www.infosecurity-magazine.com Open in urlscan Pro
13.32.99.7  Public Scan

11 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 74

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5460932&time=1727230501678&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5460932&time=1727230501678&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tm=gtmv2&e_ipv6=AQJ4rPXViKRoiwAAAZIm9eNuogOmq3-Vp4vtrrZ6-ZQk2BITLyBR_UQ51CiyEmcn_sw4E7lPCc2k

Request Chain 77

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/875375440/?random=173815234&cv=11&fst=1727230501479&bg=ffffff&guid=ON&async=1&gtm=45be49n0v892578457z878347448za201zb78347448&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&label=a2QGCPW5tqwZENDWtKED&hn=www.googleadservices.com&frm=0&tiba=New%20Octo2%20Malware%20Variant%20Threatens%20Mobile%20Banking%20Security%20-%20Infosecurity%20Magazine&value=0&npa=1&pscdl=noapi&auid=1501389769.1727230501&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjDybECSixub3QtbmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&eitems=ChAI8MbJtwYQnov6zenRwpVmEh0ApmzywiWmYRwLZeGxwXLINb40hT8JVziGkFEpVg&pscrd=IhMInJL2g4PdiAMVK4qDBx0C0CNsMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggS HTTP 302
• https://www.google.com/pagead/1p-conversion/875375440/?random=173815234&cv=11&fst=1727230501479&bg=ffffff&guid=ON&async=1&gtm=45be49n0v892578457z878347448za201zb78347448&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&label=a2QGCPW5tqwZENDWtKED&hn=www.googleadservices.com&frm=0&tiba=New%20Octo2%20Malware%20Variant%20Threatens%20Mobile%20Banking%20Security%20-%20Infosecurity%20Magazine&value=0&npa=1&pscdl=noapi&auid=1501389769.1727230501&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjDybECSixub3QtbmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMInJL2g4PdiAMVK4qDBx0C0CNsMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggS&is_vtc=1&cid=CAQSGwDpaXnfXuu1a3FQH4MM5X9EakGHm3X2IaKmIg&eitems=ChAI8MbJtwYQnov6zenRwpVmEh0ApmzywsYNxK6eP8LYKwucjy-Zb7cwI2HQNE5Q3g&random=3123957365 HTTP 302
• https://www.google.de/pagead/1p-conversion/875375440/?random=173815234&cv=11&fst=1727230501479&bg=ffffff&guid=ON&async=1&gtm=45be49n0v892578457z878347448za201zb78347448&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&label=a2QGCPW5tqwZENDWtKED&hn=www.googleadservices.com&frm=0&tiba=New%20Octo2%20Malware%20Variant%20Threatens%20Mobile%20Banking%20Security%20-%20Infosecurity%20Magazine&value=0&npa=1&pscdl=noapi&auid=1501389769.1727230501&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjDybECSixub3QtbmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMInJL2g4PdiAMVK4qDBx0C0CNsMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggS&is_vtc=1&cid=CAQSGwDpaXnfXuu1a3FQH4MM5X9EakGHm3X2IaKmIg&eitems=ChAI8MbJtwYQnov6zenRwpVmEh0ApmzywsYNxK6eP8LYKwucjy-Zb7cwI2HQNE5Q3g&random=3123957365&ipr=y

92 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/	98 KB 25 KB	86ms 29ms	Document text/html	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash 12a5d8424b6483739f5a3702a156959ef812b3184eaeb70f342eef83e11ed384 Security Headers Name Value Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type access-control-allow-methods * age 38 cache-control public, proxy-revalidate, max-age=300 content-encoding br content-security-policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content content-type text/html; charset=utf-8 date Wed, 25 Sep 2024 02:14:22 GMT feature-policy accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none' last-modified Tue, 24 Sep 2024 15:30:00 GMT permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=() referrer-policy same-origin server RX vary Accept-Encoding via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) x-amz-cf-id 6xrDSYiFMAN2ijSKANfe3IH_lss1Ro0HCBI_rLQHExzc-5pFvLpsaA== x-amz-cf-pop FRA60-P3 x-cache Hit from cloudfront x-content-type-options nosniff x-frame-options SAMEORIGIN x-ua-compatible IE=Edge x-xss-protection 1; mode=block
GET H3	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	104 KB 32 KB	91ms 37ms	Script text/javascript	142.250.186.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f2.1e100.net Software cafe / Resource Hash d2d1c75fe1ad92522c34ecccc3c048bf1e6491501c7890f4c9565d30f5beab68 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 199 / 19991 / m202409190101 / config-hash: 4027773151633523031 x-content-type-options nosniff expires Wed, 25 Sep 2024 02:15:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" date Wed, 25 Sep 2024 02:15:00 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding content-disposition attachment; filename="f.txt" cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 32720 x-xss-protection 0 server cafe
GET H2	200	jquery.min.js Show response cdn.jsdelivr.net/npm/jquery@3.7.0/dist/	85 KB 32 KB	81ms 20ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/jquery@3.7.0/dist/jquery.min.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers access-control-expose-headers * content-encoding br etag W/"155a6-Wp7qw02G6S5WYOD0+HIE8e0Mj/Y" age 386941 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT date Wed, 25 Sep 2024 02:15:00 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220031-FRA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 32087 x-jsd-version 3.7.0
GET H2	200	underscore-min.min.js Show response cdn.jsdelivr.net/npm/underscore@1.13.6/	19 KB 8 KB	86ms 26ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/underscore@1.13.6/underscore-min.min.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bb20d24b99fd1eae4fd77c1e833ce0a4536189961ceb1114fd272ca31e8ebd82 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers access-control-expose-headers * content-encoding br etag W/"4d5b-1Barardb3Bq5uc0bP3wXZk8NDAQ" age 1547960 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT date Wed, 25 Sep 2024 02:15:00 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220031-FRA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 8075 x-jsd-version 1.13.6
GET H2	200	phq8nwg.css use.typekit.net/	11 KB 1 KB	271ms 162ms	Stylesheet text/css	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/phq8nwg.css Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 85b50ffe6b0cb56f765532dbac925599ddd984fcaefb0e2590099105dbd044da Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers strict-transport-security max-age=31536000; includeSubDomains; cache-control private, max-age=600, stale-while-revalidate=604800 timing-allow-origin * content-encoding gzip cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 1297 date Wed, 25 Sep 2024 02:15:00 GMT content-type text/css;charset=utf-8 vary Accept-Encoding server nginx
GET H2	200	base.min.css www.infosecurity-magazine.com/_common/css/23080201/	66 KB 10 KB	31ms 26ms	Stylesheet text/css	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.infosecurity-magazine.com/_common/css/23080201/base.min.css?v=23080201 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash c08e633b39381743b6e6bca9c5922e9aa9ba5f3044c29031b0076a47b4af1927 Security Headers Name Value Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Response headers content-encoding br etag W/"5d7f1bbc1b1da1:0" age 78043 x-content-type-options nosniff access-control-allow-methods * x-cache Hit from cloudfront x-ua-compatible IE=Edge x-amz-cf-id 5T_BlY_dlRtaLX7D6kXZzXUvn1WtIXNziKJUoJt41kGKq5dn1RLhqQ== date Tue, 24 Sep 2024 04:34:17 GMT content-type text/css feature-policy accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none' vary Accept-Encoding last-modified Wed, 29 May 2024 12:14:18 GMT access-control-allow-headers Content-Type x-frame-options SAMEORIGIN content-security-policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content referrer-policy same-origin via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=() x-xss-protection 1; mode=block x-amz-cf-pop FRA60-P3 server RX
GET H2	200	article.min.css www.infosecurity-magazine.com/_common/css/23080201/	5 KB 3 KB	32ms 27ms	Stylesheet text/css	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.infosecurity-magazine.com/_common/css/23080201/article.min.css?v=23080201 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash 778f93243401b2fd6663834b51f4d3f32012d6ee11f40f6169af721331bd1682 Security Headers Name Value Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Response headers content-encoding br etag W/"97984bbbc1b1da1:0" age 60550 x-content-type-options nosniff access-control-allow-methods * x-cache Hit from cloudfront x-ua-compatible IE=Edge x-amz-cf-id kYq6Hw7FY0idnh7SsGgbMjSTkmpP6lOz0EZF9wOlVMnGqoH2MIGqxg== date Tue, 24 Sep 2024 09:25:50 GMT content-type text/css feature-policy accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none' vary Accept-Encoding last-modified Wed, 29 May 2024 12:14:18 GMT access-control-allow-headers Content-Type x-frame-options SAMEORIGIN content-security-policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content referrer-policy same-origin via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=() x-xss-protection 1; mode=block x-amz-cf-pop FRA60-P3 server RX
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	21 KB 7 KB	89ms 32ms	Script application/javascript	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-md5 jwlUUXc1HMPClYXMpY+NPQ== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCDBEEB2005B25 x-ms-lease-status unlocked cf-cache-status HIT age 66689 x-content-type-options nosniff date Wed, 25 Sep 2024 02:15:00 GMT content-type application/javascript last-modified Mon, 23 Sep 2024 16:42:21 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 90e1678a-501e-001f-2ee9-0d489a000000 cf-ray 8c8781030f123732-FRA accept-ranges bytes access-control-allow-origin * content-length 6881 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	ism.js Show response www.infosecurity-magazine.com/_common/js/23080201/	5 KB 3 KB	29ms 27ms	Script application/javascript	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.infosecurity-magazine.com/_common/js/23080201/ism.js?v=23080201 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash fded88b84aecf0d550b1d26a85a971351a138a573dbd6bd88cb646de1e7ab42a Security Headers Name Value Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Response headers content-encoding br etag W/"6a124d46ac6d91:0" age 68027 x-content-type-options nosniff access-control-allow-methods * x-cache Hit from cloudfront x-ua-compatible IE=Edge x-amz-cf-id IPJ70LYNruEiKMIOwevFyRlojX--rX8XSqw8yzcj8re7nVbbBzq0zg== date Tue, 24 Sep 2024 07:21:13 GMT content-type application/javascript feature-policy accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none' vary Accept-Encoding last-modified Thu, 03 Aug 2023 12:59:01 GMT access-control-allow-headers Content-Type x-frame-options SAMEORIGIN content-security-policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content referrer-policy same-origin via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=() x-xss-protection 1; mode=block x-amz-cf-pop FRA60-P3 server RX
GET H2	200	ism.ads.es5.min.js Show response www.infosecurity-magazine.com/_common/js/23080201/ism/	6 KB 3 KB	30ms 29ms	Script application/javascript	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.infosecurity-magazine.com/_common/js/23080201/ism/ism.ads.es5.min.js?v=23080201 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash cbe5296bf61f4ee88ecab204fe1ec3a144660caa32b71d9744f01102286df62a Security Headers Name Value Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Response headers content-encoding br etag W/"4e8ac8c2c1b1da1:0" age 3414 x-content-type-options nosniff access-control-allow-methods * x-cache Hit from cloudfront x-ua-compatible IE=Edge x-amz-cf-id L8aV8Dkgc9H6CMEkKK_WO1oMSx7J32Qr0SlfecTJTycb-hd5uGYlhA== date Wed, 25 Sep 2024 01:18:06 GMT content-type application/javascript feature-policy accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none' vary Accept-Encoding last-modified Wed, 29 May 2024 12:14:31 GMT access-control-allow-headers Content-Type x-frame-options SAMEORIGIN content-security-policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content referrer-policy same-origin via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=() x-xss-protection 1; mode=block x-amz-cf-pop FRA60-P3 server RX
GET H2	200	ism.whatshot.es5.min.js Show response www.infosecurity-magazine.com/_common/js/23080201/ism/	851 B 2 KB	24ms 24ms	Script application/javascript	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.infosecurity-magazine.com/_common/js/23080201/ism/ism.whatshot.es5.min.js?v=23080201 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash ecde3c0d9f4721fd5bc3989d1e6103966b836786849f65ead031a1c758687ef0 Security Headers Name Value Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Response headers etag "444aa9c1c1b1da1:0" age 63243 x-content-type-options nosniff access-control-allow-methods * x-cache Hit from cloudfront x-ua-compatible IE=Edge x-amz-cf-id KGQPL3zNMr_igt6qceM0jzZ4_L3HmLDOKnhQF7DhKCqyEzSPOg5osQ== date Tue, 24 Sep 2024 08:40:57 GMT content-type application/javascript feature-policy accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none' last-modified Wed, 29 May 2024 12:14:29 GMT access-control-allow-headers Content-Type x-frame-options SAMEORIGIN content-security-policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content referrer-policy same-origin via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=() accept-ranges bytes content-length 851 x-xss-protection 1; mode=block x-amz-cf-pop FRA60-P3 server RX
GET H2	200	p.css p.typekit.net/	5 B 173 B	151ms 40ms	Stylesheet text/css	2a02:26f0:3500:16::215:1494 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=phq8nwg&ht=tk&f=15982.15984.37450.16353.37464.37466.37515.37516.37517.37518.37519.37520.51838.51839.51840.51841&a=6157095&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/phq8nwg.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1494 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control public, max-age=604800 etag "6649f74c-5" cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 5 date Wed, 25 Sep 2024 02:15:00 GMT content-type text/css last-modified Sun, 19 May 2024 12:57:48 GMT server nginx
GET H2	200	6b575081-117f-49ba-bff7-347875107505.json Show response cdn.cookielaw.org/consent/6b575081-117f-49ba-bff7-347875107505/	4 KB 2 KB	87ms 41ms	XHR application/json	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/6b575081-117f-49ba-bff7-347875107505/6b575081-117f-49ba-bff7-347875107505.json Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 320b23415a9ca25f7546db36c5b7e2e2104f8c62e73fbdb184c03dc0948e3afb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-md5 cmmGmuVtZN6ImPkSS45ukA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DC90F45F43E159 age 45879 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Thu, 26 Sep 2024 02:15:00 GMT date Wed, 25 Sep 2024 02:15:00 GMT content-type application/json last-modified Thu, 20 Jun 2024 06:44:02 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id 404c29b0-b01e-00d9-3edd-c235a6000000 cf-ray 8c878105ad3a3a7a-FRA accept-ranges bytes access-control-allow-origin * content-length 1562 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	gtm.js Show response www.googletagmanager.com/	318 KB 108 KB	89ms 39ms	Script application/javascript	2a00:1450:4001:808::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MJ69SWF Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0f92c8e7a00fed3898525ef70d1139f3c1ad85e585062ea7e58b7d91c41c5838 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br expires Wed, 25 Sep 2024 02:15:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 25 Sep 2024 02:15:00 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Wed, 25 Sep 2024 00:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin * content-length 109706 x-xss-protection 0 server Google Tag Manager
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	98ms 18ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 content-encoding gzip age 2925 cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Wed, 25 Sep 2024 03:26:15 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 date Wed, 25 Sep 2024 01:26:15 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript server Golfe2 vary Accept-Encoding
GET H3	200	pubads_impl.js Show response securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/	479 KB 149 KB	24ms 23ms	Script text/javascript	142.250.186.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f2.1e100.net Software cafe / Resource Hash c5a5ee71d7aa281ba1438194b7024808e3f9ab07fbfb0654193d9e65d9f4838c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 4932103322520343457 age 31923 x-content-type-options nosniff expires Wed, 24 Sep 2025 17:22:57 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" date Tue, 24 Sep 2024 17:22:57 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, immutable, max-age=31536000 timing-allow-origin * cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 152859 x-xss-protection 0 server cafe
GET H3	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	217 B 134 B	75ms 31ms	XHR application/json	142.250.186.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.infosecurity-magazine.com Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f2.1e100.net Software cafe / Resource Hash 6511c9f32ed71c1b7491e4ee493babf325a33e607436ad50c2cc0faab57915f1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control private, max-age=3600, stale-while-revalidate=3600 timing-allow-origin * content-encoding br cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Wed, 25 Sep 2024 02:15:00 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-length 109 date Wed, 25 Sep 2024 02:15:00 GMT x-xss-protection 0 content-type application/json; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	1a6ee92f-d006-49c0-a850-395627287b78.jpg assets.infosecurity-magazine.com/webpage/feat/	56 KB 56 KB	85ms 68ms	Image image/jpeg	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://assets.infosecurity-magazine.com/webpage/feat/1a6ee92f-d006-49c0-a850-395627287b78.jpg Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash 52dd034510c47c0de140a4e43f3da9ee31b1ae1dcc67496dd7f676feb4b9d702 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.infosecurity-magazine.com/ Response headers strict-transport-security max-age=31536000 cache-control private, max-age=2764800 x-content-type-options nosniff via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) x-cache Miss from cloudfront content-length 57308 x-ua-compatible IE=Edge date Wed, 25 Sep 2024 02:15:00 GMT x-xss-protection 1; mode=block content-type image/jpeg x-amz-cf-pop FRA60-P3 server RX x-amz-cf-id PLGz8y-jPfjnk0Wp6XMdIXnfym84c0hLCg-UZoXpf2O9Nh84gYk0CA== x-frame-options SAMEORIGIN
GET H2	200	l use.typekit.net/af/73dbad/00000000000000007735a197/30/	24 KB 24 KB	141ms 35ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/73dbad/00000000000000007735a197/30/l?subset_id=2&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/phq8nwg.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 4ca1e0e518aaf5d78abd4fc78268ac642cb679dbb56a905d2c57a296566a0bba Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.infosecurity-magazine.com Referer https://use.typekit.net/phq8nwg.css Response headers cache-control public, max-age=31536000 timing-allow-origin * etag "550ca47a88a465c010c13a8c017f04a91a75a9a4" cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 24168 date Wed, 25 Sep 2024 02:15:00 GMT content-type application/font-woff2 server nginx
GET H2	200	l use.typekit.net/af/2180b4/00000000000000007735a193/30/	23 KB 23 KB	145ms 41ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/2180b4/00000000000000007735a193/30/l?subset_id=2&fvd=n6&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/phq8nwg.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash a45a4393f8b7ac978e32ac46f58dad43eb83811a4b3d9f7b79cac1f864edd662 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.infosecurity-magazine.com Referer https://use.typekit.net/phq8nwg.css Response headers cache-control public, max-age=31536000 timing-allow-origin * etag "d42a9fe146eae2c4c65475dbd44806c5aed58d8b" cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 23312 date Wed, 25 Sep 2024 02:15:00 GMT content-type application/font-woff2 server nginx
GET H2	200	l use.typekit.net/af/32b0e4/00000000000000007735a185/30/	44 KB 45 KB	148ms 45ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/32b0e4/00000000000000007735a185/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/phq8nwg.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 4f8059cfd6739160b9073e937833a58c728a9791b380f27fcf2d047d76951155 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.infosecurity-magazine.com Referer https://use.typekit.net/phq8nwg.css Response headers cache-control public, max-age=31536000 timing-allow-origin * etag "dead750a1d4bc579636464295fb9e45aa84c4884" cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 45468 date Wed, 25 Sep 2024 02:15:00 GMT content-type application/font-woff2 server nginx
GET H2	200	605bfdcb-abca-4e31-9902-3a3d746228ce.png assets.infosecurity-magazine.com/s3/infosec-media/images/profile/	2 KB 2 KB	31ms 23ms	Image image/webp	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://assets.infosecurity-magazine.com/s3/infosec-media/images/profile/605bfdcb-abca-4e31-9902-3a3d746228ce.png?width=64&height=64&mode=crop&scale=both&format=webp Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash 07ac84596d158248a60c2f747f609a508e6e2f1980a23f0608caee79a30291b7 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers age 732557 x-content-type-options nosniff expires Fri, 18 Oct 2024 14:45:43 GMT x-cache Hit from cloudfront x-ua-compatible IE=Edge x-amz-cf-id 6W1VAO0shVk9RGLwQg0ckxckCTtFbCyp3mJ5yYS5w3fu5t8BKXLA3g== date Mon, 16 Sep 2024 14:45:43 GMT content-type image/webp x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 cache-control public x-aspnet-version 4.0.30319 via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) content-length 1686 x-xss-protection 1; mode=block x-amz-cf-pop FRA60-P3 server RX
GET H2	200	/ Show response www.infosecurity-magazine.com/account-buttons/	240 B 2 KB	113ms 107ms	XHR application/json	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.infosecurity-magazine.com/account-buttons/?time=1727230500758 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash 4e916eb59cd64cce6fc41e3355180f0284ae0edc2602686431e90f2e7f082652 Security Headers Name Value Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers X-NewRelic-ID Vg8GV1ZVCxACUFBSAgMEV1c= Referer https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI5MTYwNjMiLCJhcCI6IjMyMjUzNTU3MiIsImlkIjoiZjE1ZDZiMzk4NDU1NGVjMyIsInRyIjoiZTZhMDUzMTk1MzAxYzYwODE1YTdiODNiZGQ1OGNjMjIiLCJ0aSI6MTcyNzIzMDUwMDc2MX19 traceparent 00-e6a053195301c60815a7b83bdd58cc22-f15d6b3984554ec3-01 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept */* tracestate 2916063@nr=0-1-2916063-322535572-f15d6b3984554ec3----1727230500761 Response headers x-content-type-options nosniff access-control-allow-methods * expires -1 x-cache Miss from cloudfront x-ua-compatible IE=Edge x-amz-cf-id m5781T7srlY3Wz5dzel4OWZIkXZP5-cs4HbomNkjU4lUYKnxObMbrA== date Wed, 25 Sep 2024 02:15:00 GMT content-type application/json; charset=utf-8 feature-policy accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none' access-control-allow-headers Content-Type x-frame-options SAMEORIGIN content-security-policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content cache-control no-cache, no-store pragma no-cache referrer-policy same-origin via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=() content-length 240 x-xss-protection 1; mode=block x-amz-cf-pop FRA60-P3 server RX
GET H2	200	/ Show response www.infosecurity-magazine.com/nav/mobile/	4 KB 2 KB	66ms 59ms	XHR text/html	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.infosecurity-magazine.com/nav/mobile/ Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash 53fc4495c7705b2373e2b73ec881c82dffb40cfbd744d8e5bd8ba7f5a018575b Security Headers Name Value Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers X-NewRelic-ID Vg8GV1ZVCxACUFBSAgMEV1c= Referer https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI5MTYwNjMiLCJhcCI6IjMyMjUzNTU3MiIsImlkIjoiMTRhNWNlYTY1MWU1MzQ3NiIsInRyIjoiYmUyNTYzOTJiMDgxMDk4ZWE0ZjI1NDkyYjA4YTIwOGIiLCJ0aSI6MTcyNzIzMDUwMDc2Mn19 traceparent 00-be256392b081098ea4f25492b08a208b-14a5cea651e53476-01 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept */* tracestate 2916063@nr=0-1-2916063-322535572-14a5cea651e53476----1727230500762 Response headers content-encoding br x-content-type-options nosniff access-control-allow-methods * x-cache Miss from cloudfront x-ua-compatible IE=Edge x-amz-cf-id enJgKEUtlxc4nZvVjfaHY2SbE-PVjf9ultlMdLVUhMq3qlsVaYZxdw== date Wed, 25 Sep 2024 02:15:00 GMT content-type text/html; charset=utf-8 vary Accept-Encoding feature-policy accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none' access-control-allow-headers Content-Type x-frame-options SAMEORIGIN content-security-policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content cache-control private referrer-policy same-origin via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=() x-xss-protection 1; mode=block x-amz-cf-pop FRA60-P3 server RX
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	59 B 295 B	97ms 36ms	XHR application/json	2606:4700:4400::6812:2089 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 accept application/json Referer Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip access-control-allow-methods GET, OPTIONS cf-ray 8c8781065e394d37-FRA access-control-allow-origin * date Wed, 25 Sep 2024 02:15:00 GMT content-type application/json vary Accept-Encoding server cloudflare access-control-allow-headers Content-Type
GET H3	200	ads Show response pagead2.googlesyndication.com/gampad/	72 KB 26 KB	115ms 63ms	Fetch text/plain	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/gampad/ads?pvsid=775757514152870&correlator=3698573546777546&eid=31079957%2C31083340%2C31083341%2C31087358&output=ldjh&gdfp_req=1&vrg=202409190101&ptt=17&impl=fifs&iu_parts=1165%2Crx_infosecurity_magazine%2Cnews%2Cocto2-malware-threatens-mobile&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90&ifi=1&sfv=1-0-40&eri=1&sc=1&abxe=1&dt=1727230500880&lmt=1727191800&adxs=436&adys=8&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&vis=1&psz=1600x50&msz=728x50&fws=0&ohw=0&td=1&egid=41639&tan=e344431d-a7c9-4002-b74b-8391f21b1ba6&tdf=2&topics=5&tps=5&htps=5&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1727230500252&idt=550&cust_params=topics%3DApplication%2520Security%252CCybercrime%252CHuman%2520Factor%252CMalware%252CMobile%2520Security%252CPayment%2520Security%252CMobile%2520Application%2520Security%252CPhishing%252CThreat%2520Intelligence%252CSocial%2520Engineering%252CSecure%2520Transactions&adks=420187029&frm=20 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash f0870261db30c2722da5728264b277e5c4d344ce8b1c0d6e1e4e14c78cd5ffbc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br google-lineitem-id 6785956999 x-content-type-options nosniff google-mediationtag-id -2 google-mediationgroup-id -2 expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Wed, 25 Sep 2024 02:15:00 GMT content-type text/plain; charset=UTF-8 google-creative-id 138489076818 cache-control no-cache, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin https://www.infosecurity-magazine.com content-length 26733 x-xss-protection 0 server cafe
GET H3	200	ads Show response pagead2.googlesyndication.com/gampad/	72 KB 26 KB	108ms 61ms	Fetch text/plain	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/gampad/ads?pvsid=775757514152870&correlator=4246767098701192&eid=31079957%2C31083340%2C31083341%2C31087358&output=ldjh&gdfp_req=1&vrg=202409190101&ptt=17&impl=fifs&iu_parts=1165%2Crx_infosecurity_magazine%2Cnews%2Cocto2-malware-threatens-mobile&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=2&sfv=1-0-40&eri=1&sc=1&abxe=1&dt=1727230500889&lmt=1727191800&adxs=1046&adys=760&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&vis=1&psz=364x329&msz=300x250&fws=0&ohw=0&td=1&egid=41639&tan=e344431d-a7c9-4002-b74b-8391f21b1ba7&tdf=2&topics=5&tps=5&htps=5&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1727230500252&idt=550&cust_params=topics%3DApplication%2520Security%252CCybercrime%252CHuman%2520Factor%252CMalware%252CMobile%2520Security%252CPayment%2520Security%252CMobile%2520Application%2520Security%252CPhishing%252CThreat%2520Intelligence%252CSocial%2520Engineering%252CSecure%2520Transactions&adks=263018736&frm=20 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash 6d1fa970766ea4c05c9c8d8f92a6865fadef9a332172b52cc2984e82e3605abb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br google-lineitem-id 6785956999 x-content-type-options nosniff google-mediationtag-id -2 google-mediationgroup-id -2 expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Wed, 25 Sep 2024 02:15:00 GMT content-type text/plain; charset=UTF-8 google-creative-id 138489322673 cache-control no-cache, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin https://www.infosecurity-magazine.com content-length 26674 x-xss-protection 0 server cafe
GET H3	200	ads Show response pagead2.googlesyndication.com/gampad/	72 KB 26 KB	107ms 70ms	Fetch text/plain	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/gampad/ads?pvsid=775757514152870&correlator=86139947436983&eid=31079957%2C31083340%2C31083341%2C31087358&output=ldjh&gdfp_req=1&vrg=202409190101&ptt=17&impl=fifs&iu_parts=1165%2Crx_infosecurity_magazine%2Cnews%2Cocto2-malware-threatens-mobile&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90&ifi=3&sfv=1-0-40&eri=1&sc=1&abxe=1&dt=1727230500893&lmt=1727191800&adxs=436&adys=1142&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&vis=1&psz=1600x50&msz=728x50&fws=512&ohw=0&td=1&egid=41639&tan=e344431d-a7c9-4002-b74b-8391f21b1ba8&tdf=2&topics=5&tps=5&htps=5&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1727230500252&idt=550&cust_params=topics%3DApplication%2520Security%252CCybercrime%252CHuman%2520Factor%252CMalware%252CMobile%2520Security%252CPayment%2520Security%252CMobile%2520Application%2520Security%252CPhishing%252CThreat%2520Intelligence%252CSocial%2520Engineering%252CSecure%2520Transactions&adks=3770769768&frm=20 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash c42c1a47ea7d7d86c6335c4be1e1e3d3dde7788825a3f472d6e38cd46ab7ce4b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br google-lineitem-id 6785956999 x-content-type-options nosniff google-mediationtag-id -2 google-mediationgroup-id -2 expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Wed, 25 Sep 2024 02:15:00 GMT content-type text/plain; charset=UTF-8 google-creative-id 138489076818 cache-control no-cache, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin https://www.infosecurity-magazine.com content-length 26682 x-xss-protection 0 server cafe
GET H2	200	container.html 87dfc31b6c02d0705a1153d81979ec28.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 71C0	0 0	100ms 30ms	Document text/html	2a00:1450:4001:806::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://87dfc31b6c02d0705a1153d81979ec28.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, max-age=300 content-encoding br content-length 2653 content-type text/html cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" cross-origin-resource-policy cross-origin date Wed, 25 Sep 2024 02:15:00 GMT expires Wed, 25 Sep 2024 02:15:00 GMT last-modified Thu, 03 Nov 2022 19:10:08 GMT report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} server sffe timing-allow-origin * vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/202405.2.0/	451 KB 110 KB	32ms 32ms	Script application/javascript	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202405.2.0/otBannerSdk.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 402dda334f81814b077c20d0d093636239c027f3e82996fd7c12cb91aa57540a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-md5 Ryx3T13YxV6i1yEKSnAPIA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCA5E423ECD5E2 x-ms-lease-status unlocked cf-cache-status HIT age 28684 x-content-type-options nosniff date Wed, 25 Sep 2024 02:15:00 GMT content-type application/javascript last-modified Tue, 16 Jul 2024 22:10:45 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 96934d7a-301e-0069-12ce-d7cc26000000 cf-ray 8c878106e9923732-FRA accept-ranges bytes access-control-allow-origin * content-length 112015 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	js Show response www.googletagmanager.com/gtag/	312 KB 104 KB	52ms 51ms	Script application/javascript	2a00:1450:4001:808::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-8VSXE5KKGM&l=dataLayer&cx=c Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 66624b08b100c9a2bee78418e76a16a3e1a6d0b6a5d8646ba423e18403a73645 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 content-encoding br cross-origin-resource-policy cross-origin access-control-allow-credentials true expires Wed, 25 Sep 2024 02:15:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 106524 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type application/javascript; charset=UTF-8 vary Accept-Encoding server Google Tag Manager access-control-allow-headers Cache-Control
GET H2	200	destination Show response www.googletagmanager.com/gtag/	275 KB 94 KB	73ms 72ms	Script application/javascript	2a00:1450:4001:808::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-875375440&l=dataLayer&cx=c Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4b76d818822846c31442acd04411a22c866c95d46b2e0b73b3aa754c99c57ab7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br expires Wed, 25 Sep 2024 02:15:01 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 25 Sep 2024 02:15:01 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Wed, 25 Sep 2024 00:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin * content-length 96159 x-xss-protection 0 server Google Tag Manager
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	175ms 42ms	Script application/javascript	2a02:26f0:3500:10::210:a9a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:10::210:a9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control max-age=51255 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Wed, 25 Sep 2024 02:15:01 GMT last-modified Thu, 22 Aug 2024 10:43:55 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	225 KB 58 KB	159ms 29ms	Script application/x-javascript	157.240.253.1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-fra5.fbcdn.net Software / Resource Hash 68fdc316e5a11d1e2430511eaf2b62d8a1b8de21814924a567473ecb3c4b4fae Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 edge-control cache-maxage=10m date Wed, 25 Sep 2024 02:15:01 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" x-fb-connection-quality EXCELLENT; q=0.9, rtt=35, rtx=0, c=23, mss=1232, tbw=4466, tp=9, tpl=0, uplat=0, ullat=-1 pragma public x-fb-debug z2dUw8MYwDDoC38EDnArjPUDaJi11brCtk6uNZSGTf0rvFFMtTx3l4WqY/sk8p01DvqT9FkheesbO5CifNqMdQ== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 58975 x-xss-protection 0 origin-agent-cluster ?0
GET H2	200	oct.js Show response static.ads-twitter.com/	56 KB 15 KB	163ms 34ms	Script application/javascript	199.232.188.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/oct.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers vary Accept-Encoding,Host cache-control no-cache content-encoding gzip etag "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip" accept-ranges bytes x-cache HIT, HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-length 15412 date Wed, 25 Sep 2024 02:15:01 GMT x-tw-cdn FT last-modified Fri, 22 Mar 2024 21:07:24 GMT content-type application/javascript; charset=utf-8 x-served-by cache-iad-kjyo7100113-IAD, cache-muc13961-MUC x-amz-server-side-encryption AES256
GET H2	200	tag.aspx Show response ml314.com/	38 KB 39 KB	155ms 28ms	Script application/javascript	34.117.77.79 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ml314.com/tag.aspx?2582024 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 79.77.117.34.bc.googleusercontent.com Software UploadServer / Resource Hash d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers x-goog-metageneration 1 x-goog-hash crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg== etag "632616ff15825f030aab3391a58ef042" age 1822 x-goog-stored-content-encoding identity x-cache-hit hit alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 39162 date Wed, 25 Sep 2024 01:44:39 GMT last-modified Wed, 24 Jul 2024 19:30:50 GMT content-type application/javascript x-guploader-uploadid AD-8lju2FRVD1yAJBg8QGgr_w5oQyx95RMp-lLx6O1qOB2WoJYzuAOgnVR-iBmCQbNnmqPm6FQ4 cache-control public,max-age=3600 x-goog-storage-class STANDARD via 1.1 google cache-id FRA accept-ranges bytes x-goog-generation 1721849450340665 content-length 39162 server UploadServer
GET H2	200	en.json Show response cdn.cookielaw.org/consent/6b575081-117f-49ba-bff7-347875107505/018e2cd8-c28b-750d-9e58-7ba1eec301f0/	54 KB 14 KB	48ms 48ms	Fetch application/json	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/6b575081-117f-49ba-bff7-347875107505/018e2cd8-c28b-750d-9e58-7ba1eec301f0/en.json Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 722b835dd570d6861f5cbf3513ecfe92232a26f68dd054d64415b271396b818a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-md5 D5PKW79w5z4Qq3Mfl/+DAA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DC90F460CF07B1 age 58656 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Thu, 26 Sep 2024 02:15:01 GMT date Wed, 25 Sep 2024 02:15:01 GMT content-type application/json last-modified Thu, 20 Jun 2024 06:44:05 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id 645a0455-601e-0071-37dd-c2e1b3000000 cf-ray 8c8781079e293a7a-FRA accept-ranges bytes access-control-allow-origin * content-length 13909 x-ms-blob-type BlockBlob server cloudflare
GET H3	200	view pagead2.googlesyndication.com/pcs/ Frame 7DB4	0 0	105ms 60ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssopEC90AK8EGpOF1Vo196mTpUR1XChruMCKu-2m14HU1eTFCHzEcvoIkaSfon90HZ8AU60-DbumkyYFQ0I69xqt4yIjiXnSZtx3E5xbG82vxF96COucjlIgFFP5BwoeTd06UzIiwNta5LQeoeUgSsVvK4OIoLdum996g5bkd1GoLQ-buq58fl0R5CsAPeb9KAeltASZYi5Siz3qapAVd9tyvAoJbnRqiE3u7_eXh1cm4tEGZ6pYocyxn20miqjJbDcbFjylDrsH_KiPIX99CK_Hs2XKn5Eq2RSIgEE0hlVmZVOc1sbjK5TjnD_PocinANKcdQJo-PMLjf2FuQKwtD6MQcXceg9chRvWyWuGluR9Cjc50kHWqdQiZDb_Hz2W-fRoJSODOwm79AZH5CKskq1o2eQJggp_31dwdYbEpFMHPVndR2JQK8oS3ugdEICleEX-9zGXplkf8WxfwDLD1rB&sig=Cg0ArKJSzKBMcm6oxazkEAE&uach_m=%5BUACH%5D&adurl= Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control private timing-allow-origin * accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 cross-origin-resource-policy cross-origin x-content-type-options nosniff access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	abg_lite_fy2021.js Show response pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/ Frame 7DB4	23 KB 9 KB	77ms 32ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/abg_lite_fy2021.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash ba5f8d3b5cd5d1a9d01d0f07c1bf82b4f422d963ab1a406e2deca0074cf5f32f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 1262224488297882673 age 44365 x-content-type-options nosniff expires Tue, 08 Oct 2024 13:55:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Tue, 24 Sep 2024 13:55:36 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=1209600 timing-allow-origin * cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 9310 x-xss-protection 0 server cafe
GET H3	200	window_focus_fy2021.js Show response pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/client/ Frame 7DB4	3 KB 1 KB	104ms 59ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/client/window_focus_fy2021.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash 66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 16544991220582087243 age 44365 x-content-type-options nosniff expires Tue, 08 Oct 2024 13:55:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Tue, 24 Sep 2024 13:55:36 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=1209600 timing-allow-origin * cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 1229 x-xss-protection 0 server cafe
GET H3	200	ufs_web_display.js Show response pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 7DB4	206 KB 64 KB	73ms 31ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash dfb0db8531c5917d5f1151c65dfc80f61cede542e49a51a5d1d5de5a70d0944b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 7801886641448685286 age 3165 x-content-type-options nosniff expires Wed, 25 Sep 2024 02:22:16 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Wed, 25 Sep 2024 01:22:16 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=ISO-8859-2 vary Accept-Encoding cache-control public, max-age=3600, stale-while-revalidate=3600 timing-allow-origin * cross-origin-resource-policy cross-origin content-length 65415 x-xss-protection 0 server cafe
GET H2	200	12464256554044988460 tpc.googlesyndication.com/simgad/ Frame 7DB4	56 KB 56 KB	118ms 24ms	Image image/png	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/12464256554044988460 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 004ed41df5a17fca8a504038688c6ac4c8b6f8a63e4a359d4b1cef6a33088593 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers age 65304 report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} x-content-type-options nosniff expires Wed, 24 Sep 2025 08:06:37 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 allow-fenced-frame-automatic-beacons true date Tue, 24 Sep 2024 08:06:37 GMT last-modified Mon, 16 Sep 2024 08:32:19 GMT content-type image/png cache-control public, max-age=31536000 timing-allow-origin * x-dns-prefetch-control off cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" content-length 56846 x-xss-protection 0 server sffe
GET DATA	200 OK	truncated / Frame 7DB4	211 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8e266adcfc960e8d15a38a80081f853eb951b2c8b599a2fbbdd3b19ad56aee52 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET H3	200	view pagead2.googlesyndication.com/pcs/ Frame 0D38	0 0	60ms 56ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjss83s2SpmnCbC1XoHGUneWszVOo5_znKzo7E8XTD-SKi3M5i3l0tjZ9Q_vAq9UHnAGR2SHfe_CxAKgP-CVRmj2erPJ3HrGgiZY6kBzqivypifb8_CLyEcTv-GQkfSJSeVS5AktcR1_3wfGx-JgGsUCCTCOX2ciGiR1IBlnL7n5zVZNMQZRFtJYU3eFnwlAaqhEfJgBbDzADy7pxj3hYQs5shR31wTDb16zy7Ifhch561mOG8GWWhO0a8oVrLMe9lV7U1X5CJujyL8JF0C34THOwNhIJGCTiumAttO-n1SOFca2ovKtO8MY0dAL6bq85J3N8qli4m6_WAvvdJRhx-x4APF4uQTDFRvkHm6dkP_veELy4zezn6Hpu94QLf6NNqAzM78eJFHn73Rnir9ERjxdUpqpiVlgQoObcb29cjU0KHUk97DzkaLKRB8YMwPLFLTu3zkR4uqJw-sTMrs0boB_G&sig=Cg0ArKJSzNxrHU8IniL7EAE&uach_m=%5BUACH%5D&adurl= Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control private timing-allow-origin * accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 cross-origin-resource-policy cross-origin x-content-type-options nosniff access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	abg_lite_fy2021.js Show response pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/ Frame 0D38	23 KB 0	19ms 19ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/abg_lite_fy2021.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash ba5f8d3b5cd5d1a9d01d0f07c1bf82b4f422d963ab1a406e2deca0074cf5f32f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 1262224488297882673 age 44365 x-content-type-options nosniff expires Tue, 08 Oct 2024 13:55:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Tue, 24 Sep 2024 13:55:36 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=1209600 timing-allow-origin * cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 9310 x-xss-protection 0 server cafe
GET H3	200	window_focus_fy2021.js Show response pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/client/ Frame 0D38	3 KB 0	37ms 37ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/client/window_focus_fy2021.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash 66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 16544991220582087243 age 44365 x-content-type-options nosniff expires Tue, 08 Oct 2024 13:55:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Tue, 24 Sep 2024 13:55:36 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=1209600 timing-allow-origin * cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 1229 x-xss-protection 0 server cafe
GET H3	200	ufs_web_display.js Show response pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 0D38	206 KB 0	13ms 13ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash dfb0db8531c5917d5f1151c65dfc80f61cede542e49a51a5d1d5de5a70d0944b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 7801886641448685286 age 3165 x-content-type-options nosniff expires Wed, 25 Sep 2024 02:22:16 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Wed, 25 Sep 2024 01:22:16 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=ISO-8859-2 vary Accept-Encoding cache-control public, max-age=3600, stale-while-revalidate=3600 timing-allow-origin * cross-origin-resource-policy cross-origin content-length 65415 x-xss-protection 0 server cafe
GET H2	200	12209591959233352387 tpc.googlesyndication.com/simgad/ Frame 0D38	46 KB 47 KB	79ms 52ms	Image image/png	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/12209591959233352387 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c538b86208051b6539e5e04493e584435e1f4986220edd809d1bcc9130458db7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers age 360891 report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} x-content-type-options nosniff expires Sat, 20 Sep 2025 22:00:10 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 allow-fenced-frame-automatic-beacons true date Fri, 20 Sep 2024 22:00:10 GMT last-modified Mon, 16 Sep 2024 08:31:57 GMT content-type image/png cache-control public, max-age=31536000 timing-allow-origin * x-dns-prefetch-control off cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" content-length 47484 x-xss-protection 0 server sffe
GET H3	200	view pagead2.googlesyndication.com/pcs/ Frame B1F1	0 0	61ms 55ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvYzrsAZbzHvzDyJXcIkR8PuRvcwKmT3mfPN-axHcUJfxQfEl4cERrRto1qyLKyD34OGzFrT7xzukSKWDbGuTh0iDabTRi68_DkpNfATuCIJdu-JMnnTyRzFbylhEV6wmAMRCVf8hnHIgNnBUzTEepWRfz5anZFLGUKL3SWF_FXjVKV4WmCoDEujd7ZfECbwMu8wzn8K_btzZ1MtYlKA1yCclEl2KNeg6McvA9Bxdub1L4cq2P5-N6U5z0s5L7yG_KOqGNKQp9GlYB5QLmQFTR4Ybsvl2H68aFM_u2OrQ5lZFJ-5xL42_KYGTQbCjrz0pAOt3BqK_T285-arFFSMqon5oKq2lgL3mxMa5jnJqsMyfDjFD0WFtWJ9NhPHXWC_-AbQ81mM9OE0ONffepTL-1eZ0FD3vEY_HfwqNf_yfVrZr3J4NwE8kWEzC_nqVCsOlUIse8iVYi8qcz-5LeJrPGT&sig=Cg0ArKJSzCHAoTDbvEi4EAE&uach_m=%5BUACH%5D&adurl= Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control private timing-allow-origin * accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 cross-origin-resource-policy cross-origin x-content-type-options nosniff access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	200	12209591959233352387 tpc.googlesyndication.com/simgad/ Frame B1F1	46 KB 0	35ms 30ms	Image image/png	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/12209591959233352387 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c538b86208051b6539e5e04493e584435e1f4986220edd809d1bcc9130458db7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers age 360891 report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} x-content-type-options nosniff expires Sat, 20 Sep 2025 22:00:10 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 allow-fenced-frame-automatic-beacons true date Fri, 20 Sep 2024 22:00:10 GMT last-modified Mon, 16 Sep 2024 08:31:57 GMT content-type image/png cache-control public, max-age=31536000 timing-allow-origin * x-dns-prefetch-control off cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" content-length 47484 x-xss-protection 0 server sffe
GET H3	200	abg_lite_fy2021.js Show response pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/ Frame B1F1	23 KB 0	2ms 2ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/abg_lite_fy2021.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash ba5f8d3b5cd5d1a9d01d0f07c1bf82b4f422d963ab1a406e2deca0074cf5f32f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 1262224488297882673 age 44365 x-content-type-options nosniff expires Tue, 08 Oct 2024 13:55:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Tue, 24 Sep 2024 13:55:36 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=1209600 timing-allow-origin * cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 9310 x-xss-protection 0 server cafe
GET H3	200	window_focus_fy2021.js Show response pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/client/ Frame B1F1	3 KB 0	2ms 2ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20240923/r20110914/client/window_focus_fy2021.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash 66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 16544991220582087243 age 44365 x-content-type-options nosniff expires Tue, 08 Oct 2024 13:55:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Tue, 24 Sep 2024 13:55:36 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=1209600 timing-allow-origin * cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 1229 x-xss-protection 0 server cafe
GET H3	200	ufs_web_display.js Show response pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame B1F1	206 KB 0	3ms 3ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409190101/pubads_impl.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash dfb0db8531c5917d5f1151c65dfc80f61cede542e49a51a5d1d5de5a70d0944b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br etag 7801886641448685286 age 3165 x-content-type-options nosniff expires Wed, 25 Sep 2024 02:22:16 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Wed, 25 Sep 2024 01:22:16 GMT content-disposition attachment; filename="f.txt" content-type text/javascript; charset=ISO-8859-2 vary Accept-Encoding cache-control public, max-age=3600, stale-while-revalidate=3600 timing-allow-origin * cross-origin-resource-policy cross-origin content-length 65415 x-xss-protection 0 server cafe
GET DATA	200 OK	truncated / Frame 0D38	215 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 54a611c1de5cd55a42242952b09ee3692ec784d704316fd3ec8182fa075a1fb2 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame B1F1	217 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5262706a668c1f25070bd20796c33917a74b52804f87f2d8d03b975485e618be Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET H3	200	js Show response www.googletagmanager.com/gtag/	275 KB 94 KB	42ms 42ms	Script application/javascript	172.217.16.136 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-875375440 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.16.136 , United States, ASN15169 (GOOGLE, US), Reverse DNS zrh04s06-in-f136.1e100.net Software Google Tag Manager / Resource Hash affccd954088dd395040db1afc1a2eba12eff103e13ba8df5aa945970e2bf1cb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding br expires Wed, 25 Sep 2024 02:15:01 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 25 Sep 2024 02:15:01 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Wed, 25 Sep 2024 00:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin * content-length 96188 x-xss-protection 0 server Google Tag Manager
GET H2	200	otCenterRounded.json Show response cdn.cookielaw.org/scripttemplates/202405.2.0/assets/	9 KB 3 KB	33ms 32ms	Fetch application/json	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202405.2.0/assets/otCenterRounded.json Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b1bc0b181617d553a69d6c20ada9495d7a8efe04ca9f098c965ec0758ba7a114 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-md5 mPFWl2a3UR06DZ1cx/YBSQ== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCA5E42003D45E x-ms-lease-status unlocked cf-cache-status HIT age 29232 x-content-type-options nosniff date Wed, 25 Sep 2024 02:15:01 GMT content-type application/json last-modified Tue, 16 Jul 2024 22:10:38 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 2c3e2b46-a01e-0023-7317-d8fc41000000 cf-ray 8c878109df563a7a-FRA accept-ranges bytes access-control-allow-origin * content-length 2612 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	otPcCenter.json Show response cdn.cookielaw.org/scripttemplates/202405.2.0/assets/	62 KB 15 KB	36ms 36ms	Fetch application/json	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202405.2.0/assets/otPcCenter.json Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash efc69d4464af1d588f4acd82f8826658ae319ba867637e2a16e5b7855ebe702f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-md5 6ih9XJsNsdvzTBaxTC+2Fw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCA5E41FECBCD3 x-ms-lease-status unlocked cf-cache-status HIT age 36806 x-content-type-options nosniff date Wed, 25 Sep 2024 02:15:01 GMT content-type application/json last-modified Tue, 16 Jul 2024 22:10:38 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id be885ef5-d01e-00eb-4017-d86d76000000 cf-ray 8c878109df573a7a-FRA accept-ranges bytes access-control-allow-origin * content-length 14987 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	otCommonStyles.css Show response cdn.cookielaw.org/scripttemplates/202405.2.0/assets/	24 KB 4 KB	35ms 35ms	Fetch text/css	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202405.2.0/assets/otCommonStyles.css Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c52550189ad7a781a37919af639c2d6a786821aad8b982daa6a54af46817b8fa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-md5 9eusssrwoAzVOVsIadvhfQ== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 36806 content-encoding gzip x-content-type-options nosniff date Wed, 25 Sep 2024 02:15:01 GMT content-type text/css last-modified Tue, 16 Jul 2024 22:10:51 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id b673c812-901e-002b-0717-d8e732000000 cf-ray 8c878109df583a7a-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	utsync.ashx Show response ml314.com/	62 B 237 B	46ms 45ms	Script application/javascript	34.117.77.79 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=81370&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&pv=1727230501408_48zjr6wfr&bl=de-de&cb=6781306&return=&ht=&d=&dc=&si=1727230501408_48zjr6wfr&cid=&s=1600x1200&rp=&v=2.7.4.212 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 79.77.117.34.bc.googleusercontent.com Software Google Frontend / Resource Hash 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache via 1.1 google expires 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA" date Wed, 25 Sep 2024 02:15:01 GMT content-type application/javascript server Google Frontend
GET H/1.1	200 OK	ud.ashx Show response in.ml314.com/	20 B 482 B	544ms 180ms	Script application/javascript	54.196.132.66 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://in.ml314.com/ud.ashx?topiclimit=&cb=2582024&v=2.7.4.212 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.196.132.66 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-196-132-66.compute-1.amazonaws.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Cache-Control public X-AspNet-Version 4.0.30319 Content-Encoding gzip Connection keep-alive Expires Thu, 26 Sep 2024 02:15:01 GMT Content-Length 138 Date Wed, 25 Sep 2024 02:15:01 GMT Content-Type application/javascript; charset=utf-8 Vary Accept-Encoding Server Microsoft-IIS/10.0 X-Powered-By ASP.NET
GET H3	200	580638648955413 Show response connect.facebook.net/signals/config/	76 KB 15 KB	97ms 97ms	Script application/x-javascript	157.240.253.1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/580638648955413?v=2.9.167&r=stable&domain=www.infosecurity-magazine.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-fra5.fbcdn.net Software / Resource Hash 6beca62d5dd4204a41dc6ef89c6c4d5ccae70d28fccfae651eab38fe28f3f930 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 edge-control cache-maxage=10m date Wed, 25 Sep 2024 02:15:01 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" x-fb-connection-quality EXCELLENT; q=0.9, rtt=26, rtx=0, c=74, mss=1232, tbw=67170, tp=62, tpl=0, uplat=66, ullat=0 pragma public x-fb-debug Nn7IkxiC0yPOzIoJ4zYQhf0UMKf/FoPqedcFPvoJwGS09nAWUmukdQYD1Uw8kWul1ma95z7aWsFjUgBeWsoCDA== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?0
GET H2	200	adsct t.co/i/	43 B 626 B	285ms 218ms	Image image/gif	162.159.140.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=1&eci=1&event_id=60f6b6f9-3de8-42da-a5b9-c6648fb93dd0&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=47f367c4-c7dc-4465-9e3e-ff3c30266c43&tw_document_href=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o7tzd&type=javascript&version=2.3.30 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers strict-transport-security max-age=0 x-transaction-id e9c35d917d123087 cache-control no-cache, no-store, max-age=0 x-connection-hash de085596c294b8e8be9571a021374f3cd482efa76e73302497b91c6ad1bca1aa cf-cache-status DYNAMIC cf-ray 8c87810a8964972b-FRA x-response-time 180 content-length 43 date Wed, 25 Sep 2024 02:15:01 GMT content-type image/gif;charset=utf-8 perf 7402827104 server cloudflare tsa_o
GET H2	200	adsct analytics.twitter.com/i/	43 B 392 B	200ms 132ms	Image image/gif	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=1&eci=1&event_id=60f6b6f9-3de8-42da-a5b9-c6648fb93dd0&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=47f367c4-c7dc-4465-9e3e-ff3c30266c43&tw_document_href=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o7tzd&type=javascript&version=2.3.30 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers strict-transport-security max-age=631138519 x-transaction-id 5091af2d2e7723a8 cache-control no-cache, no-store, max-age=0 x-connection-hash 812468a0614866432ba4d85b273578ef11003d770e4ae04642be381ad32ab39d x-response-time 106 content-length 43 date Wed, 25 Sep 2024 02:15:00 GMT perf 7402827104 content-type image/gif;charset=utf-8 server tsa_o
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 925 B	310ms 231ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept * Content-Type text/plain;charset=UTF-8 Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-msedge-ref Ref A: 0CBC435F328040B9871AE707BD4CBFDD Ref B: FRAEDGE2005 Ref C: 2024-09-25T02:15:01Z x-li-fabric prod-lor1 access-control-allow-credentials true report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-uuid AAYi6DB+v2FFnysrW78Fig== x-li-proto http/2 access-control-allow-origin https://www.infosecurity-magazine.com x-cache CONFIG_NOCACHE date Wed, 25 Sep 2024 02:15:01 GMT vary Origin
GET H3	200	/ Show response www.googleadservices.com/pagead/conversion/875375440/	5 KB 3 KB	95ms 42ms	Script text/javascript	172.217.23.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion/875375440/?random=1727230501479&cv=11&fst=1727230501479&bg=ffffff&guid=ON&async=1&gtm=45be49n0v892578457z878347448za201zb78347448&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&label=a2QGCPW5tqwZENDWtKED&hn=www.googleadservices.com&frm=0&tiba=New%20Octo2%20Malware%20Variant%20Threatens%20Mobile%20Banking%20Security%20-%20Infosecurity%20Magazine&value=0&bttype=purchase&npa=1&pscdl=noapi&auid=1501389769.1727230501&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&rfmt=3&fmt=4 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.23.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s45-in-f2.1e100.net Software cafe / Resource Hash 9cbcd2d22bac5fb07a5daac48e632d9bd6f2fe2cb0be8a936915daa799c3d32f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, must-revalidate timing-allow-origin * content-encoding br pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 2603 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type text/javascript; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
POST H2	204	collect region1.analytics.google.com/g/	0 0	93ms 36ms	Fetch text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-8VSXE5KKGM&gtm=45je49n0v898772242z878347448za200zb78347448&_p=1727230500694&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=2101885786.1727230501&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1727230501&sct=1&seg=0&dl=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&dt=New%20Octo2%20Malware%20Variant%20Threatens%20Mobile%20Banking%20Security%20-%20Infosecurity%20Magazine&en=page_view&_fv=1&_ss=1&tfd=1369 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.infosecurity-magazine.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 255 B	101ms 34ms	Ping text/plain	2a00:1450:400c:c0c::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-8VSXE5KKGM&cid=2101885786.1727230501&gtm=45je49n0v898772242z878347448za200zb78347448&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-8VSXE5KKGM&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.infosecurity-magazine.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT content-type text/plain server Golfe2
GET H3	204	td www.googletagmanager.com/	0 15 B	32ms 29ms	Image text/plain	172.217.16.136 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.googletagmanager.com/td?id=G-8VSXE5KKGM&v=3&t=t&pid=1751795922&dl=www.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tdp=G-8VSXE5KKGM;98772242;1;6;0&frm=0&rtg=8347448&rlo=11&slo=4&hlo=10&lst=1&pcid=8347448&z=0 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.16.136 , United States, ASN15169 (GOOGLE, US), Reverse DNS zrh04s06-in-f136.1e100.net Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT content-type text/plain server Golfe2
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	101ms 60ms	Image image/gif	172.217.18.3 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-8VSXE5KKGM&cid=2101885786.1727230501&gtm=45je49n0v898772242z878347448za200zb78347448&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=0&tag_exp=0&z=649413375 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.18.3 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s28-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	view pagead2.googlesyndication.com/pcs/ Frame 7DB4	0 0	58ms 57ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsuFF3uGCcNb60iy8bgKeZTGpX7Jj4pqbvQ2bIDh45fzr7l6rmm6ecsd9aDO6SletOeQBCJM_Mkfc2DMeQRbDsNLRmmJMOLEf4q1rXRPHMCRci2D90im9xP2QGTJyC4jNXz3DaPDueI42Enx56w469wbV30NfLvgghjSkY2pMgh_LwnCaP0Ii2tYrcADkKgIA9UFSsF7PJHHzAu9iyIK93PLaG9QkTRPQZa4gmXBQCU0oGKelG1GTalmJ5Fg-IB1P5HyIJV79yM0cuS7QiXd_VLaAbe7uL91XucDU0hutRs4vNEmE4syTrlGXgxKQu3E7gs7HHuYzQricKG5zdSbN99Xc4eSsytH83hwokQaPEJfvWMhQoEySOi6S2FEmzaej9pww-5PRkYEL62J62s8KSs0phHpArjbEDor4RDK9xAHQtu7bsy6ZNaW80IBH7TLQJ-z1-4Xqa6sER2d79ZJrujcPTg&sig=Cg0ArKJSzK1s_NNl_ZLXEAE&uach_m=%5BUACH%5D&adurl= Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control private timing-allow-origin * accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 cross-origin-resource-policy cross-origin x-content-type-options nosniff access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 7DB4	0 0	57ms 56ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	view pagead2.googlesyndication.com/pcs/ Frame 0D38	0 0	57ms 56ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjss7fRywMxWSWnIuMagF-s1KAW7Zk_zj8vGrMpsYM__z9cbBTunnAc3IDovWd2rGwa7I2rAwb5eEoPhVMtOmM5nVPlxis8Ftb6IcaHbG47KA4BAaLjYwsd_Pzt28jBqZr4kuABHst8gfUqqXF1z4mcTsReU5wBCGPsn0b8JEztSerQ7fup3mKa1EVU7c1mnY2X7TBaWttC-r8QeHp1Pc32Cd_PBbLCpZyYialdUsD3zkTJEe2spZcKLeHPZiK-IGno8aCWktwYNr-d12MUef12A2Cf4H8AOPF7iyuKwgIRPMeUgnmW8yVjhKX-9PAY6d8Q3yuB755sVWm0L9UuHMvXxvH_rEm8brnSw4hBFh4o5_sYzhyxrEOfDSrvnjnbNyx-eR1iH4IeUru_HUW3y-mEEofTRpXHnDaU9cUM_Q-rYWmxUos8Ni4xvoifZy-5N1loRCN7tFIXcBINn5aqQ-QPLo_xg&sig=Cg0ArKJSzAKYVMfi7kzeEAE&uach_m=%5BUACH%5D&adurl= Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control private timing-allow-origin * accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 cross-origin-resource-policy cross-origin x-content-type-options nosniff access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 0D38	0 0	58ms 54ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 812 B	209ms 165ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=5460932&time=1727230501678&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tm=gtmv2 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept * Referer Response headers x-li-pop afd-prod-ltx1-x content-encoding gzip x-fs-uuid 000622e83081529fac58d46624c01d03 x-msedge-ref Ref A: AB2A83471EA644C8BC6AD49A7F5D7E22 Ref B: FRAEDGE1211 Ref C: 2024-09-25T02:15:01Z x-li-fabric prod-ltx1 x-restli-protocol-version 1.0.0 access-control-allow-methods GET, OPTIONS x-li-uuid AAYi6DCBUp+sWNRmJMAdAw== x-li-proto http/2 access-control-allow-origin * x-cache CONFIG_NOCACHE date Wed, 25 Sep 2024 02:15:01 GMT content-type application/json access-control-allow-headers *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5460932&time=1727230501678&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tm=gtmv2 https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5460932&time=1727230501678&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tm=gtmv2&e_ipv6=AQJ4rPXViKR...	0 264 B	199ms 122ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5460932&time=1727230501678&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tm=gtmv2&e_ipv6=AQJ4rPXViKRoiwAAAZIm9eNuogOmq3-Vp4vtrrZ6-ZQk2BITLyBR_UQ51CiyEmcn_sw4E7lPCc2k Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers linkedin-action 1 x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 838FCF60B2C246C1B34C011346638ED5 Ref B: FRAEDGE1419 Ref C: 2024-09-25T02:15:01Z x-li-fabric prod-lva1 x-li-uuid AAYi6DCDbunwpcA2iCHwUQ== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-lva1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5460932&time=1727230501678&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&tm=gtmv2&e_ipv6=AQJ4rPXViKRoiwAAAZIm9eNuogOmq3-Vp4vtrrZ6-ZQk2BITLyBR_UQ51CiyEmcn_sw4E7lPCc2k x-msedge-ref Ref A: 782973F90CF0428289576FB3ECE814C0 Ref B: FRAEDGE2005 Ref C: 2024-09-25T02:15:01Z x-li-fabric prod-lva1 x-li-uuid AAYi6DCATlHVdd7eTSgxOg== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT
GET H3	200	view pagead2.googlesyndication.com/pcs/ Frame B1F1	0 0	57ms 57ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssFhALdZ8BNJr2VGKK3PWfdPnTGrHGIF_3ydhGkSyGuUNITo2UK0FFa3VKi1xBPpFq5hMIQ6LD2QTMFAXsj-BbUuX4RP4RDj6IZdyWhw2z3cWFPBURQKSAL6PI_wNp73uGbvXnA3fjyMnseDKiOZVHMv6bVjqpDQjczXYVV7cq67dZ_ceL8GPJUdtLT0rVFdnOgpfZgZTmTOpVanwQpGH3llqea7H6O9KJu2T2Y9NvLdTi_ciOc8cBlSdKclKGblo80WkJcw6m7DX83342Ye0n74Qn4tWfM0AaynmAxu1GgdjoNjtTnPnCUMsKNovo-ykZA0V9mwxLiDGMQbqmQPYS9cbdb1B0sKbuvdsc8qksP9wpQk83knI_SRjJJK92Ef2lhxsWRjf-hD4UfmXxyC8hRYyw2J-ei1RYFSDtpgCAJKMaqOTXJV5GQ6iGBUvYxs3KRonpEMnakVjX2yCKn2ghHjSo&sig=Cg0ArKJSzLP3sJzB1TImEAE&uach_m=%5BUACH%5D&adurl= Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control private timing-allow-origin * accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 cross-origin-resource-policy cross-origin x-content-type-options nosniff access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame B1F1	0 0	68ms 51ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	/ www.google.de/pagead/1p-conversion/875375440/ Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/875375440/?random=173815234&cv=11&fst=1727230501479&bg=ffffff&guid=ON&async=1&gtm=45be49n0v892578457z878347448za201zb78347448&gcd=13... https://www.google.com/pagead/1p-conversion/875375440/?random=173815234&cv=11&fst=1727230501479&bg=ffffff&guid=ON&async=1&gtm=45be49n0v892578457z878347448za201zb78347448&gcd=13l3l3l2l1l1&dma_cps=sy... https://www.google.de/pagead/1p-conversion/875375440/?random=173815234&cv=11&fst=1727230501479&bg=ffffff&guid=ON&async=1&gtm=45be49n0v892578457z878347448za201zb78347448&gcd=13l3l3l2l1l1&dma_cps=syp...	42 B 64 B	43ms 42ms	Image image/gif	172.217.18.3 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-conversion/875375440/?random=173815234&cv=11&fst=1727230501479&bg=ffffff&guid=ON&async=1&gtm=45be49n0v892578457z878347448za201zb78347448&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&label=a2QGCPW5tqwZENDWtKED&hn=www.googleadservices.com&frm=0&tiba=New%20Octo2%20Malware%20Variant%20Threatens%20Mobile%20Banking%20Security%20-%20Infosecurity%20Magazine&value=0&npa=1&pscdl=noapi&auid=1501389769.1727230501&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjDybECSixub3QtbmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMInJL2g4PdiAMVK4qDBx0C0CNsMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggS&is_vtc=1&cid=CAQSGwDpaXnfXuu1a3FQH4MM5X9EakGHm3X2IaKmIg&eitems=ChAI8MbJtwYQnov6zenRwpVmEh0ApmzywsYNxK6eP8LYKwucjy-Zb7cwI2HQNE5Q3g&random=3123957365&ipr=y Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Server 172.217.18.3 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s28-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Wed, 25 Sep 2024 02:15:02 GMT x-xss-protection 0 content-type image/gif server cafe Redirect headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * location https://www.google.de/pagead/1p-conversion/875375440/?random=173815234&cv=11&fst=1727230501479&bg=ffffff&guid=ON&async=1&gtm=45be49n0v892578457z878347448za201zb78347448&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&label=a2QGCPW5tqwZENDWtKED&hn=www.googleadservices.com&frm=0&tiba=New%20Octo2%20Malware%20Variant%20Threatens%20Mobile%20Banking%20Security%20-%20Infosecurity%20Magazine&value=0&npa=1&pscdl=noapi&auid=1501389769.1727230501&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjDybECSixub3QtbmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMInJL2g4PdiAMVK4qDBx0C0CNsMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggS&is_vtc=1&cid=CAQSGwDpaXnfXuu1a3FQH4MM5X9EakGHm3X2IaKmIg&eitems=ChAI8MbJtwYQnov6zenRwpVmEh0ApmzywsYNxK6eP8LYKwucjy-Zb7cwI2HQNE5Q3g&random=3123957365&ipr=y pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Wed, 25 Sep 2024 02:15:01 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	200	/ www.facebook.com/tr/	0 274 B	80ms 21ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=580638648955413&ev=PageView&dl=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&rl=&if=false&ts=1727230501841&sw=1600&sh=1200&v=2.9.167&r=stable&a=tmgoogletagmanager&ec=0&o=12318&fbp=fb.1.1727230501838.422194693109354749&cs_est=true&ler=empty&cdl=API_unavailable&it=1727230501435&coo=false&rqm=GET Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers strict-transport-security max-age=31536000; includeSubDomains x-fb-connection-quality EXCELLENT; q=0.9, rtt=18, rtx=0, c=10, mss=1297, tbw=2840, tp=-1, tpl=-1, uplat=0, ullat=0 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin alt-svc h3=":443"; ma=86400 content-length 0 date Wed, 25 Sep 2024 02:15:01 GMT content-type text/plain server proxygen-bolt
GET H2	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 3 KB	210ms 151ms	Image image/png	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=580638648955413&ev=PageView&dl=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Focto2-malware-threatens-mobile%2F&rl=&if=false&ts=1727230501841&sw=1600&sh=1200&v=2.9.167&r=stable&a=tmgoogletagmanager&ec=0&o=12318&fbp=fb.1.1727230501838.422194693109354749&cs_est=true&ler=empty&cdl=API_unavailable&it=1727230501435&coo=false&rqm=FGET Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding zstd report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7418398516380630617"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Wed, 25 Sep 2024 02:15:02 GMT content-type image/png vary Accept-Encoding x-fb-debug Felf4Kx2atJkkz5aFJLWAiiVZKY8hbLPkeQYhsPxuA1wV+4GPMWpAx5KNdZ27J7XBFYxftm94gXcwk6wfgoQ8g== x-frame-options DENY strict-transport-security max-age=15552000; preload reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7418398516380630617", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; cache-control private, no-store, no-cache, must-revalidate x-fb-connection-quality EXCELLENT; q=0.9, rtt=18, rtx=0, c=14, mss=1297, tbw=3158, tp=-1, tpl=-1, uplat=129, ullat=0 cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" pragma no-cache cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?0
GET H2	200	nr-spa-1216.min.js Show response js-agent.newrelic.com/	49 KB 19 KB	81ms 23ms	Script application/javascript	2602:816:5001::39 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-spa-1216.min.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2602:816:5001::39 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 545156adeae44dadc82b98d504f805ebe77fb79c928ef34eed1057bb9d4cb8fe Security Headers Name Value Strict-Transport-Security max-age=300 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers strict-transport-security max-age=300 cache-control public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 content-encoding br etag "63e2df852d15ab21d7ff8fc4363222e8" cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 19141 date Wed, 25 Sep 2024 02:15:02 GMT last-modified Wed, 18 Oct 2023 21:31:16 GMT content-type application/javascript x-served-by cache-fra-eddf8230036-FRA x-cache-hits 22559 vary Accept-Encoding
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/	17 KB 13 KB	44ms 37ms	XHR application/json	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202409190101&st=env Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash 248f5b84616a5cd518462f376846c19dfdc336f747a3fdb09dcaba5bfc45ec0c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers timing-allow-origin * content-encoding br cross-origin-resource-policy cross-origin x-content-type-options nosniff access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 12984 date Wed, 25 Sep 2024 02:15:02 GMT x-xss-protection 0 content-type application/json; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	RX_Logo_-_primary_logo_for_everyday_use.png cdn.cookielaw.org/logos/c7f35e9f-bc78-43c8-9f0e-7cd83009704c/d5d2d0ac-164a-4501-8141-3a264a81333e/95f66c83-9442-43f5-9fb4-8a136c33442a/	51 KB 51 KB	36ms 35ms	Image mage/png	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/c7f35e9f-bc78-43c8-9f0e-7cd83009704c/d5d2d0ac-164a-4501-8141-3a264a81333e/95f66c83-9442-43f5-9fb4-8a136c33442a/RX_Logo_-_primary_logo_for_everyday_use.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 279b6c8b97bfb37476d6d075d1431d85a380ca36ebe6af4146844cfb135c21d6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-md5 yxwPB4FKahj/CgrZY2+Gbg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8D9559A5FD49D88 age 70662 cf-cache-status HIT x-content-type-options nosniff date Wed, 25 Sep 2024 02:15:02 GMT content-type mage/png last-modified Mon, 02 Aug 2021 09:46:17 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id f76b8227-701e-008b-4205-f42854000000 cf-ray 8c87810e3f013732-FRA accept-ranges bytes access-control-allow-origin * content-length 52319 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	powered_by_logo.svg cdn.cookielaw.org/logos/static/	5 KB 2 KB	34ms 33ms	Image image/svg+xml	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/powered_by_logo.svg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-md5 Y+c301RBZNK39PvKQWrIBw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 6894 content-encoding gzip x-content-type-options nosniff date Wed, 25 Sep 2024 02:15:02 GMT content-type image/svg+xml last-modified Tue, 24 Sep 2024 06:41:31 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 103bc9ec-301e-0026-47bd-0e083e000000 cf-ray 8c87810e3f033732-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
POST H3	204	ping pagead2.googlesyndication.com/pagead/	0 0	54ms 53ms	Fetch text/html	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/ping?e=1 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer Response headers
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 7 KB	36ms 33ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers content-encoding gzip etag "1637097310169751" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} x-content-type-options nosniff expires Wed, 25 Sep 2024 02:15:02 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 25 Sep 2024 02:15:02 GMT content-type text/javascript vary Accept-Encoding cache-control private, max-age=3000 cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" cross-origin-resource-policy cross-origin accept-ranges bytes content-length 6386 x-xss-protection 0 server sffe
GET H2	200	favicon.ico www.infosecurity-magazine.com/	15 KB 17 KB	28ms 27ms	Other image/x-icon	13.32.99.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.infosecurity-magazine.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-7.fra60.r.cloudfront.net Software RX / Resource Hash 298718a23e658b099c5c1f9aa683dd448e518e1f6c91c4832d4ccd8fba4a4cdf Security Headers Name Value Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Response headers etag "c9436846ac6d91:0" age 64338 x-content-type-options nosniff access-control-allow-methods * x-cache Hit from cloudfront x-ua-compatible IE=Edge x-amz-cf-id xzk1ZwX4W34nM5ovwwlVrBamsQKfvQqE545yDp0BoWQhRGcsMXuXMQ== date Tue, 24 Sep 2024 08:22:44 GMT content-type image/x-icon feature-policy accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none' last-modified Thu, 03 Aug 2023 12:59:01 GMT access-control-allow-headers Content-Type x-frame-options SAMEORIGIN content-security-policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content referrer-policy same-origin via 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=() accept-ranges bytes content-length 15406 x-xss-protection 1; mode=block x-amz-cf-pop FRA60-P3 server RX
GET H/1.1	200	NRJS-70b3f9b2c6f17cc4471 Show response bam.eu01.nr-data.net/1/	79 B 634 B	125ms 47ms	Script text/javascript	185.221.87.23 FASTLY
General Check archive.org Show headers Download Go to Full URL https://bam.eu01.nr-data.net/1/NRJS-70b3f9b2c6f17cc4471?a=241052313&v=1216.487a282&to=MhBSZQoZXxEDUkdRWQtacWIoV0UHD0FfWUIABh9GHRpBAwVUHVlFFQ0%3D&rst=2007&ck=1&ref=https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/&ap=8&be=128&fe=1900&dc=594&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1727230500156,%22n%22:0,%22f%22:1,%22dn%22:3,%22dne%22:15,%22c%22:15,%22s%22:36,%22ce%22:61,%22rq%22:61,%22rp%22:89,%22rpe%22:94,%22dl%22:96,%22di%22:594,%22ds%22:594,%22de%22:595,%22dc%22:1901,%22l%22:1901,%22le%22:1950%7D,%22navigation%22:%7B%7D%7D&fp=631&fcp=631&jsonp=NREUM.setToken Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.221.87.23 , Ireland, ASN54113 (FASTLY, US), Reverse DNS Software istio-envoy / Resource Hash b39746c07da532b57661a77d04dc53159691290bc22dbc1a413b1443909c07b6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers access-control-expose-headers Date timing-allow-origin * x-envoy-upstream-service-time 3 Connection keep-alive access-control-allow-credentials true access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS cross-origin-resource-policy cross-origin access-control-allow-origin * Content-Length 79 date Wed, 25 Sep 2024 02:15:02 GMT content-type text/javascript x-served-by cache-fra-eddf8230131-FRA server istio-envoy
GET H2	200	runner.html tpc.googlesyndication.com/sodar/sodar2/225/ Frame 53F5	0 0	67ms 19ms	Document text/html	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 64948 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding gzip content-length 5046 content-type text/html cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" cross-origin-resource-policy cross-origin date Tue, 24 Sep 2024 08:12:34 GMT expires Wed, 24 Sep 2025 08:12:34 GMT last-modified Mon, 21 Jun 2021 20:47:05 GMT report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} server sffe vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
POST H/1.1	200	NRJS-70b3f9b2c6f17cc4471 Show response bam.eu01.nr-data.net/resources/1/	36 B 369 B	42ms 41ms	XHR text/plain	185.221.87.23 FASTLY
General Check archive.org Show headers Download Go to Full URL https://bam.eu01.nr-data.net/resources/1/NRJS-70b3f9b2c6f17cc4471?a=241052313&v=1216.487a282&to=MhBSZQoZXxEDUkdRWQtacWIoV0UHD0FfWUIABh9GHRpBAwVUHVlFFQ0%3D&rst=2140&ck=1&ref=https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/&st=1727230500156 Requested by Host: www.infosecurity-magazine.com URL: https://www.infosecurity-magazine.com/news/octo2-malware-threatens-mobile/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.221.87.23 , Ireland, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash f81cd7aedfd540c1df4ad818dcb57aeca08c70ff73fd6c44572e019b6e053639 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 content-type text/plain Referer Response headers Connection keep-alive access-control-allow-credentials true access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS access-control-allow-origin https://www.infosecurity-magazine.com Content-Length 36 date Wed, 25 Sep 2024 02:15:02 GMT content-type text/plain x-served-by cache-fra-eddf8230131-FRA
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame 7DB4	42 B 65 B	58ms 57ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv3jSPtwEtwQ9kM9SLpi2XMThmEf0Kuvn_orkVCT57gpoLfFkGJCb0y4sCkBDPrKijurdCgNih2nB_fr3eHQq42KreIMHffeYLkH4kv6P7IPw3AXEV6M1f6O71d0-eILyfHEFFxp1su1N4kOrfYJnasNp-N2SQxr_-bOKwnXEtP9m25mrPjKORGFuj6WYbAUva9yvStOeo&sig=Cg0ArKJSzMPAhz_whRgZEAE&id=lidar2&mcvt=1000&p=809,1046,1059,1346&tm=1019.5&tu=19.300000190734863&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240923&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=263018736&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=2316330100&rst=1727230501100&rpt=503&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Wed, 25 Sep 2024 02:15:02 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame B1F1	42 B 65 B	61ms 60ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvuQApVgZS8PpTohkG8FXzsDgZ5F1c2KSZ1W5SVqi1Dg8jnB0_y_zTCl-1tq0bMFDVpQIsp0SfKUUh70vNIaMgT-VQr6LGf2H-G7f7YXOp6PNm1lmTZfXSG5x8TpWDRSUYknhbrI7OZ2jEC81V6MwpGjxP3tFeY0S4KdHDmTpaOd37KLLHmH4Nfsuq7ZF70Qwx-GhLU7Qk&sig=Cg0ArKJSzBv2tJW2qgjWEAE&id=lidar2&mcvt=1000&p=1102,436,1192,1164&tm=1017.0999999046326&tu=17.40000009536743&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240923&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3770769768&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=2316330100&rst=1727230501249&rpt=452&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Wed, 25 Sep 2024 02:15:02 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame 0D38	42 B 65 B	58ms 58ms	Fetch image/gif	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssVLw-M6Zx6zFWi_6JRmNj7rkP0IJQMwHtGafkxMP6bI6s4td7XL5f-jkGL71ddZ76znPE362mWwEyD-dlWMxDSAeHP8r9OBkcNGKml49AfZS4fkEOCwgApXDp4Vgtp74EMhSt6wUXDffXRIrSSLkVsPPwN3DsgDR1VOx5qtLiU4pE7NGv6TwckbM2dBaFXvHmS8uhxdQo&sig=Cg0ArKJSzFo1FQkcoEdvEAE&id=lidar2&mcvt=1003&p=8,436,98,1164&tm=1066.7000002861023&tu=63.30000019073486&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20240923&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=420187029&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=2316330100&rst=1727230501213&rpt=443&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers cache-control no-cache, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Wed, 25 Sep 2024 02:15:02 GMT x-xss-protection 0 content-type image/gif server cafe
GET		sodar pagead2.googlesyndication.com/pagead/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

pagead2.googlesyndication.com

URL

https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202409190101&jk=775757514152870&bg=!ExClEF_NAAbWYrMm9mI7ADQBe5WfOI6IjyUnU246iOBS6BWojD5z48dLrvqNmH0abNkbIXBNyfsQvL2HAoF9-2x59OatAgAAAM1SAAAACWgBB34ANuU9OkbhpNXDnrJoVzkDQKijGJKPrA1WHEvj_9Kd5LPdRSjOL0QL1OcVyNevedhM5cicgvY5WJkCqV5pjn5J3I_SAm6HtsxL2KQYlNMLiLdgH5kVSyZiFY8wV6QcKJMb_dQVzuAiZ3hErW7ExkvvyA6wKhdYOljxUhTMpGFwrs55CQjmm5fbyMh3_sqID4_DhQbBwxk4zT7-y4yQqeaQMUlrk-YA8v2BFV-JPfvOweaKdcukCuwtc6n0JwuSqBl_z832_FLCmxgnh2cT_5EAx40owcd1bcqmj9fpJy8e-GaHu6nVxt5DTTCXiQw1adFJdMEI3UGMLcMNcajGfop_ghQksyy3Ep0SmkUK-zKyuznaZnHKZ0RD8nT7aqscPX_cEMnDNNdjBlcAOINpO2zeK2QPcDniRW5VxYnfEVDwDJIuhsL98r3n0oREGPLqJBKco0JZY66R4qY9lsIZ1PCzK2A-HWjvvaQ2qM5bDEP3mjYULaktRCG4E1hvswz4yji_F5SNyUSXmqbUHB5Dxu2252rfRJHewP3BuRD16UqTHeWE8cZD68Vd4o6jPwVWUJyoA6g5Rg8x3JBLRXbRlxyt5uJBE0imaWurBm37WymS2CCrhhTBeglSgKhd2twhvUjFpqFynNnJKDSAwvkiq2osV6Wm13ht2rAsFoNb5j2x7MHRfUzzoNfz4KIi3tnbXamqyD9AmH5SmIHiXMmt2EiK2jk6GMU_i0dQDrN6j5Hhf9rhG8kC3h697K1UYEXqGHU8sMkuMNGgkQMdPqDwZCjbH5fB460XPK9y7uvya_jdXIvTnwA_8Zz8fwJL6DZYsSR7ijeYaBcWwvIkftAYTOUuv_t01nMzxCJvF5brzRSYI5sTyVTvHATf6Or6a8X0r63rGCYc5ZMJz89nA2wwH7eIxotiU4jAt-5HAGfVIAiqxgsXrbves7eoGc21Pp30yEH1jijQN_YbhtmK-tc4rENFX0nfbw