120 B 143ms
142ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvrg6&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: df7c4b07c03a8537760e314c0f07c829
x-transaction: 00e4bdf800d7e4fb
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
120 B 144ms
144ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o29di&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: df7c4b07c03a8537760e314c0f07c829
x-transaction: 00db38250096a67a
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
124 B 141ms
141ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o2i9x&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 109
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: df7c4b07c03a8537760e314c0f07c829
x-transaction: 0073918b004c2e10
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
249 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=437764526963678&ev=PageView&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&rl=&if=false&ts=1582186470800&cd[jnpr_vId]=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=29&fbp=fb.1.1582186470800.1112482750&it=1582186470739&coo=false&rqm=GET

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT, Thu, 20 Feb 2020 08:14:30 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-24=":443"; ma=3600
content-length: 44
expires: Thu, 20 Feb 2020 08:14:30 GMT

GET
H2 200 jnpr-logo.svg Show response
www.juniper.net/assets/svg/ 3 KB
2 KB 23ms
9ms XHR
image/svg+xml 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.juniper.net/assets/svg/jnpr-logo.svg
Requested by: Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43 /
Resource Hash: 57f53d1b65316e7362b02a42d2a07319fcd3a8d75f2dc91d0094caf98181c741

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
last-modified: Fri, 02 Nov 2018 05:55:25 GMT
server: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43
status: 200
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: public, max-age=30532
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
content-length: 1502
x-ua-compatible: IE=edge,chrome=1

GET
H2 200 jnpr-social-icon_jnet.svg Show response
www.juniper.net/assets/icons/social/ 976 B
1 KB 24ms
16ms XHR
image/svg+xml 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_jnet.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

6b8797e0cf30f8a00ff41912ebcc895055ffeb426b34f70c4933b9828b1ca720

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 563
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:14:31 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=138834
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_facebook.svg Show response
www.juniper.net/assets/icons/social/ 366 B
755 B 26ms
18ms XHR
image/svg+xml 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_facebook.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

7ff5a2ce1b7603d6e9f61f85587efe96cbed61d71ace91bcc6ca7d0bc07cc7ce

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 273
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:14:31 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=38440
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_twitter.svg Show response
www.juniper.net/assets/icons/social/ 582 B
856 B 17ms
10ms XHR
image/svg+xml 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_twitter.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

15c14a35beeabe632f718ce14189ade1b8b6760b977e1e8149b5e1211d3efde5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 374
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:14:31 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=205775
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_youtube.svg Show response
www.juniper.net/assets/icons/social/ 451 B
789 B 18ms
11ms XHR
image/svg+xml 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_youtube.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

c6846556479addb85175eb801d75cd64485ccec53b42fac54441fef1895c0408

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 307
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:14:31 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=142888
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_linkedin.svg Show response
www.juniper.net/assets/icons/social/ 724 B
925 B 20ms
13ms XHR
image/svg+xml 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_linkedin.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

70349fe86be7c6dcd4062011d02d91185a4a45b60e2826f05985d67f8ae43bd3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 443
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:14:31 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=139237
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_instgram.svg Show response
www.juniper.net/assets/icons/social/ 1 KB
1 KB 18ms
12ms XHR
image/svg+xml 2a02:26f0:6c00:185::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_instgram.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:185::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43 /

Resource Hash

e8d5b01af589f68a0f2da663d3efc472fabb22d9ede91a7ffcf74d21e6295506

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 569
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 03 Dec 2018 20:00:23 GMT
server: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43
date: Thu, 20 Feb 2020 08:14:31 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=38451
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 satellite-5c4d601564746d128d00351a.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 2 KB
1 KB 27ms
27ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c4d601564746d128d00351a.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8a3e8d4242f53959806c3ebf262affb1bd5a78e361acb2d5bf14be201ee56a3e

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:54 GMT
server: AkamaiNetStorage
etag: "ef3e8222ffd66f5f29d86b509a85a361:1582139334.431118"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 802
expires: Thu, 20 Feb 2020 09:14:31 GMT

GET
H2 200 satellite-5c86baad64746d44c9006139.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 2 KB
1 KB 28ms
27ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c86baad64746d44c9006139.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5855809ae723b4a35f3120be99dccfc8403b3dd379fd86efeacdad8767ea6320

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:54 GMT
server: AkamaiNetStorage
etag: "64cd50749dbcff7576118000c8ee8376:1582139334.752199"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 831
expires: Thu, 20 Feb 2020 09:14:31 GMT

GET
H2 200 satellite-5a1c307e64746d671f007214.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 970 B
738 B 28ms
28ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5a1c307e64746d671f007214.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: db0031471b3f9181ff21d83674674ac3dd7c128531fae90bc274ad0e17c58c37

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 15:13:20 GMT
server: AkamaiNetStorage
etag: "e98792ce8e8b853475368de93200623c:1582125200.040193"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 493
expires: Thu, 20 Feb 2020 09:14:31 GMT

GET
H2 200 satellite-57ae0e9e64746d5a2c001384.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 756 B
610 B 30ms
30ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57ae0e9e64746d5a2c001384.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4c891889ca55d5cadf9e960d2e40f31f50ac0b6252417a9be7414ff2f26a3880

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:46 GMT
server: AkamaiNetStorage
etag: "32b2fa1768d41f11552b05c7f7bc9543:1582139326.73257"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 365
expires: Thu, 20 Feb 2020 09:14:31 GMT

GET
H2 200 satellite-57b12af264746d361f00027e.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 148 B
391 B 30ms
30ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12af264746d361f00027e.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b8eea75e456823a6e0eebfa1e4f27b56395485fff2bbf27e0344f7bf4fa8e509

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:42 GMT
server: AkamaiNetStorage
etag: "a29c925184c82cbaaeea213863aa74d1:1582139322.029758"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 147
expires: Thu, 20 Feb 2020 09:14:31 GMT

GET
H2 200 s-code-contents-aa1e4404cdb04849f2f22e6dd3789ac4f10a9afd.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/ 35 KB
13 KB 35ms
34ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/s-code-contents-aa1e4404cdb04849f2f22e6dd3789ac4f10a9afd.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e931faaef092c8d98a58ac536216378f58e2a17a4833bbe5f9a29e5bbed849f6

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 15:13:04 GMT
server: AkamaiNetStorage
etag: "0c13f2b0bfa3779da7f5bdb2ff4d1d29:1582125184.807562"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 13480
expires: Thu, 20 Feb 2020 09:14:31 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 247 KB
47 KB 15ms
14ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MHNPL3

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4cdde47aa921b0cc562b8cadb9366ea11d83bd0f27d3aa2e4ab8c22486f592d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 48480
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Feb 2020 08:14:31 GMT

GET
H/1.1 200
OK ng-messages Show response
forums.juniper.net/jnet/api/2.0/ui/lang/ 2 KB
1 KB 491ms
172ms XHR
application/json 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.juniper.net/jnet/api/2.0/ui/lang/ng-messages?board.id=threatresearch

Requested by

Host: jnet.i.lithium.com
URL: https://jnet.i.lithium.com/t5/scripts/30B7B7689E52F3255F63CF558D0B2099/lia-scripts-angularjs-min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

4dcc161d0ef98a2c9c1b776a90ab5c284032d8a333964620545bf1ceee13ac89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Application-Version: 2.0.0
Sec-Fetch-Dest: empty
If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT
Application-Identifier: DESKTOP

Response headers

Date: Thu, 20 Feb 2020 08:14:31 GMT
Content-Encoding: gzip
Server: Apache
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age,Accept-Encoding
Content-Type: application/json;charset=UTF-8
Connection: close
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Length: 842

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: jnet.i.lithium.com
URL: https://jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/lia-scripts-common-min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Lato:300,400,700
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 04 Feb 2020 02:02:12 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:45:55 GMT
server: sffe
age: 1404739
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14044
x-xss-protection: 0
expires: Wed, 03 Feb 2021 02:02:12 GMT

GET
H/1.1 204
No Content 165804524926_1582186469447.gif
forums.juniper.net/beacon/ 0
568 B 517ms
165ms Image
image/gif 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forums.juniper.net/beacon/165804524926_1582186469447.gif

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 20 Feb 2020 08:14:31 GMT
Last-Modified: Fri, 02 Nov 2007 00:36:01 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Type: image/gif
Cache-Control: private, no-cache, no-cache="Set-Cookie", proxy-revalidate
Connection: close
Content-Length: 0
Expires: Thu, 22 Jan 1976 08:28:00 GMT

GET
H2 200 satellite-5955f42064746d6e6f0053bb.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 378 B
529 B 57ms
57ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5955f42064746d6e6f0053bb.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7b08b6c86fb4d51c3e96dd3f06ed35c02b7f0662404fb6b14b9b2b0425a9e28a

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 12:36:56 GMT
server: AkamaiNetStorage
etag: "3b6d86978dcd31eae399835883bb4dfa:1581683816.749645"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 283
expires: Thu, 20 Feb 2020 09:14:31 GMT

GET
H2 200 satellite-5caeb27864746d4fde0010d0.html
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ Frame DEE9 0
0 58ms
58ms Document
text/html 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5caeb27864746d4fde0010d0.html
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

:method: GET
:authority: assets.adobedtm.com
:scheme: https
:path: /998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5caeb27864746d4fde0010d0.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
accept-ranges: bytes
content-type: text/html
etag: "99efb13f2ce40bcc3d8c60d4557d2185:1582139314.215093"
last-modified: Wed, 19 Feb 2020 19:08:34 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Thu, 20 Feb 2020 09:14:31 GMT
date: Thu, 20 Feb 2020 08:14:31 GMT
content-length: 810
timing-allow-origin: *

GET
H2 200 satellite-5d487bc864746d25bd00073a.html
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ Frame AD1B 0
0 61ms
61ms Document
text/html 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5d487bc864746d25bd00073a.html
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

:method: GET
:authority: assets.adobedtm.com
:scheme: https
:path: /998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5d487bc864746d25bd00073a.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
accept-ranges: bytes
content-type: text/html
etag: "6f794f7bf8d2cbee9f48532e60fe0435:1582125186.77754"
last-modified: Wed, 19 Feb 2020 15:13:06 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 654
cache-control: max-age=3600
expires: Thu, 20 Feb 2020 09:14:31 GMT
date: Thu, 20 Feb 2020 08:14:31 GMT
timing-allow-origin: *

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
236 B 142ms
142ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1lnh&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:31 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 194c3f1e21256b98bcfa19af7913f601
x-transaction: 00d5912b001f1ccd
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
236 B 134ms
133ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 112
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:31 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 194c3f1e21256b98bcfa19af7913f601
x-transaction: 00191244005914c4
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
237 B 130ms
130ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvrg6&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 107
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:31 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 194c3f1e21256b98bcfa19af7913f601
x-transaction: 000513c900ecd33d
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
236 B 136ms
135ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o29di&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:31 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 194c3f1e21256b98bcfa19af7913f601
x-transaction: 0072bbf2000e4880
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
283 B 130ms
129ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o2i9x&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 106
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:31 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 194c3f1e21256b98bcfa19af7913f601
x-transaction: 00e0588000c885d0
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H/1.1 200
OK blogarticlepage.tagcloudtaplet:lazyrender Show response
forums.juniper.net/t5/blogs/ 20 B
563 B 467ms
174ms XHR
application/json 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.juniper.net/t5/blogs/blogarticlepage.tagcloudtaplet:lazyrender?t:ac=blog-id/threatresearch/article-id/72&t:cp=tagging/contributions/page

Requested by

Host: jnet.i.lithium.com
URL: https://jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/lia-scripts-common-min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

7283dcbdf14b954c1e61e173cc8bdb244b2bf508b7f0211ac749857bf47acda3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
X-Requested-With: XMLHttpRequest
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Thu, 20 Feb 2020 08:14:31 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json;charset=UTF-8
Connection: close
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000;includeSubDomains
X-Robots-Tag: noindex, nofollow

GET
DATA 200
OK truncated
/ 667 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edd8db5c29b96b7a290a5e266d426dca85541b7cd7a62b180e5ec89dc635f05f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H/1.1 200
OK elqCfg.min.js Show response
img.en25.com/i/ 6 KB
3 KB 113ms
37ms Script
application/x-javascript 104.103.106.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://img.en25.com/i/elqCfg.min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.103.106.126 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-103-106-126.deploy.static.akamaitechnologies.com

Software

Resource Hash

6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Jan 2020 17:21:27 GMT
ETag: "164336148d1d51:0"
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: no-cache, no-store
Date: Thu, 20 Feb 2020 08:14:31 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 2115
Expires: Thu, 20 Feb 2020 08:14:31 GMT

GET
H2 200 pntheon.min.js Show response
secure.rmulus.com/ 9 KB
9 KB 82ms
21ms Script
application/javascript 13.35.253.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c4d601564746d128d00351a.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:08:46 GMT
via: 1.1 94faae20b0f122c4555025f52a2fd745.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jan 2020 23:16:42 GMT
server: AmazonS3
age: 346
etag: "0e3d80db82062b64ac3e71d661e18282"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 9338
x-amz-cf-id: XSyppZ_JOrb2MmnN7sFgORt34As9K7cP4l1wAXBE7R4Zos36oHZRPw==

GET
H2 200 pntheon.min.js Show response
secure.rmulus.com/ 9 KB
9 KB 91ms
36ms Script
application/javascript 13.35.253.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=active&_pclIp=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c86baad64746d44c9006139.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 19 Feb 2020 21:03:37 GMT
via: 1.1 94faae20b0f122c4555025f52a2fd745.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jan 2020 23:16:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "0e3d80db82062b64ac3e71d661e18282"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
content-length: 9338
x-amz-cf-id: dmvjjloRqMC4Bya1KDiA2GLhsZJVDWe3b4pqVdDhlozXs06gulhJvg==

GET
H2 200 pntheon.min.js Show response
secure.rmulus.com/ 9 KB
9 KB 87ms
33ms Script
application/javascript 13.35.253.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&_pqStr=enabled&jnpr_vID=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5a1c307e64746d671f007214.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 19 Feb 2020 21:03:37 GMT
via: 1.1 94faae20b0f122c4555025f52a2fd745.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jan 2020 23:16:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "0e3d80db82062b64ac3e71d661e18282"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
content-length: 9338
x-amz-cf-id: Au4MgLoYM05ctxvgQ9npXG3qTIiLBiH0e3n1s95z4jgEW-9ixM0Hiw==

GET
H2

200

activityi;dc_pre=CIz71fTX3-cCFXXluwgdfnYA0A;src=5922977;type=pageview;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is...
5922977.fls.doubleclick.net/ Frame 9A79
Redirect Chain

https://5922977.fls.doubleclick.net/activityi;src=5922977;type=pageview;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-...
https://5922977.fls.doubleclick.net/activityi;dc_pre=CIz71fTX3-cCFXXluwgdfnYA0A;src=5922977;type=pageview;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.n...

0
0

34ms
34ms

Document
text/html

172.217.22.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5922977.fls.doubleclick.net/activityi;dc_pre=CIz71fTX3-cCFXXluwgdfnYA0A;src=5922977;type=pageview;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6639682050090.881?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12a8364746d4d41000291.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f38.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5922977.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CIz71fTX3-cCFXXluwgdfnYA0A;src=5922977;type=pageview;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6639682050090.881?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:14:31 GMT
expires: Thu, 20 Feb 2020 08:14:31 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 452
x-xss-protection: 0
set-cookie: IDE=AHWqTUkFtNrszSoC3wq0cTmuRXC_vcKSjF7N88eo7DowufAnzsFmAGEd2Rbw2hdm; expires=Tue, 16-Mar-2021 08:14:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:14:31 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5922977.fls.doubleclick.net/activityi;dc_pre=CIz71fTX3-cCFXXluwgdfnYA0A;src=5922977;type=pageview;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6639682050090.881?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 20-Feb-2020 08:29:31 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2

200

activityi;dc_pre=CJKD1vTX3-cCFYTDuwgd7G4Bmg;src=3872718;type=gojpnet;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-...
3872718.fls.doubleclick.net/ Frame 745D
Redirect Chain

https://3872718.fls.doubleclick.net/activityi;src=3872718;type=gojpnet;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-I...
https://3872718.fls.doubleclick.net/activityi;dc_pre=CJKD1vTX3-cCFYTDuwgd7G4Bmg;src=3872718;type=gojpnet;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.ne...

0
0

37ms
37ms

Document
text/html

172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3872718.fls.doubleclick.net/activityi;dc_pre=CJKD1vTX3-cCFYTDuwgd7G4Bmg;src=3872718;type=gojpnet;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6392541218947.796?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12a8364746d4d41000291.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f134.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 3872718.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CJKD1vTX3-cCFYTDuwgd7G4Bmg;src=3872718;type=gojpnet;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6392541218947.796?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:14:31 GMT
expires: Thu, 20 Feb 2020 08:14:31 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 453
x-xss-protection: 0
set-cookie: IDE=AHWqTUlNz_iM-bmNRpYQBNzrZzZ4CxyjTUUV_GVx-RmF4JssQezN4t34_yLLLuOE; expires=Tue, 16-Mar-2021 08:14:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:14:31 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://3872718.fls.doubleclick.net/activityi;dc_pre=CJKD1vTX3-cCFYTDuwgd7G4Bmg;src=3872718;type=gojpnet;cat=pagev0;u1=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6392541218947.796?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 20-Feb-2020 08:29:31 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 s81987511183809
junipernetworks.d2.sc.omtrdc.net/b/ss/jnprod/1/JS-2.12.0-D7QN/ 43 B
221 B 182ms
182ms Image
image/gif 18.138.216.223
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://junipernetworks.d2.sc.omtrdc.net/b/ss/jnprod/1/JS-2.12.0-D7QN/s81987511183809?AQB=1&ndh=1&pf=1&t=20%2F1%2F2020%209%3A14%3A31%204%20-60&sdid=291A17710B9F48D4-6953C3587F910B1D&D=D%3D&mid=29655759245099169021142167160330775484&aamlh=6&ce=UTF-8&pageName=forums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&g=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=forums.juniper.net&v5=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&v15=D%3DpageName&v30=ISP%20Visitor&v31=ISP%20Visitor&v32=ISP%20Visitor&v33=ISP%20Visitor&v34=ISP%20Visitor&v35=ISP%20Visitor&v36=ISP%20Visitor&v37=ISP%20Visitor&v38=ISP%20Visitor&v39=ISP%20Visitor&v40=ISP%20Visitor&v41=ISP%20Visitor&v42=ISP%20Visitor&v43=ISP%20Visitor&v44=ISP%20Visitor&v45=Bot&v46=ISP%20Visitor&v84=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=D206123F524450F50A490D45%40AdobeOrg&AQE=1

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.138.216.223 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-138-216-223.ap-southeast-1.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:30 GMT
x-content-type-options: nosniff
x-c: master-1169.Ie4359b.M0-349
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 21 Feb 2020 08:14:31 GMT
server: jag
xserver: anedge-665bcdccf8-5gddb
etag: 3397719574644621312-4619609390214408369
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 19 Feb 2020 08:14:31 GMT

GET
H2 200 wRPiG49f.min.js Show response
scripts.demandbase.com/ 58 KB
59 KB 25ms
25ms Script
application/javascript 13.35.253.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/wRPiG49f.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5955f42064746d6e6f0053bb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.107 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-107.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0d815b2e925f887c1210ae79918c2daed72f94cafb870f4fedffcfac47a341b4

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: rBjPpaaLgRwfk.HwhBorpW7VSW9pfD6m
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
age: 1948
x-cache: Hit from cloudfront
status: 200
date: Thu, 20 Feb 2020 07:42:04 GMT
content-length: 59517
last-modified: Thu, 16 Jan 2020 17:41:57 GMT
server: AmazonS3
etag: "52b032a7bc001b85e47103b9aa975fa2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-amz-cf-id: hu6oCa-rBn8hqBxrA06M8HgB3fRn_Ei1Q-9BsteARCMYlhFZNZzPGQ==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 6059
date: Thu, 20 Feb 2020 06:33:32 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18174
expires: Thu, 20 Feb 2020 08:33:32 GMT

GET
H/1.1

200
OK

37366
tags.bluekai.com/site/
Redirect Chain

https://s1229.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=225&optin=disabled
https://s1229.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=225&optin=disabled&elqCookie=1
https://tags.bluekai.com/site/37366?vid=e932dafe1c8e4dd1994d30b664a6ff74

62 B
745 B

184ms
184ms

Image
image/gif

23.45.237.36
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/37366?vid=e932dafe1c8e4dd1994d30b664a6ff74
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.45.237.36 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-237-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 08:14:32 GMT
Connection: keep-alive
Content-Type: image/gif
Content-Length: 62
BK-Server: b469
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Thu, 20 Feb 2020 08:14:31 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location: //tags.bluekai.com/site/37366?vid=e932dafe1c8e4dd1994d30b664a6ff74
Cache-Control: private,no-cache, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 183
Expires: -1

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 436 B
937 B 101ms
58ms XHR
application/json 13.35.253.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&page_title=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&key=b04729caf27be3d1f33d91242883c6cd22de73c9&src=tag
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/wRPiG49f.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.53 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-53.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 8844cfebefa2192e921ac8233c63ab3c0ad98a44823b71d84cd1ec25411a7a40

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
status: 200
request-id: f215abd5-0fa4-4cc7-91e4-cbac08914f67
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://forums.juniper.net
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: BYqTJ6j32nqfCXmFQbI3qpumLeyG527q6mvRZuUElcFxDg1PTZvwLg==
expires: Wed, 19 Feb 2020 08:14:31 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 436 B
937 B 99ms
57ms XHR
application/json 13.35.253.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&page_title=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&key=2f583737f4267c258cb4cda0abb7f0add09816ce&src=tag
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/wRPiG49f.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.53 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-53.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 8844cfebefa2192e921ac8233c63ab3c0ad98a44823b71d84cd1ec25411a7a40

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:31 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
status: 200
request-id: 958ed4c1-764d-4398-903e-1bd799b15653
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://forums.juniper.net
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9NWyRrR2pUUVpIsUgASYhX1ciS2sUxQRNZrd3ihla2kr54BWBFe-_Q==
expires: Wed, 19 Feb 2020 08:14:31 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AAE5TU68nIAAAC8IZbYKVg
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAE5TU68nIAAAC8IZbYKVg&verifyHash=c6c4ecc99ce5c3fa07c59e0bf1e013ba82642585

26 B
409 B

109ms
109ms

Image
image/gif

143.204.202.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAE5TU68nIAAAC8IZbYKVg&verifyHash=c6c4ecc99ce5c3fa07c59e0bf1e013ba82642585
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.106 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-106.fra53.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 08:14:31 GMT
Via: 1.1 b16802a1e349d80b7688070778305ae2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: 0adefe8feecae035
X-Amz-Cf-Id: k46XoPVBZ2739phdnDI_tE9BaLduB1KEiLaX8Myw7mBBsy5u-46xxQ==

Redirect headers

Date: Thu, 20 Feb 2020 08:14:31 GMT
Via: 1.1 b16802a1e349d80b7688070778305ae2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AAE5TU68nIAAAC8IZbYKVg&verifyHash=c6c4ecc99ce5c3fa07c59e0bf1e013ba82642585
Connection: keep-alive
trace-id: 72d5445cb374571e
Content-Length: 0
X-Amz-Cf-Id: FMxIUgqmAjLv6mMZBVgGE-_zO3J3xkUgdfezFZy2k1wlU1_wv-26kg==

GET
H2 200 collect
www.google-analytics.com/ 35 B
99 B 6ms
6ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=1417188680&t=pageview&_s=1&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&ul=en-us&de=UTF-8&dt=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGDAgEAB~&jid=1354523792&gjid=2048534013&cid=1009817513.1582186471&tid=UA-2343305-4&_gid=1275773075.1582186471&z=982962373

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Tue, 04 Feb 2020 17:28:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1349148
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
stats.g.doubleclick.net/r/ 35 B
136 B 16ms
16ms Image
image/gif 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2343305-4&cid=1009817513.1582186471&jid=1354523792&gjid=2048534013&_gid=1275773075.1582186471&_u=YGDAgEAB~&z=1246979521

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
date: Thu, 20 Feb 2020 08:14:31 GMT
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
93 B 6ms
6ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=1417188680&t=pageview&_s=1&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&ul=en-us&de=UTF-8&dt=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGDAgEAB~&jid=2110321050&gjid=1503267803&cid=1009817513.1582186471&tid=UA-2343305-1&_gid=1275773075.1582186471&cd5=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&cd19=gtm%20%2B%20dtm&z=1612110117

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Tue, 04 Feb 2020 17:28:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1349148
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2343305-1&cid=1009817513.1582186471&jid=2110321050&gjid=1503267803&_gid=1275773075.1582186471&_u=YGDAgEAB~&z=1163844290
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1009817513.1582186471&jid=2110321050&_v=j81&z=1163844290
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1009817513.1582186471&jid=2110321050&_v=j81&z=1163844290&slf_rd=1&random=3237983594

42 B
109 B

17ms
17ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1009817513.1582186471&jid=2110321050&_v=j81&z=1163844290&slf_rd=1&random=3237983594

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:31 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1009817513.1582186471&jid=2110321050&_v=j81&z=1163844290&slf_rd=1&random=3237983594
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK profiler Show response
lookups.rmulus.com/pntheon/profiles/ 25 B
205 B 446ms
115ms XHR
application/json 52.72.180.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lookups.rmulus.com/pntheon/profiles/profiler?_pclientId=jnpr&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vid&_plkpPrfl=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.180.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-180-134.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 851bd834d24a84c0f4780789e868a65f9db8d9655a7a0cac039dbf3b65ad873f

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 20 Feb 2020 08:14:31 GMT
Server: Apache
Connection: keep-alive
Content-Length: 25
Content-Type: application/json

GET
H2 200 /
secure.rmulus.com/ Frame F79F 0
0 22ms
22ms Document
text/html 13.35.253.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/?_pevId=vSR4xvEtVHgDRpld9mNYTORIb9skv3i5-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=enabled&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dpgvw%26_pdataSource%3Dweb%26_pqStr%3Denabled%26jnpr_vID%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&jnpr_vID=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pidSource=secure.rmulus.com&_pidName=rmulusId&_pclIp=disabled&_plkpPrfl=disabled
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: secure.rmulus.com
:scheme: https
:path: /?_pevId=vSR4xvEtVHgDRpld9mNYTORIb9skv3i5-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=enabled&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dpgvw%26_pdataSource%3Dweb%26_pqStr%3Denabled%26jnpr_vID%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&jnpr_vID=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pidSource=secure.rmulus.com&_pidName=rmulusId&_pclIp=disabled&_plkpPrfl=disabled
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
content-type: text/html
content-length: 11311
last-modified: Mon, 20 Jan 2020 22:54:47 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Feb 2020 07:48:28 GMT
etag: "b54bfc44e96bae45f2b930edddba58f9"
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 94faae20b0f122c4555025f52a2fd745.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: ZOXbZewpC8SfMXPg23dZXRjt1uebq4wrUMKqNwnMnQA0zMGLIESF9Q==
age: 1564

GET
H/1.1 200
OK jnpr Show response
lookups.rmulus.com/pntheon/ip/ 403 B
592 B 696ms
365ms XHR
text/html 52.72.180.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lookups.rmulus.com/pntheon/ip/jnpr
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.180.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-180-134.compute-1.amazonaws.com
Software: Apache /
Resource Hash: b61257c26264a2d7eea71f0228f96d6a2e3e05d194cd3247342554f2aeeacd8d

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 20 Feb 2020 08:14:31 GMT
Server: Apache
Connection: keep-alive
Content-Length: 403
Content-Type: text/html; charset=UTF-8

GET
H2 200 collect
www.google-analytics.com/ 35 B
93 B 6ms
6ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=1417188680&t=event&ni=1&_s=2&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&ul=en-us&de=UTF-8&dt=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aGDAgEAB~&jid=&gjid=&cid=1009817513.1582186471&tid=UA-2343305-1&_gid=1275773075.1582186471&cd5=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&cd19=gtm%20%2B%20dtm&cd6=(Non-Company%20Visitor)&cd7=(Non-Company%20Visitor)&cd8=(Non-Company%20Visitor)&cd9=Bot&cd10=(Non-Company%20Visitor)&cd11=(Non-Company%20Visitor)&cd12=(Non-Company%20Visitor)&cd13=(Non-Company%20Visitor)&cd14=(Non-Company%20Visitor)&cd15=BRU&cd16=(Non-Company%20Visitor)&cd17=(Non-Company%20Visitor)&cd18=Belgium&z=2041502640

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Tue, 04 Feb 2020 17:28:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1349148
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
research.juniper.net/ Frame 6D4B 11 KB
11 KB 88ms
24ms Document
text/html 143.204.202.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-79.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: db82939943dfa4e2ddd5cb40b4eef2237e4ff65a12c248db91352b36dbbca8a3

Request headers

:method: GET
:authority: research.juniper.net
:scheme: https
:path: /?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: check=true; jnpr_vID=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; dmdbase_cdc=DBSET; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C29655759245099169021142167160330775484%7CMCAAMLH-1582791269%7C6%7CMCAAMB-1582791269%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582193669s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2; mbox=session#8bc62a27dfef4a14af4301a793374005#1582188331|PC#8bc62a27dfef4a14af4301a793374005.26_0#1645431271; mboxEdgeCluster=26; _fbp=fb.1.1582186470800.1112482750; s_cc=true; _gcl_au=1.1.828065639.1582186471; _ga=GA1.2.1009817513.1582186471; _gid=GA1.2.1275773075.1582186471; _gat_b=1; _gat_jn=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
content-type: text/html
content-length: 11311
last-modified: Mon, 20 Jan 2020 22:54:47 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Feb 2020 07:15:15 GMT
etag: "b54bfc44e96bae45f2b930edddba58f9"
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: niGiuL6OgcvVC47LD8k0uxqWa4gjqiJdmMT5XoSqYtxzvO74OASNjA==
age: 3557

GET
H2 200 _pclPrint.min.js Show response
research.juniper.net/ Frame 6D4B 38 KB
39 KB 23ms
22ms Script
application/javascript 143.204.202.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/_pclPrint.min.js
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-79.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c5aff3477022f781ee765989cdf6abbdd986f331064c59f5655fab8c6f9796c7

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 07:48:49 GMT
via: 1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jul 2019 21:53:49 GMT
server: AmazonS3
age: 1543
etag: "2b2becfbac440238e8ca3a6f7a3b2c50"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 39179
x-amz-cf-id: aJHVLgcEZ7QB57DA0Hq56SwYcIoF9gu2LnzlbrITzHDilCryi3EWqg==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 6D4B 74 KB
28 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-956680084

Requested by

Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f62ff9e57b4243edeb728b981a1380a3bbf12d8c18c092fa93cac93a72e5a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28494
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Feb 2020 08:14:32 GMT

GET
H2 200 insight.min.js Show response
research.juniper.net/ Frame 6D4B 15 KB
15 KB 21ms
21ms Script
application/javascript 143.204.202.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/insight.min.js
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-79.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0f533082d6b784c7f939ad3fbcafc2faa6a88d96f0b076f7a0e28b431995bff

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 07:23:31 GMT
via: 1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)
last-modified: Fri, 26 Jul 2019 18:43:20 GMT
server: AmazonS3
age: 3062
etag: "5b837d1dc3da4d22567332e2fe693e12"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 15282
x-amz-cf-id: mQtip0h7KdYHDDvBujCf4jtWH2UbdF5Di5LMCtjoibVgpZk3NhkyGg==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 6D4B 126 KB
30 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: raUFI/o6CJPg70nfZsFaPgrH9qPowb5wextIB3x7tdmToFj6reh/QQ058oE/ulJLnlHEYgZhlsK3gRtQ2I+/mQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:14:32 GMT, Thu, 20 Feb 2020 08:14:32 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ Frame 6D4B 5 KB
2 KB 22ms
22ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
age: 16
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19173-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582186472.042141,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 /
collect.rmulus.com/ Frame 6D4B 43 B
367 B 21ms
21ms Image
image/gif 143.204.202.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collect.rmulus.com/?_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472&_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=a29d5f7b2fb83ed2db62c131cb65f013&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled&cachebuster=635054
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.47 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-47.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 19 Feb 2020 19:31:41 GMT
via: 1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
last-modified: Mon, 16 Jan 2017 04:49:32 GMT
server: AmazonS3
age: 45772
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 43
x-amz-cf-id: 14nkkoGFgoLf_yF-mhQCQ9Z3x5mEzvGbsszNV4S0-IhPxVLus2T6eg==

GET
H/1.1 200
OK profiler Show response
lookups.rmulus.com/pntheon/profiles/ 25 B
205 B 120ms
120ms XHR
application/json 52.72.180.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lookups.rmulus.com/pntheon/profiles/profiler?_pclientId=jnpr&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pmatchedip&_plkpPrfl=82.102.19.134
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.180.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-180-134.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 851bd834d24a84c0f4780789e868a65f9db8d9655a7a0cac039dbf3b65ad873f

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 20 Feb 2020 08:14:32 GMT
Server: Apache
Connection: keep-alive
Content-Length: 25
Content-Type: application/json

GET
H2 200 340159566928684 Show response
connect.facebook.net/signals/config/ Frame 6D4B 447 KB
112 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/340159566928684?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1498e3b254909c3f097fc78de60171d0be0c367e534e0af35c21c359ef6801e7

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 114918
x-xss-protection: 0
pragma: public
x-fb-debug: Vq72Vfz6r5BFvpRQ3TxRbX8unHXds13TSdEmM/ksGFNSCkovMMuRlTkY992qkaLqQqADv8jJwnPcraBt2paL+A==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:14:32 GMT, Thu, 20 Feb 2020 08:14:32 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame 6D4B 26 KB
10 KB 32ms
32ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-956680084

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

cafe /

Resource Hash

e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9931
x-xss-protection: 0
server: cafe
etag: 9478280665056484852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 20 Feb 2020 08:14:32 GMT

GET
H2 200 / Show response
px.ads.linkedin.com/collect/ Frame 6D4B 0
64 B 165ms
165ms Script
application/javascript 2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1582186472060&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_pclPrint%253Dtrue%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclIp%3Ddisabled&fmt=js&s=1
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: R7YyrDYO9RXgyYtuoCsAAA==

POST
H2 200 /
www.facebook.com/tr/ Frame 6D4B 0
101 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
Origin: https://research.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvC9W9B47nSCJj3fn

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
access-control-allow-origin: https://research.juniper.net
date: Thu, 20 Feb 2020 08:14:32 GMT
content-type: text/plain
status: 200
access-control-allow-credentials: true
alt-svc: h3-24=":443"; ma=3600
content-length: 0

GET
H2 200 adsct Show response
analytics.twitter.com/i/ Frame 6D4B 31 B
159 B 143ms
143ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&tw_document_referrer=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_pclPrint%253Dtrue%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclIp%3Ddisabled

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:32 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 194c3f1e21256b98bcfa19af7913f601
x-transaction: 0051e6ca00e71467
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ Frame 6D4B 43 B
167 B 132ms
132ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&tw_document_referrer=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:32 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: df7c4b07c03a8537760e314c0f07c829
x-transaction: 00fd768200ee8483
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame 6D4B 3 KB
1 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582186472095&cv=9&fst=1582186472095&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d248a3e6b33b3da3d7546264b7d476d38a0b8ad73aba469d5f5fe12b1391d07f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame 6D4B 6 KB
2 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582186472097&cv=9&fst=1582186472097&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dpage_view%3B_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472%3B_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c69445f7d9197d77b0d98fc2d4c19972148ab59e09816636137533a64f6d4041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1715
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame 6D4B 42 B
110 B 21ms
20ms Image
image/gif 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582186472095&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=363367143&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame 6D4B 42 B
110 B 24ms
23ms Image
image/gif 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582186472095&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=363367143&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame 6D4B 42 B
110 B 21ms
20ms Image
image/gif 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582186472097&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472%3B_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3681244387&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame 6D4B 42 B
110 B 24ms
24ms Image
image/gif 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582186472097&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472%3B_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DFFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3681244387&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=FFKLxpNB0SdrinWXqDnWqfQz5H4BrEy2-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
research.juniper.net/ Frame 1CC9 11 KB
11 KB 27ms
27ms Document
text/html 143.204.202.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-79.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: db82939943dfa4e2ddd5cb40b4eef2237e4ff65a12c248db91352b36dbbca8a3

Request headers

:method: GET
:authority: research.juniper.net
:scheme: https
:path: /?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: check=true; jnpr_vID=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; dmdbase_cdc=DBSET; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C29655759245099169021142167160330775484%7CMCAAMLH-1582791269%7C6%7CMCAAMB-1582791269%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582193669s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2; mbox=session#8bc62a27dfef4a14af4301a793374005#1582188331|PC#8bc62a27dfef4a14af4301a793374005.26_0#1645431271; mboxEdgeCluster=26; _fbp=fb.1.1582186470800.1112482750; s_cc=true; _gcl_au=1.1.828065639.1582186471; _ga=GA1.2.1009817513.1582186471; _gid=GA1.2.1275773075.1582186471; _gat_b=1; _gat_jn=1; rmulusId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
content-type: text/html
content-length: 11311
last-modified: Mon, 20 Jan 2020 22:54:47 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Feb 2020 07:19:05 GMT
etag: "b54bfc44e96bae45f2b930edddba58f9"
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: tLuwvIeW8syhl8asZFgIFA6UFz6yvybym9h4tPdIfxnz-S0DvuwJKg==
age: 3328

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 1CC9 74 KB
28 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-956680084

Requested by

Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f62ff9e57b4243edeb728b981a1380a3bbf12d8c18c092fa93cac93a72e5a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28494
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Feb 2020 08:14:32 GMT

GET
H2 200 insight.min.js Show response
research.juniper.net/ Frame 1CC9 15 KB
15 KB 22ms
22ms Script
application/javascript 143.204.202.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/insight.min.js
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-79.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0f533082d6b784c7f939ad3fbcafc2faa6a88d96f0b076f7a0e28b431995bff

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 07:23:31 GMT
via: 1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)
last-modified: Fri, 26 Jul 2019 18:43:20 GMT
server: AmazonS3
age: 3062
etag: "5b837d1dc3da4d22567332e2fe693e12"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 15282
x-amz-cf-id: 3mQuLbEY_YVWKdOL2mFCjjAkltLTaBavTNWzr3gWLOtBzUUJtRYXWQ==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 1CC9 126 KB
30 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: raUFI/o6CJPg70nfZsFaPgrH9qPowb5wextIB3x7tdmToFj6reh/QQ058oE/ulJLnlHEYgZhlsK3gRtQ2I+/mQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:14:32 GMT, Thu, 20 Feb 2020 08:14:32 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ Frame 1CC9 5 KB
2 KB 22ms
22ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
age: 16
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19173-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582186472.410056,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 /
collect.rmulus.com/ Frame 1CC9 43 B
367 B 21ms
20ms Image
image/gif 143.204.202.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collect.rmulus.com/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472&cachebuster=36770457
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.47 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-47.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 19 Feb 2020 19:31:41 GMT
via: 1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
last-modified: Mon, 16 Jan 2017 04:49:32 GMT
server: AmazonS3
age: 45772
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 43
x-amz-cf-id: SNEaKbEpI_4GvCDQz1S4TSgxSbvHp2h1CaKza8sDDHuXsrV9Ql4O9Q==

GET
H2 200 340159566928684 Show response
connect.facebook.net/signals/config/ Frame 1CC9 447 KB
112 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/340159566928684?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1498e3b254909c3f097fc78de60171d0be0c367e534e0af35c21c359ef6801e7

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 114918
x-xss-protection: 0
pragma: public
x-fb-debug: Vq72Vfz6r5BFvpRQ3TxRbX8unHXds13TSdEmM/ksGFNSCkovMMuRlTkY992qkaLqQqADv8jJwnPcraBt2paL+A==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:14:32 GMT, Thu, 20 Feb 2020 08:14:32 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame 1CC9 26 KB
10 KB 32ms
32ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-956680084

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

cafe /

Resource Hash

e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9931
x-xss-protection: 0
server: cafe
etag: 9478280665056484852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 20 Feb 2020 08:14:32 GMT

GET
H2 200 adsct
t.co/i/ Frame 1CC9 43 B
119 B 133ms
132ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:32 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: df7c4b07c03a8537760e314c0f07c829
x-transaction: 00cb2b09002fef20
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 200 /
www.facebook.com/tr/ Frame 1CC9 0
30 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
Origin: https://research.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXmRU9FvnBGihjmCN

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
access-control-allow-origin: https://research.juniper.net
date: Thu, 20 Feb 2020 08:14:32 GMT
content-type: text/plain
status: 200
access-control-allow-credentials: true
alt-svc: h3-24=":443"; ma=3600
content-length: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame 1CC9 3 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582186472456&cv=9&fst=1582186472456&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3fa435ff4951a562cd2c03615833881a9b0382f5080c47f64f9e3f8e8125eb76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame 1CC9 6 KB
2 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582186472457&cv=9&fst=1582186472457&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dpage_view%3B_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%5C%3D_pclIp._pmatchedIP%26_plkpPrfl%5C%3Dactive%26_pclIp%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts_ip%3B_plkpKey%3D_pclIp._pmatchedIP%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pcityName%3DBrussels%3B_pcompanyName%3DM247%20Ltd%3B_pcontinentCode%3DEU%3B_pcontinentName%3DEurope%3B_pcountryISOCode%3DBE%3B_pcountryName%3DBelgium%3B_platitude%3D50.8847%3B_plongitude%3D4.5049%3B_pmatchedIP%3D82.102.19.134%3B_ppostalCode%3D1930%3B_pstateISOCode%3DBRU%3B_pstateName%3DBrussels%20Capital%3B_ptimeZone%3DEurope%2FBrussels%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe315ad2dc09f086467ade00e354f5803a2f47cfb0a455b3c089471d9b7f3219

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1844
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame 1CC9 42 B
110 B 21ms
21ms Image
image/gif 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582186472456&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3624303294&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame 1CC9 42 B
110 B 26ms
26ms Image
image/gif 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582186472456&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3624303294&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame 1CC9 42 B
110 B 26ms
25ms Image
image/gif 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582186472457&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%5C%3D_pclIp._pmatchedIP%26_plkpPrfl%5C%3Dactive%26_pclIp%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts_ip%3B_plkpKey%3D_pclIp._pmatchedIP%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pcityName%3DBrussels%3B_pcompanyName%3DM247%20Ltd%3B_pcontinentCode%3DEU%3B_pcontinentName%3DEurope%3B_pcountryISOCode%3DBE%3B_pcountryName%3DBelgium%3B_platitude%3D50.8847%3B_plongitude%3D4.5049%3B_pmatchedIP%3D82.102.19.134%3B_ppostalCode%3D1930%3B_pstateISOCode%3DBRU%3B_pstateName%3DBrussels%20Capital%3B_ptimeZone%3DEurope%2FBrussels%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3985314889&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame 1CC9 42 B
110 B 24ms
24ms Image
image/gif 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582186472457&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%5C%3D_pclIp._pmatchedIP%26_plkpPrfl%5C%3Dactive%26_pclIp%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts_ip%3B_plkpKey%3D_pclIp._pmatchedIP%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pcityName%3DBrussels%3B_pcompanyName%3DM247%20Ltd%3B_pcontinentCode%3DEU%3B_pcontinentName%3DEurope%3B_pcountryISOCode%3DBE%3B_pcountryName%3DBelgium%3B_platitude%3D50.8847%3B_plongitude%3D4.5049%3B_pmatchedIP%3D82.102.19.134%3B_ppostalCode%3D1930%3B_pstateISOCode%3DBRU%3B_pstateName%3DBrussels%20Capital%3B_ptimeZone%3DEurope%2FBrussels%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%3B_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3985314889&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:14:32 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/ Show response
px.ads.linkedin.com/collect/ Frame 1CC9
Redirect Chain

https://px.ads.linkedin.com/collect/?time=1582186472558&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforu...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1582186472558%26pid%3D4751%26url%3Dhttps%253A%252F%252Fresearch.juniper.net%252F%253F_pevId%253D...
https://px.ads.linkedin.com/collect/?time=1582186472558&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforu...

0
63 B

166ms
166ms

Script
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1582186472558&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pcityName%3DBrussels%26_pcompanyName%3DM247%2520Ltd%26_pcontinentCode%3DEU%26_pcontinentName%3DEurope%26_pcountryISOCode%3DBE%26_pcountryName%3DBelgium%26_platitude%3D50.8847%26_plongitude%3D4.5049%26_pmatchedIP%3D82.102.19.134%26_ppostalCode%3D1930%26_pstateISOCode%3DBRU%26_pstateName%3DBrussels%2520Capital%26_ptimeZone%3DEurope%252FBrussels%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472&fmt=js&s=1&liSync=true
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: gSYE3jYO9RUQp4IPoSsAAA==

Redirect headers

date: Thu, 20 Feb 2020 08:14:32 GMT
x-content-type-options: nosniff
linkedin-action: 1
status: 302
strict-transport-security: max-age=2592000
content-length: 0
x-li-uuid: aagE1DYO9RWg5KNfoSsAAA==
server: Play
pragma: no-cache
x-li-pop: prod-tln1
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect/?time=1582186472558&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pcityName%3DBrussels%26_pcompanyName%3DM247%2520Ltd%26_pcontinentCode%3DEU%26_pcontinentName%3DEurope%26_pcountryISOCode%3DBE%26_pcountryName%3DBelgium%26_platitude%3D50.8847%26_plongitude%3D4.5049%26_pmatchedIP%3D82.102.19.134%26_ppostalCode%3D1930%26_pstateISOCode%3DBRU%26_pstateName%3DBrussels%2520Capital%26_ptimeZone%3DEurope%252FBrussels%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472&fmt=js&s=1&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ Frame 1CC9 31 B
233 B 137ms
137ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&tw_document_referrer=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DXw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pcityName%3DBrussels%26_pcompanyName%3DM247%2520Ltd%26_pcontinentCode%3DEU%26_pcontinentName%3DEurope%26_pcountryISOCode%3DBE%26_pcountryName%3DBelgium%26_platitude%3D50.8847%26_plongitude%3D4.5049%26_pmatchedIP%3D82.102.19.134%26_ppostalCode%3D1930%26_pstateISOCode%3DBRU%26_pstateName%3DBrussels%2520Capital%26_ptimeZone%3DEurope%252FBrussels%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470%26_pclId%3DFAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Xw0mnOG2bj9qNITS7RTJOUpyj9J3COKc-1582186471&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DLsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470&_pclId=FAWcijdkkapLyoPcG9ETIbm2SonKBLc6-1582186472
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:14:32 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 194c3f1e21256b98bcfa19af7913f601
x-transaction: 006e034800f2c764
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 satellite-57e2f6c764746d7a990154e8.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 1 KB
676 B 32ms
32ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57e2f6c764746d7a990154e8.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0b30b39cc04a7922ed34d3d567d814c6ea9c8cea7e4ba2302b5d45272c13a483

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:33 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:48 GMT
server: AkamaiNetStorage
etag: "143f04ca053bbbb67e7e7db60384c44e:1582139328.582401"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 431
expires: Thu, 20 Feb 2020 09:14:33 GMT

GET
H2 200 satellite-586d49e464746d11fd002f2c.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 414 B
526 B 32ms
32ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-586d49e464746d11fd002f2c.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f0ebf94842d7584c1c3c4925765c776bc6acc5345d1c01bdb846b416bad07877

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:33 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:48 GMT
server: AkamaiNetStorage
etag: "73f8288b3e1da89f3ff0360bfca03245:1582139328.788734"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 281
expires: Thu, 20 Feb 2020 09:14:33 GMT

GET
H2 200 satellite-5630f65f64746d185c002af5.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 503 B
579 B 33ms
33ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5630f65f64746d185c002af5.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1fee2fb3eb1831930f4e325e6f05dc0d322ce37f53cc7da4cd2cdde999ed0b1d

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:14:33 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:36 GMT
server: AkamaiNetStorage
etag: "902ab4d82e29bb124a4127654ea7be62:1582139316.38057"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 335
expires: Thu, 20 Feb 2020 09:14:33 GMT

Verdicts & Comments Add Verdict or Comment

123 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478(Line 5646) Message: Mobile Width. Width is lessthan or equalto 480!
console-api	log	URL: https://forumstage.juniper.net/html/assets/global-nav.js(Line 78) Message: check=true; jnpr_vID=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; dmdbase_cdc=DBSET; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C29655759245099169021142167160330775484%7CMCAAMLH-1582791269%7C6%7CMCAAMB-1582791269%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582193669s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2; mbox=session#8bc62a27dfef4a14af4301a793374005#1582188331\|PC#8bc62a27dfef4a14af4301a793374005.26_0#1645431271; mboxEdgeCluster=26; _fbp=fb.1.1582186470800.1112482750
console-api	log	URL: https://forumstage.juniper.net/html/assets/global-nav.js(Line 78) Message: check=true; jnpr_vID=LsAGNG5nec4CZyPYWQu4S1xSl4Qet2I1-1582186470; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; dmdbase_cdc=DBSET; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C29655759245099169021142167160330775484%7CMCAAMLH-1582791269%7C6%7CMCAAMB-1582791269%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582193669s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2; mbox=session#8bc62a27dfef4a14af4301a793374005#1582188331\|PC#8bc62a27dfef4a14af4301a793374005.26_0#1645431271; mboxEdgeCluster=26; _fbp=fb.1.1582186470800.1112482750
console-api	log	URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478(Line 3242) Message: This is secondary nav bar;
console-api	log	URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478(Line 170) Message: on load

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3872718.fls.doubleclick.net
5922977.fls.doubleclick.net
ajax.googleapis.com
analytics.twitter.com
api.company-target.com
api.demandbase.com
assets.adobedtm.com
attr.ml-api.io
cloud.webtype.com
cm.everesttech.net
collect.rmulus.com
connect.facebook.net
dpm.demdex.net
fonts.googleapis.com
fonts.gstatic.com
forums.juniper.net
forumstage.juniper.net
googleads.g.doubleclick.net
img.en25.com
jnet.i.lithium.com
junipernetworks.d2.sc.omtrdc.net
junipernetworks.demdex.net
junipernetworks.tt.omtrdc.net
lookups.rmulus.com
match.prod.bidr.io
maxcdn.bootstrapcdn.com
platform.twitter.com
pls.webtype.com
px.ads.linkedin.com
research.juniper.net
s.ml-attr.com
s1229.t.eloqua.com
scripts.demandbase.com
secure.adnxs.com
secure.rmulus.com
segments.company-target.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tags.bluekai.com
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.juniper.net
www.linkedin.com
104.103.106.126
104.244.42.195
104.244.42.5
13.35.253.107
13.35.253.53
13.35.253.77
13.35.253.91
13.35.253.94
143.204.202.106
143.204.202.47
143.204.202.79
151.101.12.157
172.217.16.134
172.217.16.194
172.217.22.38
18.138.216.223
2001:4de0:ac19::1:b:1a
208.74.205.254
208.74.207.25
209.167.231.17
23.111.9.35
23.210.248.45
23.45.237.36
2a00:1450:4001:806::2002
2a00:1450:4001:808::200a
2a00:1450:4001:80b::2008
2a00:1450:4001:80b::200e
2a00:1450:4001:814::2004
2a00:1450:4001:815::2003
2a00:1450:4001:815::200a
2a00:1450:4001:820::2003
2a00:1450:400c:c00::9d
2a02:26f0:6c00:185::720
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:11:101::b93f:9001
2a05:f500:11:101::b93f:9005
34.249.192.36
34.253.43.81
37.252.172.250
52.214.123.193
52.72.180.134
65.52.62.25
66.117.28.86
66.117.29.6
68.67.153.60
93.184.220.41
93.184.220.97
01eb8f5a91c70faa5681a3048eab75e78f30b4c4e0c04f8afbb46bfa98371ec0
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b30b39cc04a7922ed34d3d567d814c6ea9c8cea7e4ba2302b5d45272c13a483
0d815b2e925f887c1210ae79918c2daed72f94cafb870f4fedffcfac47a341b4
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1451b7c400c9e305f589883bbe1b45139abc74e3c977a8b91fa353dda6a642cb
1498e3b254909c3f097fc78de60171d0be0c367e534e0af35c21c359ef6801e7
15c14a35beeabe632f718ce14189ade1b8b6760b977e1e8149b5e1211d3efde5
179f42988ae4cab77687b27656fc69ab3fa07efbcf6279ac1bef85ac0688e69d
18b4b83afed32c0ec228e62a5f1080fbad1ca25addd958a4fc8b30c281fcc031
1d111313a277d37912be5ec29e0d77426d991feb85a04106694b72f66739885b
1fee2fb3eb1831930f4e325e6f05dc0d322ce37f53cc7da4cd2cdde999ed0b1d
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
272a2861dab52511f662603420b847ab73e6e13e75e8973c3091bdaa44c51706
2c9f1c57bc31c65cdb84a1c44c0c91fc88799512fd87c5bc6e52b21f69abd5d0
30e3f5a97af46d8cb43bf62c9875a8eacfc02c00826ea47549d4e33d0e1aa446
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
3928a8be3b073b7b4272b3863934222d52f00e782a0d157b9b7edfd7acf1bfbd
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d
3e84bcc6469e170029339c0b60b522671ca5d4298578308ec882df95f7badd9c
3eadffc329fb1c32ee10e809962cb4114a71d92b0f30db0b9ba9bef6abc91015
3f62ff9e57b4243edeb728b981a1380a3bbf12d8c18c092fa93cac93a72e5a6a
3fa435ff4951a562cd2c03615833881a9b0382f5080c47f64f9e3f8e8125eb76
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44c53106498ced14c80aab52391120b380216ce24de07bb5a91e659fd3ba8aed
4a3d7f509f217225975b98891f41fde0b216552b35f9a76460e86aaf52454733
4c5ed401667661bca33d013a7bc790e2079bbe0300a1a1d5ad5e5780ae259a4b
4c891889ca55d5cadf9e960d2e40f31f50ac0b6252417a9be7414ff2f26a3880
4cdde47aa921b0cc562b8cadb9366ea11d83bd0f27d3aa2e4ab8c22486f592d2
4dcc161d0ef98a2c9c1b776a90ab5c284032d8a333964620545bf1ceee13ac89
4ded81a3d2fd6dd9c1240d80be198e98eb78db7dc4e3e525fd21ffc0c05efbcd
506339130f152becadfa3ab2fbdbab5261035e4f9c343440ec23bc178cdc164a
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
57f53d1b65316e7362b02a42d2a07319fcd3a8d75f2dc91d0094caf98181c741
5855809ae723b4a35f3120be99dccfc8403b3dd379fd86efeacdad8767ea6320
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5b6b9462f29599d5332fa41d67010d03aa0aadb939144caad40e341bd3a2939a
5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350
626ef4978a3758ced595afe37b89812432ef49fe3f967d2cd8e1321459b3a9b8
68b59cc00ec1508f1c08e46c340c9802cdb23ec0b99d0099adaea9f8bb49528a
6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae
6b8797e0cf30f8a00ff41912ebcc895055ffeb426b34f70c4933b9828b1ca720
70349fe86be7c6dcd4062011d02d91185a4a45b60e2826f05985d67f8ae43bd3
70c2868114f52cb3b41e70e017c88ee5f5495639db9d495574e8ced55e7b272f
7283dcbdf14b954c1e61e173cc8bdb244b2bf508b7f0211ac749857bf47acda3
79340c32d5422c3331db60c78f9854b0d9c0a9bd0f9c454b7398734c1b990658
79e16119ceda988947279eb9addd1869b4270af3967b69ec9e09713ae4b6572b
7b08b6c86fb4d51c3e96dd3f06ed35c02b7f0662404fb6b14b9b2b0425a9e28a
7c9a167fcb4f690dc41db9f58f3ee6a20d3bba39316f2b46c8031c6d8ca300f1
7da66ec546c027bfe5b9ca59aa2225cfaa5f0d68f96801f31186878c0fa853f8
7ee39e6b76207efc841a6882a2af5241490e1a2161c4e13790f78fb4dbfdde28
7ff5a2ce1b7603d6e9f61f85587efe96cbed61d71ace91bcc6ca7d0bc07cc7ce
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847ad7d2d327222488e06177809a66d0517d53362838b94dfd3f1961d209d8b1
851bd834d24a84c0f4780789e868a65f9db8d9655a7a0cac039dbf3b65ad873f
85d9f9ab745f8b1dd6c6dc27722498c9eaf0f1e864242b01c7f396a5fb3aa3dc
8844cfebefa2192e921ac8233c63ab3c0ad98a44823b71d84cd1ec25411a7a40
8a3e8d4242f53959806c3ebf262affb1bd5a78e361acb2d5bf14be201ee56a3e
8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0
8febd8b0e9b817a31d401574d8f8aaeb5003d76c2c1afa9da932fa0990685b53
92dc916bc3b1001de758bc7fa95b57046ab5a80f1da16558fe8c8051d331f211
983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f
9912c03b52a7cb0fc11bde58e200010eca671219552929b31be4c2e26c0e10c3
9c3e9a35283d074cbf4f873b077e78b5a8cbd9a8bb4caa5ccc09e0142962a65a
9e5b8d4ced66c172dc84f16051eee4bac1e0fc60781c1ea05d73072b3cc7ddf1
9fe23bd043e18d262b1ee628108185e934ef555f4711f5149d4ffac94c117de5
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c
abeaf4a2dde5b673ce9957f08cb803a54d6b82b90bc1fa958a8335168d501c8b
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad9e90d9b2ef8c8af06afa88f231a5cf0dff89eb5c47a948dfbde3c856c7db39
ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6
b1110f2c7ae9f0a22977c4df6431fdfef92d1e8223f9734713e57aeb2ee96fcf
b61257c26264a2d7eea71f0228f96d6a2e3e05d194cd3247342554f2aeeacd8d
b8eea75e456823a6e0eebfa1e4f27b56395485fff2bbf27e0344f7bf4fa8e509
bacc031e0bfe9a4084bb166f88193dcdc3498aab6b1d14ebedbb75045afce823
bef8b6a5f4399be5da990490ceee7525da2698723a003af12b7095f03a78a34f
c0f533082d6b784c7f939ad3fbcafc2faa6a88d96f0b076f7a0e28b431995bff
c30c04eb35d4ff5c75690016858f8678b3c5ee7c68ec4cd76b71573b50a23943
c5aff3477022f781ee765989cdf6abbdd986f331064c59f5655fab8c6f9796c7
c6846556479addb85175eb801d75cd64485ccec53b42fac54441fef1895c0408
c69445f7d9197d77b0d98fc2d4c19972148ab59e09816636137533a64f6d4041
c74679537a89890b260d93e19aad5f4cc95a230623a945ffcc3d981fc13a1adf
cac7a767eecdd70123f853d74d1fb29d15cb89dfd93215b57dce2606b4cd1c23
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d248a3e6b33b3da3d7546264b7d476d38a0b8ad73aba469d5f5fe12b1391d07f
db0031471b3f9181ff21d83674674ac3dd7c128531fae90bc274ad0e17c58c37
db82939943dfa4e2ddd5cb40b4eef2237e4ff65a12c248db91352b36dbbca8a3
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e28195ef556c2e1f2d22ff939f487f10a32e608255bbd541be3eda5883b414c3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5d717d2c24e52afc0e139b41d817580583acad2e3c9d725d1bd46f0f7e5cb1b
e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a
e61de02b5fa3204c2ed29bd12fcdceaff8d33d4e9be52ff1a6c02a03a407baea
e8a8cd48f7f93a8c8d708eda1f3f9c6ddd886c3f6c38eee67aeac98897b09510
e8d5b01af589f68a0f2da663d3efc472fabb22d9ede91a7ffcf74d21e6295506
e931faaef092c8d98a58ac536216378f58e2a17a4833bbe5f9a29e5bbed849f6
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ec895e944daf4d8226fe560ff1d95437497215d33885fe2d0db0e54ce3db6d96
ed3a677654473b8329f8d886993e734d6cef36c4273263b767be878c9ff8ff44
edd8db5c29b96b7a290a5e266d426dca85541b7cd7a62b180e5ec89dc635f05f
eec3860fdc0bff086a73a04051948c4e76ea29a6b61eaa870083739555b83f64
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f084c102586ae8b161379d7b96d20408bab4577337e96829fb88576e0f9b075d
f0ebf94842d7584c1c3c4925765c776bc6acc5345d1c01bdb846b416bad07877
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6
fe315ad2dc09f086467ade00e354f5803a2f47cfb0a455b3c089471d9b7f3219

forums.juniper.net Open in urlscan Pro 208.74.207.25 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

161 Requests

100 %HTTPS

31 %IPv6

33 Domains

49 Subdomains

43 IPs

8 Countries

5014 kBTransfer

12270 kBSize

0 Cookies

115 Outgoing links

Redirected requests

161 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

forums.juniper.net Open in urlscan Pro
208.74.207.25 Public Scan

Screenshot
Live screenshot

Full Image

161
Requests

100 %
HTTPS

31 %
IPv6

33
Domains

49
Subdomains

43
IPs

8
Countries

5014 kB
Transfer

12270 kB
Size

0
Cookies

161 HTTP transactions
1 data transactions