www.ghacks.net Open in urlscan Pro
2606:4700:20::681a:fa Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.baesystems.zip/
Effective URL:
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Submission: On June 23 via api (June 23rd 2023, 2:36:20 am UTC) from US — Scanned from US

Summary HTTP 188 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 54 IPs in 7 countries across 66 domains to perform 188 HTTP transactions. The main IP is 2606:4700:20::681a:fa, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.ghacks.net. The Cisco Umbrella rank of the primary domain is 248840.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 25th 2023. Valid for: a year.

This is the only time www.ghacks.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2607:f8b0:400... 2607:f8b0:4006:821::2013	15169 (GOOGLE) (GOOGLE)
1 32	2606:4700:20:... 2606:4700:20::681a:fa	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:81f::200a	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:820::2003	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42::282 2a04:4e42::282	54113 (FASTLY) (FASTLY)
3	2607:f8b0:400... 2607:f8b0:4006:824::2002	15169 (GOOGLE) (GOOGLE)
5	151.101.65.91 151.101.65.91	54113 (FASTLY) (FASTLY)
10	139.45.240.92 139.45.240.92	57304 (RUBY-AS) (RUBY-AS)
3	2600:9000:251... 2600:9000:2510:c600:5:b7cc:d3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3033::ac43:9fa2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2607:f8b0:400... 2607:f8b0:4006:821::2008	15169 (GOOGLE) (GOOGLE)
1	13.225.224.171 13.225.224.171	16509 (AMAZON-02) (AMAZON-02)
3	108.138.107.138 108.138.107.138	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:20:... 2606:4700:20::ac43:4686	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2607:f8b0:400... 2607:f8b0:4006:80f::200e	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80f::200a	15169 (GOOGLE) (GOOGLE)
3	130.211.23.194 130.211.23.194	15169 (GOOGLE) (GOOGLE)
2	2606:4700:20:... 2606:4700:20::681a:346	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.251.35.166 142.251.35.166	15169 (GOOGLE) (GOOGLE)
2	2600:9000:251... 2600:9000:2512:a200:d:2044:5c40:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700:10:... 2606:4700:10::ac43:266a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	108.138.126.121 108.138.126.121	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:c08::9d	15169 (GOOGLE) (GOOGLE)
2 16	52.46.155.104 52.46.155.104	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:81c::2004	15169 (GOOGLE) (GOOGLE)
4 4	199.127.204.171 199.127.204.171	26120 (RHYTHMONE) (RHYTHMONE)
2 2	2620:112:f002... 2620:112:f002:bbbb::21	6336 (TURN-US-ASN) (TURN-US-ASN)
1	3.225.218.40 3.225.218.40	14618 (AMAZON-AES) (AMAZON-AES)
2 11	192.40.39.223 192.40.39.223	27381 (CASALE-MEDIA) (CASALE-MEDIA)
3	72.247.71.192 72.247.71.192	16625 (AKAMAI-AS) (AKAMAI-AS)
1 5	104.127.172.242 104.127.172.242	16625 (AKAMAI-AS) (AKAMAI-AS)
2 6	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	23.105.12.143 23.105.12.143	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
2 3	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
2 2	68.67.160.186 68.67.160.186	29990 (ASN-APPNEX) (ASN-APPNEX)
1 19	3.213.224.199 3.213.224.199	14618 (AMAZON-AES) (AMAZON-AES)
5 5	35.211.178.172 35.211.178.172	19527 (GOOGLE-2) (GOOGLE-2)
2 2	44.208.128.231 44.208.128.231	14618 (AMAZON-AES) (AMAZON-AES)
3 4	70.42.32.223 70.42.32.223	13789 (INTERNAP-...) (INTERNAP-BLK3)
1 1	2600:9000:220... 2600:9000:2209:7800:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	54.235.195.83 54.235.195.83	14618 (AMAZON-AES) (AMAZON-AES)
2 4	2600:1f18:4e9... 2600:1f18:4e9:5a07:6454:8b0d:b7ff:750	14618 (AMAZON-AES) (AMAZON-AES)
2 2	54.172.162.57 54.172.162.57	14618 (AMAZON-AES) (AMAZON-AES)
2 2	2603:c020:400... 2603:c020:400d:3000:7130:bb0b:d7e:bee2	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
1 2	38.91.45.7 38.91.45.7	398989 (DEEPINTENT) (DEEPINTENT)
2 2	70.42.32.95 70.42.32.95	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1 1	23.197.21.62 23.197.21.62	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	44.205.102.24 44.205.102.24	14618 (AMAZON-AES) (AMAZON-AES)
2 2	198.148.27.139 198.148.27.139	19189 (PULSEPOINT) (PULSEPOINT)
2	104.36.115.113 104.36.115.113	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	216.200.232.253 216.200.232.253	30419 (MEDIAMATH...) (MEDIAMATH-INC)
13 17	142.251.41.2 142.251.41.2	15169 (GOOGLE) (GOOGLE)
9 9	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
3 5	151.101.2.49 151.101.2.49	54113 (FASTLY) (FASTLY)
1 1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	107.20.114.132 107.20.114.132	14618 (AMAZON-AES) (AMAZON-AES)
1 1	35.214.199.183 35.214.199.183	15169 (GOOGLE) (GOOGLE)
1	174.137.133.32 174.137.133.32	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
1 1	202.241.208.56 202.241.208.56	4694 (IDCF IDC ...) (IDCF IDC Frontier Inc.)
1 1	80.77.87.162 80.77.87.162	46636 (NATCOWEB) (NATCOWEB)
2 2	185.184.8.90 185.184.8.90	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
8 12	8.43.72.98 8.43.72.98	26667 (RUBICONPR...) (RUBICONPROJECT)
2 3	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	54.236.237.143 54.236.237.143	14618 (AMAZON-AES) (AMAZON-AES)
6	8.28.7.83 8.28.7.83	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	34.133.71.175 34.133.71.175	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
6	162.248.18.37 162.248.18.37	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	54.239.33.158 54.239.33.158	16509 (AMAZON-02) (AMAZON-02)
3	8.28.7.84 8.28.7.84	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	199.38.167.130 199.38.167.130	54312 (ROCKETFUEL) (ROCKETFUEL)
6 6	44.193.243.239 44.193.243.239	14618 (AMAZON-AES) (AMAZON-AES)
1 1	23.105.12.151 23.105.12.151	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
1	54.236.122.247 54.236.122.247	14618 (AMAZON-AES) (AMAZON-AES)
1	52.54.245.27 52.54.245.27	14618 (AMAZON-AES) (AMAZON-AES)
1	52.212.37.98 52.212.37.98	16509 (AMAZON-02) (AMAZON-02)
1 1	34.200.65.202 34.200.65.202	14618 (AMAZON-AES) (AMAZON-AES)
2 2	2606:ae80:145... 2606:ae80:1451:14::1050	25751 (VALUECLICK) (VALUECLICK)
2 2	52.6.34.133 52.6.34.133	14618 (AMAZON-AES) (AMAZON-AES)
3	116.202.150.116 116.202.150.116	24940 (HETZNER-AS) (HETZNER-AS)
1	2606:4700:303... 2606:4700:3033::6815:325a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
188	54

1 2607:f8b0:4006:821::2013 (Flushing, United States) 1 redirects

ASN15169 (GOOGLE, US)

www.baesystems.zip	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 2606:4700:20::681a:fa (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.ghacks.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81f::200a (Flushing, United States)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:820::2003 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::282 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:824::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.65.91 (United States)

ASN54113 (FASTLY, US)

spn-v1.revampcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 139.45.240.92 (Russian Federation)

ASN57304 (RUBY-AS, RU)

notix.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2510:c600:5:b7cc:d3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

sdk.privacy-center.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::ac43:9fa2 (United States)

ASN13335 (CLOUDFLARENET, US)

sdk.mrf.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:821::2008 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.224.171 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-224-171.jfk51.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 108.138.107.138 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-107-138.jfk50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:4686 (United States)

ASN13335 (CLOUDFLARENET, US)

btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4006:80f::200e (Flushing, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80f::200a (Flushing, United States)

ASN15169 (GOOGLE, US)

readaloud.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 130.211.23.194 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 194.23.211.130.bc.googleusercontent.com

api.btloader.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:346 (United States)

ASN13335 (CLOUDFLARENET, US)

ad-delivery.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.35.166 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2512:a200:d:2044:5c40:93a1 (United States)

ASN16509 (AMAZON-02, US)

api.privacy-center.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:266a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 108.138.126.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-126-121.jfk50.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c08::9d (Ashburn, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 52.46.155.104 (Ashburn, United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::2004 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 199.127.204.171 (United States) 4 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:112:f002:bbbb::21 (United States) 2 redirects

ASN6336 (TURN-US-ASN, US)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.225.218.40 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-218-40.compute-1.amazonaws.com

rtb.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 192.40.39.223 (Canada) 2 redirects

ASN27381 (CASALE-MEDIA, CA)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 72.247.71.192 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-71-192.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.127.172.242 (Piscataway, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-127-172-242.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.98.64.218 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.105.12.143 (Manassas, United States) 2 redirects

ASN30633 (LEASEWEB-USA-WDC, US)

ssbsync-us.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.71.139.29 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.186 (New York, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 3.213.224.199 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-224-199.compute-1.amazonaws.com

usersync.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.211.178.172 (North Charleston, United States) 5 redirects

ASN19527 (GOOGLE-2, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.208.128.231 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-208-128-231.compute-1.amazonaws.com

ads.creative-serving.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 70.42.32.223 (United States) 3 redirects

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2209:7800:1b:5138:8a40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.235.195.83 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-235-195-83.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:1f18:4e9:5a07:6454:8b0d:b7ff:750 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.172.162.57 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-172-162-57.compute-1.amazonaws.com

sync.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2603:c020:400d:3000:7130:bb0b:d7e:bee2 (Ashburn, United States) 2 redirects

ASN31898 (ORACLE-BMC-31898, US)

sync.technoratimedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 38.91.45.7 (United States) 1 redirects

ASN398989 (DEEPINTENT, US)

match.deepintent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 70.42.32.95 (United States) 2 redirects

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.197.21.62 (Piscataway, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-197-21-62.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.205.102.24 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-205-102-24.compute-1.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.148.27.139 (New York, United States) 2 redirects

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.36.115.113 (United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.200.232.253 (Frederick, United States) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 142.251.41.2 (United States) 13 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s40-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 15.197.193.217 (Seattle, United States) 9 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.2.49 (United States) 3 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.20.114.132 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-20-114-132.compute-1.amazonaws.com

beacon.lynx.cognitivlabs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.214.199.183 (Groningen, Netherlands) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 183.199.214.35.bc.googleusercontent.com

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 174.137.133.32 (United States)

ASN27257 (WEBAIR-INTERNET, US)

sync.adkernel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 202.241.208.56 (Japan) 1 redirects

ASN4694 (IDCF IDC Frontier Inc., JP)

tg.socdm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.77.87.162 (Clifton, United States) 1 redirects

ASN46636 (NATCOWEB, US)

cs.admanmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.90 (Amsterdam, Netherlands) 2 redirects

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net

creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 8.43.72.98 (United States) 8 redirects

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.111.113.62 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.236.237.143 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-236-237-143.compute-1.amazonaws.com

thrtle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.133.71.175 (Council Bluffs, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 175.71.133.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 162.248.18.37 (United States)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.239.33.158 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 8.28.7.84 (United States)

ASN62713 (AS-PUBMATIC, US)

simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.38.167.130 (United States) 1 redirects

ASN54312 (ROCKETFUEL, US)

p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 44.193.243.239 (Ashburn, United States) 6 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-193-243-239.compute-1.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.105.12.151 (Manassas, United States) 1 redirects

ASN30633 (LEASEWEB-USA-WDC, US)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.236.122.247 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-236-122-247.compute-1.amazonaws.com

crb.kargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.54.245.27 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-245-27.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.37.98 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-37-98.eu-west-1.compute.amazonaws.com

synchroscript.deliveryengine.adswizz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.200.65.202 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-65-202.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:ae80:1451:14::1050 (United States) 2 redirects

ASN25751 (VALUECLICK, US)

pubmatic-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.6.34.133 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-34-133.compute-1.amazonaws.com

ads.avct.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 116.202.150.116 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: haproxy01.cl03.het.mrf.io

events.newsroom.bi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6815:325a (United States)

ASN13335 (CLOUDFLARENET, US)

flowcards.mrf.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	ghacks.net 1 redirects www.ghacks.net — Cisco Umbrella Rank: 248840	280 KB
23	amazon-adsystem.com 2 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 357 aax.amazon-adsystem.com — Cisco Umbrella Rank: 444 s.amazon-adsystem.com — Cisco Umbrella Rank: 337 aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1032	76 KB
22	doubleclick.net 13 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 219 ad.doubleclick.net — Cisco Umbrella Rank: 184 stats.g.doubleclick.net — Cisco Umbrella Rank: 124 cm.g.doubleclick.net — Cisco Umbrella Rank: 244	156 KB
20	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 547 image6.pubmatic.com — Cisco Umbrella Rank: 822 image2.pubmatic.com — Cisco Umbrella Rank: 1020 simage2.pubmatic.com — Cisco Umbrella Rank: 761 simage4.pubmatic.com — Cisco Umbrella Rank: 1351 image4.pubmatic.com — Cisco Umbrella Rank: 1216	36 KB
20	gumgum.com 1 redirects rtb.gumgum.com — Cisco Umbrella Rank: 1673 usersync.gumgum.com — Cisco Umbrella Rank: 2018	6 KB
17	rubiconproject.com 9 redirects eus.rubiconproject.com — Cisco Umbrella Rank: 639 secure-assets.rubiconproject.com — Cisco Umbrella Rank: 1134 token.rubiconproject.com — Cisco Umbrella Rank: 656 pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 1178 pixel.rubiconproject.com — Cisco Umbrella Rank: 381	29 KB
11	casalemedia.com 2 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 486 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 621	9 KB
10	notix.io notix.io — Cisco Umbrella Rank: 11863	27 KB
9	adsrvr.org 9 redirects match.adsrvr.org — Cisco Umbrella Rank: 375	5 KB
7	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 60	21 KB
6	bidr.io 6 redirects match.prod.bidr.io — Cisco Umbrella Rank: 602	3 KB
6	openx.net 2 redirects u.openx.net — Cisco Umbrella Rank: 740 us-u.openx.net — Cisco Umbrella Rank: 492	2 KB
5	everesttech.net 3 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 778	1 KB
5	yahoo.com 3 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 468 ups.analytics.yahoo.com — Cisco Umbrella Rank: 340	3 KB
5	bidswitch.net 5 redirects x.bidswitch.net — Cisco Umbrella Rank: 361	3 KB
5	privacy-center.org sdk.privacy-center.org — Cisco Umbrella Rank: 6076 api.privacy-center.org — Cisco Umbrella Rank: 8934	140 KB
5	revampcdn.com spn-v1.revampcdn.com — Cisco Umbrella Rank: 209679	119 KB
4	outbrain.com 3 redirects sync.outbrain.com — Cisco Umbrella Rank: 763	1 KB
4	btloader.com btloader.com — Cisco Umbrella Rank: 1086 api.btloader.com — Cisco Umbrella Rank: 1196	7 KB
3	newsroom.bi events.newsroom.bi — Cisco Umbrella Rank: 9518	1 KB
3	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 513	1 KB
3	3lift.com 2 redirects eb2.3lift.com — Cisco Umbrella Rank: 421	1 KB
3	smartadserver.com 3 redirects ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 8210 ssbsync.smartadserver.com — Cisco Umbrella Rank: 867 rtb-csync.smartadserver.com — Cisco Umbrella Rank: 615	920 B
3	1rx.io 3 redirects sync.1rx.io — Cisco Umbrella Rank: 618	2 KB
3	googleapis.com imasdk.googleapis.com — Cisco Umbrella Rank: 495 readaloud.googleapis.com — Cisco Umbrella Rank: 5630	124 KB
2	avct.cloud 2 redirects ads.avct.cloud — Cisco Umbrella Rank: 4619	1 KB
2	dotomi.com 2 redirects pubmatic-match.dotomi.com — Cisco Umbrella Rank: 4315	746 B
2	thrtle.com 1 redirects thrtle.com — Cisco Umbrella Rank: 1466	685 B
2	creativecdn.com 2 redirects creativecdn.com — Cisco Umbrella Rank: 498	701 B
2	mathtag.com 2 redirects sync.mathtag.com — Cisco Umbrella Rank: 566	1 KB
2	contextweb.com 2 redirects bh.contextweb.com — Cisco Umbrella Rank: 648	2 KB
2	360yield.com 2 redirects ad.360yield.com — Cisco Umbrella Rank: 662	647 B
2	zemanta.com 2 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 560	1 KB
2	deepintent.com 1 redirects match.deepintent.com — Cisco Umbrella Rank: 1163	594 B
2	technoratimedia.com 2 redirects sync.technoratimedia.com — Cisco Umbrella Rank: 1587	4 KB
2	ipredictive.com 2 redirects sync.ipredictive.com — Cisco Umbrella Rank: 1069	1019 B
2	creative-serving.com 2 redirects ads.creative-serving.com — Cisco Umbrella Rank: 4938	1 KB
2	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 476	2 KB
2	turn.com 2 redirects ad.turn.com — Cisco Umbrella Rank: 1039	952 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 101	257 B
2	ad-delivery.net ad-delivery.net — Cisco Umbrella Rank: 1167	1 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 82	98 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 176	115 KB
2	mrf.io sdk.mrf.io — Cisco Umbrella Rank: 11825 flowcards.mrf.io — Cisco Umbrella Rank: 24328	31 KB
1	adswizz.com synchroscript.deliveryengine.adswizz.com — Cisco Umbrella Rank: 3020	397 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1630	425 B
1	kargo.com crb.kargo.com — Cisco Umbrella Rank: 1801	504 B
1	rfihub.com 1 redirects p.rfihub.com — Cisco Umbrella Rank: 933	786 B
1	linkedin.com px.ads.linkedin.com — Cisco Umbrella Rank: 408	516 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 976	656 B
1	admanmedia.com 1 redirects cs.admanmedia.com — Cisco Umbrella Rank: 1103	660 B
1	socdm.com 1 redirects tg.socdm.com — Cisco Umbrella Rank: 1091	831 B
1	adkernel.com sync.adkernel.com — Cisco Umbrella Rank: 1375	192 B
1	loopme.me 1 redirects csync.loopme.me — Cisco Umbrella Rank: 1024	289 B
1	cognitivlabs.com 1 redirects beacon.lynx.cognitivlabs.com — Cisco Umbrella Rank: 1669	561 B
1	company-target.com 1 redirects s.company-target.com — Cisco Umbrella Rank: 2002	425 B
1	bluekai.com 1 redirects stags.bluekai.com — Cisco Umbrella Rank: 589	684 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 792	887 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 805	651 B
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1281	600 B
1	google.com www.google.com — Cisco Umbrella Rank: 3	408 B
1	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 839	25 KB
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 2021	45 KB
1	polyfill.io polyfill.io — Cisco Umbrella Rank: 1711	673 B
1	gstatic.com www.gstatic.com	159 KB
1	baesystems.zip 1 redirects www.baesystems.zip	183 B
188	66

	Domain	Requested by
32	www.ghacks.net	1 redirects www.ghacks.net
19	usersync.gumgum.com	1 redirects rtb.gumgum.com ads.pubmatic.com
17	cm.g.doubleclick.net	13 redirects u.openx.net rtb.gumgum.com
16	s.amazon-adsystem.com	2 redirects c.amazon-adsystem.com s.amazon-adsystem.com rtb.gumgum.com ssum-sec.casalemedia.com u.openx.net ads.pubmatic.com
10	notix.io	www.ghacks.net www.datadoghq-browser-agent.com notix.io
9	match.adsrvr.org	9 redirects
7	dsum-sec.casalemedia.com	1 redirects ssum-sec.casalemedia.com
7	www.google-analytics.com	www.googletagmanager.com www.datadoghq-browser-agent.com www.ghacks.net
6	match.prod.bidr.io	6 redirects
6	pixel.rubiconproject.com	3 redirects
6	simage2.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
6	image2.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
5	token.rubiconproject.com	4 redirects s.amazon-adsystem.com
5	sync-tm.everesttech.net	3 redirects rtb.gumgum.com ads.pubmatic.com
5	x.bidswitch.net	5 redirects
5	spn-v1.revampcdn.com	www.ghacks.net spn-v1.revampcdn.com
4	pr-bh.ybp.yahoo.com	2 redirects u.openx.net
4	us-u.openx.net	1 redirects u.openx.net
4	sync.outbrain.com	3 redirects rtb.gumgum.com
4	eus.rubiconproject.com	s.amazon-adsystem.com eus.rubiconproject.com rtb.gumgum.com
4	ssum-sec.casalemedia.com	1 redirects s.amazon-adsystem.com ssum-sec.casalemedia.com rtb.gumgum.com
3	events.newsroom.bi	www.datadoghq-browser-agent.com
3	pixel.tapad.com	2 redirects s.amazon-adsystem.com
3	eb2.3lift.com	2 redirects s.amazon-adsystem.com
3	ads.pubmatic.com	s.amazon-adsystem.com rtb.gumgum.com
3	sync.1rx.io	3 redirects
3	aax.amazon-adsystem.com	www.datadoghq-browser-agent.com
3	api.btloader.com	www.datadoghq-browser-agent.com
3	c.amazon-adsystem.com	spn-v1.revampcdn.com www.datadoghq-browser-agent.com
3	sdk.privacy-center.org	www.ghacks.net sdk.privacy-center.org
3	securepubads.g.doubleclick.net	www.ghacks.net securepubads.g.doubleclick.net
2	ads.avct.cloud	2 redirects
2	pubmatic-match.dotomi.com	2 redirects
2	simage4.pubmatic.com	ads.pubmatic.com
2	thrtle.com	1 redirects s.amazon-adsystem.com
2	creativecdn.com	2 redirects
2	sync.mathtag.com	2 redirects
2	image6.pubmatic.com	ads.pubmatic.com
2	bh.contextweb.com	2 redirects
2	ad.360yield.com	2 redirects
2	b1sync.zemanta.com	2 redirects
2	match.deepintent.com	1 redirects rtb.gumgum.com
2	sync.technoratimedia.com	2 redirects
2	sync.ipredictive.com	2 redirects
2	ads.creative-serving.com	2 redirects
2	secure.adnxs.com	2 redirects
2	u.openx.net	1 redirects s.amazon-adsystem.com
2	ad.turn.com	2 redirects
2	www.facebook.com	www.ghacks.net
2	api.privacy-center.org	www.datadoghq-browser-agent.com
2	ad-delivery.net	www.ghacks.net
2	readaloud.googleapis.com	www.gstatic.com
2	www.googletagmanager.com	www.ghacks.net www.googletagmanager.com
2	connect.facebook.net	www.ghacks.net connect.facebook.net
1	flowcards.mrf.io	www.datadoghq-browser-agent.com
1	image4.pubmatic.com
1	ups.analytics.yahoo.com	1 redirects
1	synchroscript.deliveryengine.adswizz.com
1	sync.bfmio.com
1	crb.kargo.com
1	rtb-csync.smartadserver.com	1 redirects
1	p.rfihub.com	1 redirects
1	aax-eu.amazon-adsystem.com
1	px.ads.linkedin.com
1	pixel-us-east.rubiconproject.com	1 redirects
1	um.simpli.fi	1 redirects
1	secure-assets.rubiconproject.com	1 redirects
1	cs.admanmedia.com	1 redirects
1	tg.socdm.com	1 redirects
1	sync.adkernel.com	rtb.gumgum.com
1	csync.loopme.me	1 redirects
1	beacon.lynx.cognitivlabs.com	1 redirects
1	s.company-target.com	1 redirects
1	ssbsync.smartadserver.com	1 redirects
1	stags.bluekai.com	1 redirects
1	sync.srv.stackadapt.com	1 redirects
1	s.ad.smaato.net	1 redirects
1	ssbsync-us.smartadserver.com	1 redirects
1	rtb.gumgum.com	s.amazon-adsystem.com
1	sync.targeting.unrulymedia.com	1 redirects
1	www.google.com	www.ghacks.net
1	stats.g.doubleclick.net	www.datadoghq-browser-agent.com
1	cdn.id5-sync.com	www.ghacks.net
1	ad.doubleclick.net	www.ghacks.net
1	btloader.com	spn-v1.revampcdn.com
1	www.datadoghq-browser-agent.com	spn-v1.revampcdn.com
1	sdk.mrf.io	www.ghacks.net
1	polyfill.io	www.ghacks.net
1	www.gstatic.com	www.ghacks.net
1	imasdk.googleapis.com	www.ghacks.net
1	www.baesystems.zip	1 redirects
188	91

This site contains links to these domains. Also see Links.

Domain
deals.ghacks.net
domains.google
isc.sans.edu
blog.google
www.facebook.com
twitter.com
martinbrinkmann.substack.com
webextension.org
hello.softonic.com
eepurl.com
en.softonic.com

Subject Issuer	Validity	Valid
ghacks.net Cloudflare Inc ECC CA-3	`2023-05-25` - `2024-05-23`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
polyfill.io GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-10` - `2024-01-11`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.revampcdn.com R3	`2023-06-02` - `2023-08-31`	3 months	crt.sh
notix.io R3	`2023-04-14` - `2023-07-13`	3 months	crt.sh
*.privacy-center.org Amazon RSA 2048 M02	`2023-03-25` - `2024-04-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-02-28` - `2024-02-27`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-04-01` - `2023-06-30`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-14` - `2024-01-16`	a year	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
api.btloader.com GTS CA 1D4	`2023-06-13` - `2023-09-11`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
api.privacy-center.org Amazon RSA 2048 M02	`2023-06-13` - `2024-07-11`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
s.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-03` - `2024-02-19`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
gumgum.com Amazon RSA 2048 M02	`2023-06-07` - `2024-07-06`	a year	crt.sh
casalemedia.com Go Daddy Secure Certificate Authority - G2	`2022-12-13` - `2024-01-13`	a year	crt.sh
*.pubmatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-25` - `2024-01-24`	a year	crt.sh
*.rubiconproject.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-03-07` - `2024-04-03`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.deepintent.com Go Daddy Secure Certificate Authority - G2	`2022-11-30` - `2024-01-01`	a year	crt.sh
*.ad-server.k8s.ggops.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-09`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-04-04` - `2023-09-27`	6 months	crt.sh
*.adkernel.com AlphaSSL CA - SHA256 - G4	`2023-01-03` - `2024-02-04`	a year	crt.sh
*.everesttech.net GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-11-07` - `2023-12-09`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2023-04-13` - `2024-05-11`	a year	crt.sh
aax-eu.amazon-adsystem.com Amazon RSA 2048 M01	`2023-06-21` - `2024-03-02`	8 months	crt.sh
*.app.kargo.com Amazon RSA 2048 M02	`2023-02-21` - `2024-01-18`	a year	crt.sh
*.bfmio.com Amazon RSA 2048 M02	`2023-03-17` - `2024-04-14`	a year	crt.sh
*.deliveryengine.adswizz.com Amazon RSA 2048 M02	`2023-02-09` - `2024-02-13`	a year	crt.sh
ssl03.cert.cl03.k8s.mrf.io R3	`2023-05-18` - `2023-08-16`	3 months	crt.sh

This page contains 30 frames:

Primary Page: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Frame ID: 534E2446B2509675E4E23DC15FCEDD07
Requests: 101 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t
Frame ID: 1B8A72ABF2FDD8BFF2324D08A49A6FF1
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 3B4AD3018024EEB6B2A3BCE056ADE455
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Frame ID: 0C77FD08737DC8CC268512D81B1892BF
Requests: 2 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Frame ID: 8D48EDB74774E8E3FE79ED73B3A2090D
Requests: 15 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Frame ID: 73DB09CD67DCD0AF92DCF7BBFE4E4606
Requests: 10 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Frame ID: 9CA806171ED1BF12930BE6A7809C47D4
Requests: 12 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: B787BFAB1A7E0FD083D67034BE07B21D
Requests: 12 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Frame ID: 26B1EDE07DC137F0DB2C7289EAE2C8F0
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=507124677645352015&gdpr=0&gdpr_consent=
Frame ID: 7380423443C06A1DEE3CD2E21BD5DAB2
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2240945551553324476182
Frame ID: 8D59B09FEB0A0961535D73BAEE536E2C
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=mmh&i=db226495-051a-4000-a988-5c7e629ad986&gdpr=&gdpr_consent=
Frame ID: 6136E68D6F62F145FFB4A02E0C0EC746
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=&gdpr_consent=&ccpa=
Frame ID: 13E360E23566A281E6023F1DBE18E533
Requests: 1 HTTP requests in this frame

Frame: https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=&_test=ZJUFGgATww5K6QAn
Frame ID: E67E5254F51660A68DC9100C8A04FB4E
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV8zNGE5Y2YyMi1iZGY5LTQzY2MtYTdhMy1iM2M5NmQ4ZTEyYmE=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv&google_tc=
Frame ID: 6F932AB9F6E4109325CBF9F147F15CB0
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Frame ID: 9B77147B2E72BD71AB0E6F0F2D232BE0
Requests: 12 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=ttd&i=5eebcfb8-e278-488f-b8a2-8e2c72e8342a
Frame ID: CEB56C3F843D9099EB4BA3ABD759D175
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s8AANhrMPYAAAAA
Frame ID: ED06C71C598883B7DEF7970E3872B1EA
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=aad&i=e9c2641c-16df-4241-b89f-acb98e5dda9f
Frame ID: D3F1801124800839EDC8646FD054CDD7
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Frame ID: 6A29BE28A0E527A4F104566D112DBAC0
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=rth&i=Fm6e4GJQl7FYhMVArg0p&pi=gumgum&tc=1
Frame ID: 1A0D7C37A28C24554D912080A3C9526C
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: 3068C1E0D4718D43B330294860669928
Requests: 3 HTTP requests in this frame

Frame: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Frame ID: 28C85662E9D508807C1D7DE91FDDF403
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDF9E8B40E-FA4B-4829-B1B4-0D3C144F20AA
Frame ID: 102F34861A7A3603B519A6D5DF525740
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716706107066
Frame ID: 738414B18A1B7BE3B36BA506CC1AF5BB
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&redir=true&gdpr=0&gdpr_consent=
Frame ID: BD042400BD21FAEE6C56B13AC96A3A67
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:db226495-051a-4000-a988-5c7e629ad986&gdpr=0&gdpr_consent=
Frame ID: 82F48BEF560BF3C97D338D9059DB771D
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABp1U7JKgoAAB-8yGYLag&gdpr=0&gdpr_consent=
Frame ID: 63CB9A7591F6C5FA70E5B4C83F58FB3E
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_459e3ba870174a4daa4af
Frame ID: AC347777182D60DC7C88C0D8907FD44D
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=pbm&i=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA
Frame ID: 6DC51B45B37641E4B2C49A8BF17674B3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Google's .zip Top Level domain is already used in phishing attacks - gHacks Tech News

Page URL History Show full URLs

http://www.baesystems.zip/ HTTP 307
https://www.baesystems.zip/ HTTP 302
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks// HTTP 301
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Didomi (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

sdk\.privacy-center\.org/.*/loader\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

/prebid\.js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

188
Requests

76 %
HTTPS

31 %
IPv6

66
Domains

91
Subdomains

54
IPs

7
Countries

1503 kB
Transfer

4641 kB
Size

124
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://deals.ghacks.net/
Title: Deals

Search URL Search Domain Scan URL

URL: https://domains.google/tld/zip/
Title: released

Search URL Search Domain Scan URL

URL: https://isc.sans.edu/diary/The+zip+gTLD+Risks+and+Opportunities/29838
Title: SANS Internet Storm Center

Search URL Search Domain Scan URL

URL: https://blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/
Title: but it took

Search URL Search Domain Scan URL

URL: https://www.facebook.com/therealmartinbrinkmann
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/martibrinkm
Title: Twitter

Search URL Search Domain Scan URL

URL: https://martinbrinkmann.substack.com/
Title: Substack

Search URL Search Domain Scan URL

URL: https://webextension.org/listing/block-site.html
Title: https://webextension.org/listing/block-site.html

Search URL Search Domain Scan URL

URL: https://hello.softonic.com/privacy-policy/
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ghacksnet

Search URL Search Domain Scan URL

URL: https://twitter.com/ghacks

Search URL Search Domain Scan URL

URL: http://eepurl.com/dp_1rj
Title: Ghacks Newsletter Sign up

Search URL Search Domain Scan URL

URL: https://en.softonic.com/articles/three-features-apple-should-add-now-to-apple-vision-pro
Title: Improving the User Experience: Three Essential Features for Apple Vision Pro

Search URL Search Domain Scan URL

URL: https://en.softonic.com/articles/reddit-gets-hot-with-the-recent-protest-mode-on-the-platform
Title: The Heat is On: Reddit’s Protest Mode Sparks Intense Online Discussions

Search URL Search Domain Scan URL

URL: https://en.softonic.com/articles/if-you-are-an-amazon-prime-member-we-have-bad-news-for-you-they-are-cheating-you
Title: Are You an Amazon Prime Member? Discover the Dark Secret They Don’t Want You to Know

Search URL Search Domain Scan URL

URL: https://en.softonic.com/articles/nasa-has-turned-a-galaxy-into-dj-listen-to-the-nebula-session
Title: Out of This World Beats: NASA Turns a Galaxy into a DJ, Bringing You the Nebula Session

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.baesystems.zip/ HTTP 307
https://www.baesystems.zip/ HTTP 302
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks// HTTP 301
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 89

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t

Request Chain 96

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D HTTP 302
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1687487770146 HTTP 302
https://ad.turn.com/r/cs?pid=45&rndcb=2192153305 HTTP 302
https://sync.1rx.io/usersync/turn/3195108133375671054?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-ddc61c9a-6b88-467e-8e84-53dfcb9d06b3-005?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-ddc61c9a-6b88-467e-8e84-53dfcb9d06b3-005 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-ddc61c9a-6b88-467e-8e84-53dfcb9d06b3-005

Request Chain 98

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID HTTP 302
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Request Chain 101

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Request Chain 102

https://ssbsync-us.smartadserver.com/api/sync?callerId=2 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=507124677645352015&gdpr=0&gdpr_consent=

Request Chain 103

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2240945551553324476182

Request Chain 111

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dapn%26i%3D%24UID HTTP 302
https://usersync.gumgum.com/usersync?b=apn&i=2314681699185709474

Request Chain 112

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent= HTTP 302
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?dsp_id=4&user_id=1b3bf3a9-a15b-4cf6-b005-9da6815cb966&ssp=gumgum2&expires=30&user_group=5&bsw_param=d083ad98-f0e3-4de4-b3e5-06f02856f38d HTTP 302
https://usersync.gumgum.com/usersync?b=bsw&i=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=&us_privacy=

Request Chain 113

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28eMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28eMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP%29 HTTP 302
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&obuid=ENC(eMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP) HTTP 302
https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
https://s.ad.smaato.net/c/?adExInit=o&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmaato%26uid%3D%24UID%26obUid%3DeMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP%26gdpr%3D%24GDPR_APPLIES%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%26initiator%3Dplatform HTTP 302
https://sync.outbrain.com/cookie-sync?p=smaato&uid=47b0bd4&obUid=eMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform

Request Chain 114

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
https://usersync.gumgum.com/usersync?b=opx&i=cac0f6ff-4205-050a-1f6b-b269d1fae803

Request Chain 115

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=&gdpr_consent= HTTP 302
https://usersync.gumgum.com/usersync?b=sta&i=0-4ec415cb-95e1-538d-6230-0ad19cdf4f4a$ip$5.181.234.134

Request Chain 116

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=&gdpr_consent= HTTP 302
https://usersync.gumgum.com/usersync?b=oth&i=y-Pbk0UvhE2pdH_yHrNngXCmJLQ1bMMyPEItwz~A

Request Chain 117

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
https://usersync.gumgum.com/usersync?b=vnt&i=582f5e29-0699-4a31-a424-ccc0c640626a

Request Chain 118

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D HTTP 307
https://usersync.gumgum.com/usersync?b=snc&i=6C9509C18A274A72AA6720B9342CCB7A

Request Chain 120

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__ HTTP 302
https://stags.bluekai.com/site/23178?id=lvbBgY938I3hSZR8CkVq&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTJHVWHMYSCM5MTSMZYJEZWQU22KI4EG22WOE HTTP 302
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTJHVWHMYSCM5MTSMZYJEZWQU22KI4EG22WOE HTTP 302
https://usersync.gumgum.com/usersync?b=zem&i=lvbBgY938I3hSZR8CkVq

Request Chain 121

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
https://usersync.gumgum.com/usersync?b=idi&i=4ae05c80-c319-4767-a4df-5bcc83899ea8

Request Chain 122

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
https://usersync.gumgum.com/usersync?b=pln&i=wwyVaIRIrOpg&ev=1&pid=558355

Request Chain 123

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=&gdpr_consent= HTTP 302
https://usersync.gumgum.com/usersync?b=sad&i=507124677645352015

Request Chain 126

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
https://usersync.gumgum.com/usersync?b=mmh&i=db226495-051a-4000-a988-5c7e629ad986&gdpr=&gdpr_consent=

Request Chain 127

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJUFGtNgPQ6lXIQH-YIvTAAADh4AAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm=&google_hm=ZJUFGtNgPQ6lXIQH-YIvTAAADh4AAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=&google_tc= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEBGoA9_BgUA-SGBEHNs9EIg&google_cver=1

Request Chain 128

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJUFGtNgPQ6lXIQH.YIvTAAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAlyHRGyOgie1YJxHF_ZGRI&google_cver=1&google_hm=2

Request Chain 129

https://match.adsrvr.org/track/cmf/casale HTTP 302
https://match.adsrvr.org/track/cmb/casale HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&expiration=1690079770&gdpr=0&gdpr_consent=

Request Chain 131

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=ZJUFGgATy18NjQBL HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJUFGgATy18NjQBL&_test=ZJUFGgATy18NjQBL

Request Chain 132

https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703298970&external_user_id=04cd3886-d7e5-4626-b584-b32c59343b7b

Request Chain 133

https://beacon.lynx.cognitivlabs.com/ix.gif HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=f2d851c3-77e7-43d1-926b-5bfdd10b1764&expiration=1719110170

Request Chain 134

https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 307
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=46a11ea3-841d-4501-bdde-d15eb10abe6f&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null

Request Chain 139

https://match.adsrvr.org/track/cmf/openx?oxid=3dfd528f-6a10-3d5c-7810-a28419aae945&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/openx?oxid=3dfd528f-6a10-3d5c-7810-a28419aae945&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&ttd_puid=3dfd528f-6a10-3d5c-7810-a28419aae945&gdpr=0&gdpr_consent=

Request Chain 140

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTE5MjgxNDUtYTM2Ny02M2Y4LTZkZjAtZjgzZGQzNDgyNzI1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTE5MjgxNDUtYTM2Ny02M2Y4LTZkZjAtZjgzZGQzNDgyNzI1&google_tc=

Request Chain 141

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc= HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPo2tk2X1KwsR2-lysYNqlY&google_cver=1

Request Chain 143

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=&_test=ZJUFGgATww5K6QAn

Request Chain 144

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV8zNGE5Y2YyMi1iZGY5LTQzY2MtYTdhMy1iM2M5NmQ4ZTEyYmE=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV8zNGE5Y2YyMi1iZGY5LTQzY2MtYTdhMy1iM2M5NmQ4ZTEyYmE=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv&google_tc=

Request Chain 146

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent= HTTP 302
https://usersync.gumgum.com/usersync?b=ttd&i=5eebcfb8-e278-488f-b8a2-8e2c72e8342a

Request Chain 147

https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s8AANhrMPYAAAAA

Request Chain 148

https://cs.admanmedia.com/sync/gumgum?puid=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=&gdpr_consent=&ccpa= HTTP 302
https://usersync.gumgum.com/usersync?b=aad&i=e9c2641c-16df-4241-b89f-acb98e5dda9f

Request Chain 150

https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
https://usersync.gumgum.com/usersync?b=rth&i=Fm6e4GJQl7FYhMVArg0p&pi=gumgum&tc=1

Request Chain 151

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
https://eus.rubiconproject.com/usync.html?p=gumgum

Request Chain 155

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-ei0DvpLSCmxtA08FE8gqg%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Request Chain 156

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=e2f0ea03-289e-4f5f-a1bd-a39e23bc0ac4%252C%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&ttd_puid=e2f0ea03-289e-4f5f-a1bd-a39e23bc0ac4%2C%2C

Request Chain 158

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent= HTTP 302
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&vxii_pid=12&vxii_pid1=10067&vxii_rcid=9af62d21-c101-4096-a1ff-c0e1de91ac2e

Request Chain 159

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjlFOEI0MEUtRkE0Qi00ODI5LUIxQjQtMEQzQzE0NEYyMEFB&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 160

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELrCNr7v4shcd-sZzkVlvRI&google_cver=1

Request Chain 161

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:8E184FF7195341CDA169C2CC1F27D2A6

Request Chain 162

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3195108133375671054&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 163

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&gdpr=0&gdpr_consent=

Request Chain 167

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=LJ7YNDTX-C-328J HTTP 302
https://s.amazon-adsystem.com/ecm3?id=LJ7YNDTX-C-328J&ex=d-rubiconproject.com&status=ok

Request Chain 168

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/zaEBPnx3LbI_EKvJa3qQqw?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-UdC6.05E2oKzR.7XnxDehCHwdjo0Pj.dJa4wOw--~A

Request Chain 169

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEEWBxmPL1MJBIjYtzSq5Y9k&google_cver=1

Request Chain 170

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&gdpr=0&gdpr_consent=&expires=30

Request Chain 171

https://token.rubiconproject.com/token?pid=36584 HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ7YNDTX-C-328J

Request Chain 172

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWY2YjU2Y2I1NWZiYjY5MTI4MGQ4YzIyN2FiOGU2MzM4MTZlMWFjMg

Request Chain 173

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo3WU5EVFgtQy0zMjhK HTTP 302
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGHXRUQZPmkoAqYj3bniq_Y&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo3WU5EVFgtQy0zMjhK&google_push=

Request Chain 174

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=JOA-aQgMQUiQPB9zf_8emw&rk=usync-na HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=JOA-aQgMQUiQPB9zf_8emw

Request Chain 176

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=LJ7YNDTX-C-328J HTTP 302
https://usersync.gumgum.com/usersync?b=mag&i=LJ7YNDTX-C-328J

Request Chain 179

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716706107066

Request Chain 181

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:db226495-051a-4000-a988-5c7e629ad986&gdpr=0&gdpr_consent=

Request Chain 182

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent= HTTP 303
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCcDFVN0pLZ29BQUItOHlHWUxhZw&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AABp1U7JKgoAAB-8yGYLag&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0 HTTP 307
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABp1U7JKgoAAB-8yGYLag&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=507124677645352015&gdpr=0&gdpr_consent= HTTP 303
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABp1U7JKgoAAB-8yGYLag&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D507124677645352015%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=507124677645352015&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AABp1U7JKgoAAB-8yGYLag&pid=558502&do=add&gdpr=0 HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABp1U7JKgoAAB-8yGYLag&gdpr=0&gdpr_consent=

Request Chain 183

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent= HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_459e3ba870174a4daa4af

Request Chain 189

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-AqzcaEJE2uUmOL3sCFiEal96GRuVcCk-~A&gdpr=0

Request Chain 191

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent= HTTP 302
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=377845f35a34183c&is_secure=true&networkId=17100&version=1&nuid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHO7MYr_854wNqUE_sAAAAAAA&expiration=1687574174&nuid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&is_secure=true&gdpr_consent=&gdpr=0

Request Chain 192

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=582f5e29-0699-4a31-a424-ccc0c640626a&gdpr=0&gdpr_consent=

Request Chain 193

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic HTTP 307
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic HTTP 302
https://x.bidswitch.net/sync?dsp_id=59&user_id=f294f51b-1a97-4bcb-ba5c-84b09808cdee&ssp=pubmatic HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=&gdpr_pd=

188 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Redirect Chain

http://www.baesystems.zip/
https://www.baesystems.zip/
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks//
https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

127 KB
28 KB

982ms
980ms

Document
text/html

2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac8cd48b7a9d1e1e1e9bb3939b1f76cfaf430ab142be8d36593b0a4b8204e6ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0
cf-cache-status: DYNAMIC
cf-ray: 7db95764ec4c8c77-EWR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 23 Jun 2023 02:36:06 GMT
expires: Fri, 23 Jun 2023 02:36:05 GMT
link: <https://www.ghacks.net/wp-json/>; rel="https://api.w.org/", <https://www.ghacks.net/wp-json/wp/v2/posts/194771>; rel="alternate"; type="application/json", <https://www.ghacks.net/?p=194771>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qlN0qmWOmACX%2BoyEahDFsx%2BR80kaMqLzZ8FeXIl0ktkSa4YQZ0R71kx4LAJaoPPuZxpXUIOorhWcwWjuPv5dgKLeyS8hxglDwnG2CCD9GhMsccmY4McYgjUWWfK9OiGj5yUDmK1pwmsrqYMT"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff nosniff
x-xss-protection: 1; mode=block 1; mode=block

Redirect headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 7db95761896f8c77-EWR
content-type: text/html; charset=UTF-8
date: Fri, 23 Jun 2023 02:36:05 GMT
expires: Fri, 23 Jun 2023 03:36:05 GMT
location: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xcFkQRyK%2Bsgbkc%2FosVwqZ%2FPuCzn%2BHOYr3kXS2BPxE04%2B48p%2F7YXUbKy31d5bQ42PQ4EclrczHaerHOG0eXZ8rttsbSTWSxGtOdN9hFv8fHL4DeLEF2EIGrrYf9SiVxn1I4QXwjzTpwKRRaJd"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff nosniff
x-redirect-by: WordPress
x-xss-protection: 1; mode=block 1; mode=block

GET
H2 200 style.min.css
www.ghacks.net/wp-includes/css/dist/block-library/ 79 KB
11 KB 39ms
33ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/css/dist/block-library/style.min.css?ver=5.8.7

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3214139
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 17 Jan 2022 06:40:42 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZA3rLq3Q8%2FJdQdq7oOp06VmVl0PvPF5ZdN%2BkoABFlfqCG5vAg658CVHXO4c0kCA12kVd8mwnvWhEnF5CMb0awHz53ZhIPHcKhaSfWuUZXQxcbGHgNMKhL4SmKjtW0JRdg%2F%2F%2FQr%2B8KyRGmF%2Fd"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2aa48c77-EWR
expires: Wed, 15 May 2024 21:47:07 GMT

GET
H2 200 slick.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/ghacks-post-slider/assets/css/ 1 KB
779 B 38ms
32ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/ghacks-post-slider/assets/css/slick.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9615d053779f17698d32327e1fe8296c8fb45353770837879e4795f9c28cad38

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
cf-polished: origSize=1474
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LMhHcIJB1tFZ0VsARUsy1sKWzvflIfS7RoZCkp2phwvdXHwL5E57nuka9LioC5VWFRXnt5N6DIOTKfx54hN5iC9VgyIk6FQsHUPwUa6lMksBROnDdteKJuWxwQvKfIqwgrMrz9uj5R7Om2d5"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2aa78c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 recent-post-style.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/ghacks-post-slider/assets/css/ 7 KB
2 KB 45ms
40ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/ghacks-post-slider/assets/css/recent-post-style.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2464528204e216b4f6b2e8f52b577c86621d2297d0f0b69e848abe643aa6896c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189252
cf-polished: origSize=6976
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p6atGWTGTiXBVLqqduuuVcakmOMNyXYsUSgQDpwZPsp%2BkGv4Fu%2BmtJR%2FapbR9cVqfjcs9Wf0xFL4vi0Jg1XiGNo3LMvbLKtj%2BxyASzO9Sq0PwAQaJuoxfaD0VlBY%2B3PSXJNOXsrSX%2BejMo1r"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2aa98c77-EWR
expires: Sat, 08 Jun 2024 08:15:14 GMT

GET
H2 200 swiper.min.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/my-custom-functionality-master/assets/css/ 13 KB
4 KB 35ms
30ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/my-custom-functionality-master/assets/css/swiper.min.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11ec9bb8e81592df9f2c0e18c6dae852561b7ed0dca2d47d5dc50edc8d2a90a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OYNVRgfftN9XwQWwlGHH%2FN0KUrD0%2FEj4prADFQtjzSm5Pl58KpbMw2E%2FG2ODo0OGrJYmcUcuZVJgybUyukxeOy09P2%2BTj3GmSR0633QeLh3nSzYgzyRBrXKD239yStL2BHe%2FNjKc8UK%2FkIyO"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2aaa8c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 notix-public.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/notix-web-push-notifications/public/css/ 1 KB
659 B 36ms
31ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/notix-web-push-notifications/public/css/notix-public.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6738331b4ac9f5a9c6c2cad8fa28ea9a6834d28bdc5ebcb545ec7a4acd6795e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
cf-polished: origSize=1107
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Oq8uoxSrtzebu3N41kHXFJd6f98csGJtRGCWO2%2Ff%2B2URGQvjOswOnQkWJUQhOGgYFB6LnOBb8%2BBA2jM4tXmbXCA00xn%2Fx5qPdhR7D6EkZpgtHS2QvEv58vBaliWYUAY4VleadQV02ST2jKQT"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2aab8c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 dashicons.min.css
www.ghacks.net/wp-content/cache/min/1/wp-includes/css/ 58 KB
35 KB 39ms
34ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-includes/css/dashicons.min.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8276d99808a3a111dcb2dc61c895388c21341d48be9c3f87d905787a49c2b832

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0ws81nseAIQ9%2BFK8qt9zEQkVAtaypOQqzcUaF8Lr9PioJvk7SAFMTnfjm9h5IoWsvIgFy%2Bni59t%2Bw%2FKgwDAgzr%2BGz7ZdHkwgfyWfiqLjurdOgsEg2kxqTCuvGs%2Fy%2BR%2BCSqyPJW%2FUy78y%2FHl7"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2aac8c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 style.css
www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/ 242 B
590 B 41ms
37ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/style.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e808c4a589bbe7ad73f3e66b99f651c32d1a10079973e9db31bd2cce64855c16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
cf-polished: origSize=245
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q5%2F0EFruQSghklMkehEUsJMZ%2FRZNMq4Q8WEq6PWEtXaDcXjCJcwOFOz0NkId610xPZyMdq0pTSdVZh5bD9BuUK9znIQdj4TAFk74S1apLsWMP8ZYfWu6jzt3gotbu97muZeT9oDUdWNp0SSX"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2aad8c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 single.css
www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/ 23 KB
5 KB 42ms
38ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/single.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7378fe642cc87c3a1343b20efdd53f4e560319daf19f95c4312163a3b788585c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I7NQwnIHaBMn%2FqaZiITPo5SASwd%2B92helRhhWZFdBbRDOxcKJTtKu7Szo1%2B72slm9SvGvyOQ3kOBCSnPIFiayNDyJJ5YHWhCkC25vMEfvOwqw2w%2BalI9OlxFFj%2BMFQ%2B2gBuS94ZO5BJ999wi"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2aae8c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 tablepress-combined.min.css
www.ghacks.net/wp-content/cache/min/1/wp-content/ 5 KB
2 KB 43ms
39ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/tablepress-combined.min.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3664be3a8c387d48a6ba88f70f557117597213f1d377d6b54810de6a6abe20c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1I%2BbKHJI6QALkyH2Mwc4cHIRKsWL8hB7DKF%2FV4c%2Fy6j5OYC7F6bopW%2FyQJJv0%2Folr5V4s7o0IRUnrz8NfY6TJefC2YWRUEKWpb0sA6K0JIS72sy6nQz1nv7tHA2YRhMS%2FodEv6ucnK2Wr3wZ"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2ab08c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 tablepress-responsive.min.css
www.ghacks.net/wp-content/plugins/tablepress-responsive-tables/css/ 9 KB
2 KB 45ms
41ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/tablepress-responsive-tables/css/tablepress-responsive.min.css?ver=1.8

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228388
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 30 Sep 2021 13:17:37 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ln2y2%2FFrbx5SvmZymaz8cXSHGwPJq2w3Ftj8lolUkyv81Nrb3Wn2eK18qPhOzsXSFbUUd6qHyih1ZWbtKPTmOsgA93sv0uIXr5SNlKHRUtJ84wANs43wDK1nyW304p%2FJk%2FmbsyUcKKWiJSAg"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b2ab28c77-EWR
expires: Tue, 05 Dec 2023 16:56:18 GMT

GET
H2 200 jquery.rating.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/all-in-one-schemaorg-rich-snippets/css/ 876 B
614 B 63ms
60ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/all-in-one-schemaorg-rich-snippets/css/jquery.rating.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8aa3471bd234c6963a168e8501f9aeb622c42ffe00fba96072a487f71a00029b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
cf-polished: origSize=894
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dccF%2FRZ964WEGesYEAW1bCSW%2BcmP956ehN7NlcJwAW%2BkztMJ76CBTXhih10JwlbrL3JtznHiElz9UzdrOYwyLYtju1c6vpEHXUeL3J6VJb4%2B8JxPvbyRoMCt0fsAIKcNOw0vVQSu07KRm%2FnZ"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b4ad08c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 style.css
www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/all-in-one-schemaorg-rich-snippets/css/ 2 KB
948 B 62ms
58ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/plugins/all-in-one-schemaorg-rich-snippets/css/style.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b477c9694f19d0c1f986ba24a394caaf31be4d2b06e4df9b30be12f9cb1e76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
cf-polished: origSize=1671
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XO39ewA3bho21zgeNtQrRibGcRDDk2JPRunYPwc6tKIHPy48L8OtGJdLrjdjuu7Ud9ctfY52Eav0fYOnMrUiPgHuwDCS65QfF7VB7kaqlAO%2Fm3w4Sjwo6so7ilqzb%2B0qdMOR2foIC%2BwOMTSi"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b4ad38c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 jquery.min.js Show response
www.ghacks.net/wp-includes/js/jquery/ 87 KB
32 KB 66ms
62ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228388
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 17 Jan 2022 06:40:43 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0LjKZIbb7Fv%2FPRyMwJa0fwZuqS0ANyQiEJntnROyIxxnhZRxRblyWiyLpa2%2FapNTAY7zk%2BgKjbwGGyDptPsxo5NJrG%2FJPlZG8qI7q34rXQJSE%2BsHhB92lK4lEi5hgswzGVRNRmY%2BkXUromDk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b4ad58c77-EWR
expires: Tue, 05 Dec 2023 16:56:18 GMT

GET
H2 200 jquery-migrate.min.js Show response
www.ghacks.net/wp-includes/js/jquery/ 11 KB
5 KB 31ms
30ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228388
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 25 Feb 2021 15:04:44 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wzBYEBlK7NG8G%2FIGi1%2FVe8PjLWrle1E5oDmhltiLx3%2BwwPV0CNlKp5aGNB7b3aj549cjUA5%2B7nA%2BVcl8KW%2BbRduxXjta4bwcYxZorT9rRQvY0E0wNmd75tNSbmfmtl7xDhNoHZs9G0FXu%2Fqg"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576bbb5a8c77-EWR
expires: Tue, 05 Dec 2023 16:56:18 GMT

GET
H2 200 notix-public.js Show response
www.ghacks.net/wp-content/plugins/notix-web-push-notifications/public/js/ 37 B
404 B 32ms
27ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/notix-web-push-notifications/public/js/notix-public.js?ver=1.1.1

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1e8df27eefed0250a8e2785a341a5d35d838d8136f4ffde3168c57e9137aa2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228388
cf-polished: origSize=838
content-length: 37
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Mon, 17 Jan 2022 06:50:03 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rH3PHMlMZ%2Bgoiqdg45ogSPUvFZQwDW2bhPb%2BSaaWePwW5SnGbYeCeAkxMjM29o8qWHEAb9v%2BfO1556zX1yPIM3lxQMQFG8GbwWEkaCDMf9CToZ9%2Fa46f9Qt8jkY8kBBmp3Vlm9ORcOHXA5qR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 7db9576c1bba8c77-EWR
expires: Tue, 05 Dec 2023 16:56:18 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 361 KB
121 KB 110ms
66ms Script
text/javascript 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js?ver=1

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed3307c62c0d78bf73af142b4c660e3257374d97385b2f50b28b1003a5c00513

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 123120
x-xss-protection: 0
expires: Fri, 23 Jun 2023 02:36:06 GMT

GET
H2 200 api.js Show response
www.gstatic.com/readaloud/player/web/api/js/ 464 KB
159 KB 110ms
68ms Script
text/javascript 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/readaloud/player/web/api/js/api.js?ver=1

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3e051a82490a96f88cc2342630f59cac4c7c4bcab275ee30f9cbecd8e8a62b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 01:46:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2989
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/speakr
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 162572
x-xss-protection: 0
last-modified: Tue, 20 Jun 2023 14:28:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="speakr"
vary: Accept-Encoding
report-to: {"group":"speakr","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/speakr"}]}
content-type: text/javascript
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Fri, 23 Jun 2023 02:36:17 GMT

GET
H2 200 jquery.rating.min.js Show response
www.ghacks.net/wp-content/plugins/all-in-one-schemaorg-rich-snippets/js/ 29 KB
11 KB 57ms
51ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/all-in-one-schemaorg-rich-snippets/js/jquery.rating.min.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

554f3ff96cba4f2f33ff2c37c48282006ab24a85cf9ca0ac8b22b0a06126c1d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228388
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 17 Jan 2022 06:50:41 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mqG%2F6lEQyK%2FcWUVOXpmYIOf3SR5oZ5XLdEavQSxoCF12cIzfC%2FqvTvWNnEED8b7igwnTgzmA%2FnhBKse6MVWen683Oysap5rrt4CPObwOXTsi1e71a%2FiuK60RAVmvtcxfrpfusO%2FlEFGbDMi7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c2bc48c77-EWR
expires: Tue, 05 Dec 2023 16:56:18 GMT

GET
H2 200 polyfill.min.js Show response
polyfill.io/v2/ 100 B
673 B 139ms
44ms Script
text/javascript 2a04:4e42::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v2/polyfill.min.js?features=fetch

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Fri, 23 Jun 2023 02:36:06 GMT
age: 152660
detected-user-agent: Chrome/114.0.0
useragent_normaliser: chrome/114.0.0
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=3
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 104
referrer-policy: origin-when-cross-origin
last-modified: Tue, 20 Jun 2023 23:08:32 GMT
fastly_service_version: 202
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
normalized-user-agent: chrome/114.0.0
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 163ms
93ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5422371e9dc5032144463d1bba86e009030131126cfe22315a3e51cefed2a451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26662
x-xss-protection: 0
server: cafe
etag: 642 / 19531 / 31075569 / config-hash: 11591319961802778394
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 23 Jun 2023 02:36:06 GMT

GET
H3 200 prebid.js Show response
spn-v1.revampcdn.com/prebid/ 223 KB
64 KB 88ms
56ms Script
application/javascript 151.101.65.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/prebid/prebid.js
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 151.101.65.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 70d9311702ac457eb90a7133063593c379191d9d9ca1d3c9549d78481283be6f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1138.0
date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: br
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
age: 92520
x-cache: HIT, HIT
x-envoy-upstream-service-time: 47
x-region: CT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 65207
x-request-id: ebe7c965-b8ac-4e77-983f-31ec01d5ddbf
x-served-by: cache-ams21069-AMS, cache-lga21958-LGA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-platform-id: Windows 10
server: istio-envoy
x-timer: S1687487766.447453,VS0,VE6
etag: W/"2ee0925227babc3bbd91d16ceed0b888"
x-browser-name: Chrome
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=172500, public, s-maxage=172800, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
accept-ranges: bytes
x-country-code: US
x-cache-hits: 567, 1

GET
H2 200 ghacks.js Show response
spn-v1.revampcdn.com/publishers/ 250 KB
53 KB 128ms
28ms Script
application/javascript 151.101.65.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.101.65.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 124e61a3b158acb4ab3d8b81c92f3d11d3444ae08413e03e23aa4c14ea4d308a

Request headers

Referer: https://www.ghacks.net/
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1140.0
date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: br
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
age: 3597
x-cache: HIT, HIT
x-envoy-upstream-service-time: 350
x-region: CT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 53454
x-request-id: 85845830-d70a-45e5-8fba-548261bb8b43
x-served-by: cache-ams21024-AMS, cache-lga21977-LGA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-platform-id: Windows 10
server: istio-envoy
x-publisher-id: ghacks
x-timer: S1687487766.363460,VS0,VE7
etag: W/"3e8e50d8958c079a0b33cf131d941b9c"
x-browser-name: Chrome
vary: Accept-Encoding,x-device-platform
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=172500, public, s-maxage=172800, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
accept-ranges: bytes
x-country-code: US
x-cache-hits: 21, 1

GET
H2 200 email-decode.min.js Show response
www.ghacks.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 58ms
56ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Jun 2023 09:29:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64941465-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=55xLHvvl05MfjlrjiWZBkT0%2ByxogdGkY3okFryLkvXafbLRw2z4%2F37MB%2Bq3VNTzhYvIBbIlUPFiRUEqTXp35S%2Fl9rCIM7j1%2B2YwzW%2BQxztUWm%2BBzhUz0P3LxqguA4qM%2BXj5I0i2J1Sd1YptL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7db9576b4ad78c77-EWR
expires: Sun, 25 Jun 2023 02:36:06 GMT

GET
H2 200 affiliate-link-shortcode.css
www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/ 1 KB
794 B 59ms
57ms Stylesheet
text/css 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/affiliate-link-shortcode.css?ver=1686297620

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e4ea1a836c9e61ca541b43dec61bcd3314ee017b899177e00355034775adce14

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1189251
cf-polished: origSize=1544
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 09 Jun 2023 08:00:20 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N%2F3PkwIUioOFGD7bbF3mi62MyeoE44oXvgBLK9EKMY%2FKhybGB2RbLMKBOc5e6hZnlwTwv071JDjoOZQwWY49I05ovcLLWF1DibrGipvxtrGwLb0xXul%2FilRFO1o%2BYly4eOEJUjUr4oIUcdEZ"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576b4ad68c77-EWR
expires: Sat, 08 Jun 2024 08:15:15 GMT

GET
H2 200 frontend.js Show response
www.ghacks.net/wp-content/plugins/geoip-detect/js/dist/ 20 KB
7 KB 36ms
30ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/geoip-detect/js/dist/frontend.js?ver=5.0.0

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b13fc50b6ed0a616dc2581175f19de22c59207a54ab0099f32b96c5e13fd71d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228388
cf-polished: origSize=20717
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Mon, 17 Jan 2022 06:49:32 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=enOrE4pnqGuzy8%2BwcZ%2Bfx%2BY09DU5nZiRCh%2F2%2BUNXP2acOXbfuhwwElAiqQW9piJtkZyVoU9OICOolmzdZpcgGZ4U9sQn8WNo7dDdmFuo0nYjWtch3jjrNjflwViKloQ8WjaPGu%2F6I6Cs34KJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c2bc58c77-EWR
expires: Tue, 05 Dec 2023 16:56:18 GMT

GET
H2 200 swiper.min.js Show response
www.ghacks.net/wp-content/plugins/my-custom-functionality-master/assets/js/ 133 KB
35 KB 58ms
53ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/my-custom-functionality-master/assets/js/swiper.min.js?ver=9.9.0

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d36ac645d9f3443fe2b4ee6306a14b305bc3d93f3ed72e913d067d02200e889c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 850772
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jul 2021 09:37:48 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uyTTnKGozup9YE2fYwV7WX6%2F1t2crWteuBuMAWehRBjI5Kq8rTVdmvLjWdGHDR8lnGvswH9G0gz13F%2B%2BcuVh4WuHShEzvhuY%2FeQKAQvLEDduXmUFHTBNXnjxQrEaOv%2Fy8THwrrY30QGTM82B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c2bc78c77-EWR
expires: Wed, 12 Jun 2024 06:16:34 GMT

GET
H2 200 rmp-menu.js Show response
www.ghacks.net/wp-content/plugins/responsive-menu/v4.0.0/assets/js/ 7 KB
2 KB 61ms
56ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/responsive-menu/v4.0.0/assets/js/rmp-menu.js?ver=4.2.0

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25d617eac8e9a101e470e45fefe975a9c7c7420f5d3f0eff1a3ffe6a535a03dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228388
cf-polished: origSize=10883
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Mon, 21 Nov 2022 18:21:27 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AVBcnN41k2ehAIk7SOgzn%2FHpNhWUBI21IVsQfMaweQWHithIf2PvoN7Zb39Omm07RgkhPCXlJkClGqgEm0f5UOKVjEmzz4rMQ81%2BSQeyHtZADenamUbo0fh434dSpsjzsDL8H%2BJtJA%2BexlBf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c2bc98c77-EWR
expires: Tue, 05 Dec 2023 16:56:18 GMT

GET
H2 200 scripts.js Show response
www.ghacks.net/wp-content/themes/new-ghacks-preview/ 711 B
698 B 62ms
57ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/themes/new-ghacks-preview/scripts.js?ver=1.2.3.4.26

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42acc026706304b5193dbb474671c1258d2ab58d51512fa283e2ec02718fc531

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228388
cf-polished: origSize=792
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Fri, 12 Nov 2021 11:58:46 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nIRfnkdms5E7qvlZok%2BC%2FZhOKVOMtBrTvaic5HDNQ3tOo3hNjUuvrnCE%2BEUGldPOV0IkBNnAPKn91vxUylsvsPLpcjQEywzWtYZJ7KD8WT12u2N5S0klAg8b5pcgiCeczfGp4F%2BEHQUEHRDf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c2bcb8c77-EWR
expires: Tue, 05 Dec 2023 16:56:18 GMT

GET
H2 200 comment-reply.min.js Show response
www.ghacks.net/wp-includes/js/ 3 KB
2 KB 57ms
52ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/js/comment-reply.min.js?ver=5.8.7

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3214139
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Sun, 18 Apr 2021 15:10:03 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MQaui7jgqjG3p7b36k2emARrfPEaOn8NFE1y8zCgc%2FjMhQkuAAyo3CHbSqMVurloOIt6iTI3YtF5owT8omMcpB%2F9YgOe852crF%2FpefMMATDXx243HSp9xEuaxsN8kZ5ZoMW%2BRbjWkgB4I65b"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c2bce8c77-EWR
expires: Wed, 15 May 2024 21:47:07 GMT

GET
H2 200 revamp-infinite-leaderboard.js Show response
www.ghacks.net/wp-content/themes/new-ghacks-preview/ 4 KB
3 KB 63ms
59ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/themes/new-ghacks-preview/revamp-infinite-leaderboard.js?ver=0.2

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eee2cc0688e4321b02687d1644a880232b97ba8bbaa2effb391b98da84cb408f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4378119
cf-polished: origSize=5368
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Wed, 03 May 2023 10:15:21 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t5YWB0Z5a063gyjJvEdVbXsqX%2FSWr2ynip2QZSxMNX%2FmjaCcgBh2kJEzu67syf3bqSqrDfY2AZ%2BTBGBxByWciPYOtGoUv9BMCuv5XpUN2Q1IT16SCxIiZssz2Ln4bseZ9XLS%2FfFQ2%2FTIunZ0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c2bd08c77-EWR
expires: Thu, 02 May 2024 10:27:27 GMT

GET
H2 200 wp-embed.min.js Show response
www.ghacks.net/wp-includes/js/ 1 KB
1 KB 62ms
58ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-includes/js/wp-embed.min.js?ver=5.8.7

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a482d2d94c0d1bc6937a1759389d01b475e6b28a0d9b5d7eaa3f9cc8f59f3cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3214139
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Tue, 16 May 2023 21:46:29 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fGqV%2F4i53phwK71l0AVAPOcKpi9B21GEezDl2jHte6FiJ8grW5X4AgnYhkkm%2FNbWmOxANDtnxpslyFAah%2B5DEMh7PCCsMyJQgwnS%2BUZLt3eFcz%2BVT%2FgspQ0djqewaZ64B%2FD1%2FAdtZiJqs0B6"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c2bd18c77-EWR
expires: Wed, 15 May 2024 21:47:07 GMT

GET
H2 200 lazyload.min.js Show response
www.ghacks.net/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ 8 KB
3 KB 64ms
60ms Script
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228388
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 17 Jan 2022 06:51:30 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kWVStbTxFNwFYVN%2FWt0vqfXvZ7w7uu8r6D%2BkhBDnGaDXCDHX86b1%2BLyXwvdYHj3DB0tEf%2B9MkynOF4j3gyAxGuwCNCOv5e8p44Xlj3OPz6L%2F6eCssrYCQSoIpAcsMpMtmIYnaTg3QOgXfN90"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c2bd28c77-EWR
expires: Tue, 05 Dec 2023 16:56:18 GMT

GET
H2 200 dfp.js Show response
www.ghacks.net/statics/ 106 B
434 B 28ms
27ms Fetch
application/javascript 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/statics/dfp.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aea4e7430290383948b2c8a639f25a8a6998ee0cba5eba1f49de44b34f6d1487

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17228387
cf-polished: origSize=110
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
cf-bgj: minify
last-modified: Mon, 06 Jul 2020 09:03:09 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OCc4xTKDCOuMzgj%2Fjh55FhXr%2F7p5IrGngkvsWy85F2aqDhlfGw3jQfsdNiownEGIe62Lw1FS2gtgxD9XkPDDLCFooVEUE60Ow06qoC7zn%2FW2axQm9ylueNA7hJEfS0vgD3%2F24MvFcnzKWjBF"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7db9576c0bb38c77-EWR
expires: Tue, 05 Dec 2023 16:56:19 GMT

GET
H2 200 px.gif Show response
www.ghacks.net/statics/ 68 B
443 B 29ms
28ms Fetch
image/gif 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ghacks.net/statics/px.gif

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6859872
content-length: 68
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 13 Aug 2020 14:05:45 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lrfxy84PgTyPTTngRKg%2BH%2FwZd5IF2BEjc3qj2Qs1%2BXRSDXk59E2cwtf1ohXMgjif4rQ7VHNP1pYbtjk7TwsT4TRkDiC5SQCLaKFfRaPXgKYGxbkNK9xr9sVCQvbnkX%2BqrhYiVa2EKpY%2B2KKB"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public, max-age=10368000
accept-ranges: bytes
cf-ray: 7db9576c0bb58c77-EWR
expires: Wed, 02 Aug 2023 17:04:54 GMT

GET
H2 200 enot.min.js Show response
notix.io/ent/current/ 90 KB
26 KB 334ms
95ms Script
application/javascript 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/ent/current/enot.min.js
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 00bf6629654c4bdef1a8aacb834c7522d0798c4fc681fb85761e3b9ae2913db6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:35:59 GMT
content-encoding: gzip
last-modified: Wed, 21 Jun 2023 16:09:29 GMT
server: nginx
etag: W/"649320b9-1675a"
content-type: application/javascript
cache-control: no-cache
access-control-allow-credentials: true

GET
H2 200 loader.js Show response
sdk.privacy-center.org/a8ff32f4-78c7-4428-825d-0badb488b68b/ 54 KB
12 KB 154ms
37ms Script
application/javascript 2600:9000:2510:c600:5:b7cc:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.privacy-center.org/a8ff32f4-78c7-4428-825d-0badb488b68b/loader.js?target=www.ghacks.net
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2510:c600:5:b7cc:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e47839620ae791505f14bcf06a9ada7a2ecf1a0268cbda2c9efc883d77558449

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 00:37:32 GMT
content-encoding: gzip
via: 1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
x-didomi-remote-config-source: Lambda
server: CloudFront
x-amz-cf-pop: JFK50-P5
age: 7114
etag: "655cd1060229c5692fb1e7c9b958a121"
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: max-age=7200, public
content-length: 12312
x-amz-cf-id: w28hJq9U_CCzmwEx5ny44SO93aGJ8x6MknHluZ-nb86HxoTd76cOvQ==

GET
H2 200 marfeel-sdk.js Show response
sdk.mrf.io/statics/ 112 KB
31 KB 486ms
365ms Script
application/javascript 2606:4700:3033::ac43:9fa2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=2544
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:9fa2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59cb9485f12fbd706268412d6ac360905369d2aca4889973b8fbfe8ba834db2a

Request headers

Referer: https://www.ghacks.net/
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-response-time: 1ms
date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Fri, 23 Jun 2023 02:30:31 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=1800
x-envoy-upstream-service-time: 5
accept-ranges: bytes
cf-ray: 7db9576cdae11811-EWR
alt-svc: h3=":443"; ma=86400
content-length: 31571

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 112 KB
29 KB 135ms
33ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 23 Jun 2023 02:36:06 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 28296
x-xss-protection: 0
pragma: public
x-fb-debug: cmjp3h1NEO6SbDYHmdtouRHeZEEJ4fCJbEcbQFozyMsl268FWt/Og3pHruY6x5N2u1Zvssiz4QULfFYxMag4Eg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 134 KB
51 KB 153ms
61ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NHW6RDK

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c793dd0c17a874af11c48cf5decfc60297b14b8739a867bffb4586db64e8c868

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52079
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Jun 2023 02:36:06 GMT

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e00e9bc52a415fc6e22f2332ba8c16d996f59962d5d80ff84f2de86b23782e2d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4919ddf6337285052dc0fe47fd60298fceb2679267a3fd1a85938d2b52538ef2

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec922a202c99fe67c6a7a2d4cddb5947f4f9ba6a501768b9900114d32ab43315

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9cca958d544314da08debbbdc0614a7310a50846cf880c26746104cde227de84

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75e0fe33a139622cde1d4bacdef52e609e623b514c56b113c69568fa16c23a12

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aaf69f969c85107828b863ad90f70534c60fc64cbb1a7f3e28d78692d8854db5

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3b0c961624b56351ac1fdcfed1a3ce5c68e73921d08887d89713a1d0df83427

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 search-icon.svg
www.ghacks.net/wp-content/themes/new-ghacks-preview/images/ 894 B
956 B 59ms
58ms Image
image/svg+xml 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ghacks.net/wp-content/themes/new-ghacks-preview/images/search-icon.svg

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/single.css?ver=1686297620

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c56ae0ce6a61669700b75187f654ea8b5fe23cb1377e463c7fc93d052eade027

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/wp-content/cache/min/1/wp-content/themes/new-ghacks-preview/css/single.css?ver=1686297620
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1674782
content-encoding: br
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 09 Jul 2021 09:43:09 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uqh5Av6DjHTXBwPKyN8oF8X5EbZFdWSKK3oHN2swtKOHFRT1VTwgTeJb5k4nrirc5cLMU0zHB%2FPG15raEa%2FE%2BHddyHygJN4rIXuifx7z4gJ5VNprDHRAoKnImqNd8XyPdJNgYCbkzMVv5TfN"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 7db9576c4bea8c77-EWR
expires: Mon, 03 Jul 2023 17:23:04 GMT

GET
DATA 200
OK truncated
/ 384 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8564419bba762b0ce4e3bc45fe5c478fcdaac5cc92e78862ce30a6581e11a3f0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 datadog-rum-v4.js Show response
www.datadoghq-browser-agent.com/ 141 KB
45 KB 93ms
15ms Script
application/javascript 13.225.224.171
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.224.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-224-171.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9d8c5621c9f8cbe6b7a788a8f34d405a443c511cc5135f38452da0c6d901ba6d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:35:40 GMT
content-encoding: br
via: 1.1 ab00cdb05d9e58b648b9b6b09875b196.cloudfront.net (CloudFront)
last-modified: Mon, 19 Jun 2023 09:41:15 GMT
server: AmazonS3
x-amz-cf-pop: JFK51-C1
age: 27
x-amz-server-side-encryption: AES256
etag: W/"f7e0ebdf291cb29f61bc6eff74446bf9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: tYzZL56OmJzmiHvkfy4_1OFzOgNdvIs5Mlw5Mo7gppUv4Lr-I6J9HA==

HEAD
H2 200 ghacks.js
spn-v1.revampcdn.com/publishers/ 0
0 14ms
13ms Fetch
application/javascript 151.101.65.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.101.65.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1140.0
date: Fri, 23 Jun 2023 02:36:06 GMT
content-encoding: br
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
age: 3597
x-cache: HIT, HIT
x-envoy-upstream-service-time: 350
x-region: CT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 53454
x-request-id: 85845830-d70a-45e5-8fba-548261bb8b43
x-served-by: cache-ams21024-AMS, cache-lga21977-LGA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-platform-id: Windows 10
server: istio-envoy
x-publisher-id: ghacks
x-timer: S1687487767.818164,VS0,VE1
etag: W/"3e8e50d8958c079a0b33cf131d941b9c"
x-browser-name: Chrome
vary: Accept-Encoding,x-device-platform
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=172500, public, s-maxage=172800, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
accept-ranges: bytes
x-country-code: US
x-cache-hits: 21, 2

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 236 KB
58 KB 161ms
26ms Script
application/javascript 108.138.107.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-107-138.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:11:00 GMT
content-encoding: gzip
via: 1.1 8d6071bd169bbf5fd46638140132b1d0.cloudfront.net (CloudFront), 1.1 44ffe5f6f95421818455d39547956aa4.cloudfront.net (CloudFront)
last-modified: Thu, 15 Jun 2023 18:14:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, JFK50-P3
age: 1508
x-amz-server-side-encryption: AES256
etag: W/"7c6a36eb4b73f6b7cf4a63a33418a2c9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: mnJqD977tjjtupjFFpFDHLE9_Wb0k9bWzFPTRr33u15n0vWtJUltgQ==

GET
H2 200 tag Show response
btloader.com/ 15 KB
7 KB 119ms
24ms Script
application/javascript 2606:4700:20::ac43:4686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?o=5633429348548608&domain=ghacks.net&upapi=true
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02563f6dd488eac87d5c8280cdc49326a311cde34be86fe6ec5f5793385d7ad7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 23 Jun 2023 02:22:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 602
etag: W/"85918af2c3611aef454ef5c6285bc0b0"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=htImvWBrmYwiDP9whJV1jZf5%2FsiFgsB2KB9sfiZB9UYWqw79G%2FBB2HSWvcdANutYRGTsUar76V4R4FsC3TWg4hanbRJ7wZmbGDGy7E%2Fr2pJ7wd7YKhM0DcwrnCz%2F3xtG%2BDUqKJZybmkxdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
cf-ray: 7db9576fe83542f8-EWR

GET
H3 200 https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F Show response
spn-v1.revampcdn.com/contextual/ghacks/ 315 B
893 B 111ms
107ms Fetch
application/json 151.101.65.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/contextual/ghacks/https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 151.101.65.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: ff481473ceb28fd40f49e1d1dce9a969cc0d52f89be7fd2c687044cc2ff98cce

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1140.0
date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: br
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
age: 236904
x-cache: HIT, MISS
x-envoy-upstream-service-time: 26
x-region: CT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 153
x-request-id: 4225ac43-c1b9-4b52-8a19-2f79316b11dd
x-served-by: cache-ams21057-AMS, cache-lga21958-LGA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-platform-id: Windows 10
server: istio-envoy
x-publisher-id: ghacks
x-timer: S1687487767.938955,VS0,VE89
etag: W/"063af77f2196cd23fab5a55029c48576"
x-browser-name: Chrome
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=2419200, public, s-maxage=2419500, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
accept-ranges: bytes
x-country-code: US
x-cache-hits: 24, 0

GET
H3 200 https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F Show response
spn-v1.revampcdn.com/policyshield/ghacks/ 39 B
943 B 37ms
33ms Fetch
application/json 151.101.65.91
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://spn-v1.revampcdn.com/policyshield/ghacks/https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F
Requested by: Host: spn-v1.revampcdn.com
URL: https://spn-v1.revampcdn.com/publishers/ghacks.js?modern=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 151.101.65.91 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: b8898a324d47c121f750f567f66777129c9a6980d0590cdc93a90043963f110c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-version: 1.1125.0
content-encoding: br
x-compliant: 0
age: 847731
x-rv-policy: crime
x-served-by: cache-ams21047-AMS, cache-lga21958-LGA
x-platform-version: NT 10.0
x-browser-version: 114.0.5735.133
x-publisher-id: ghacks
x-timer: S1687487767.966267,VS0,VE5
etag: W/"73178ed97c848f1611171ac6e2a0c92c"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: x-country-code, x-region, x-browser-name, x-browser-version, x-platform-id, x-platform-version, x-device-platform
cache-control: max-age=2419200, public, s-maxage=2419500, stale-if-error=31536000, stale-while-revalidate=864000
x-device-platform: Desktop
x-cache-hits: 13, 1
date: Fri, 23 Jun 2023 02:36:06 GMT
x-envoy-decorator-operation: svc-revamp-api-cms.revamp-api-v2.svc.cluster.local:80/*
via: 1.1 google, 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT
x-envoy-upstream-service-time: 48
x-region: CT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 43
x-request-id: f41874a4-cb0f-4d53-b784-8e511d81b70a
x-last-modified-timestamp: 1686351793
last-modified: Fri, 09 June 2023 23:03:13 GMT
server: istio-envoy
x-platform-id: Windows 10
x-browser-name: Chrome
accept-ranges: bytes
x-param-url: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
x-country-code: US

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/ 393 KB
125 KB 36ms
10ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3086c49956d51c2cba2562ba86a083aedf01d66f41c264f158f5d4f6e632c3eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 10:36:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57552
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127939
x-xss-protection: 0
server: cafe
etag: 10569078359274256513
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Fri, 21 Jun 2024 10:36:55 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 1001 B
440 B 83ms
46ms XHR
application/json 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.ghacks.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1215d4981afb248c13294b152d9f8366af3b5bda4c670fdff59ec2a62b4fba3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 415
x-xss-protection: 0
expires: Fri, 23 Jun 2023 02:36:07 GMT

GET
H2 200 sdk.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js Show response
sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/ 312 KB
78 KB 52ms
15ms Script
application/javascript 2600:9000:2510:c600:5:b7cc:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/sdk.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js
Requested by: Host: sdk.privacy-center.org
URL: https://sdk.privacy-center.org/a8ff32f4-78c7-4428-825d-0badb488b68b/loader.js?target=www.ghacks.net
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2510:c600:5:b7cc:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a558ceae2f0ab0ad8a509bf14731225828b3c4fec3e07169da9d5a9259cb216d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 07:39:19 GMT
content-encoding: gzip
via: 1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
last-modified: Wed, 21 Jun 2023 07:34:50 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1687332584/ctime:1687332584/gid:0/gname:root/md5:437042dea76567c00952101e6322af49/mode:33188/mtime:1687332584/uid:0/uname:root
x-amz-cf-pop: JFK50-P5
age: 154609
etag: W/"437042dea76567c00952101e6322af49"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-cf-id: woZZLGbam-GOmnPPjFi9Yj27UHtxSW4GKSQRoN6VJLamEYk11Ec5Jw==

GET
H2 200 908872676891328 Show response
connect.facebook.net/signals/config/ 300 KB
86 KB 16ms
12ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/908872676891328?v=2.9.108&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e477cf8c725f201e70140a5806a96b2b62fb58e92ae48b107b8129d952f5b163

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 23 Jun 2023 02:36:07 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87896
x-xss-protection: 0
pragma: public
x-fb-debug: 5gmpwKuvtsn0QbFqTyfXkGT8R1pZIKB/0GcAg+KZvLfvq7HZyvFozDseiiVjBfSIN/hJdNmXK/JHhkuhb4HAyg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 google-amp_02.jpg
www.ghacks.net/wp-content/uploads/2023/05/ 82 KB
82 KB 539ms
538ms Image
image/jpeg 2606:4700:20::681a:fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ghacks.net/wp-content/uploads/2023/05/google-amp_02.jpg

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:fa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e03c4dee893e4ab667b0e92e791bd76021c03a88925e4a6124e0115372b85d55

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 83942
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Wed, 10 May 2023 13:22:09 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tql46IIPKLkqVQx83ocpEorYHs8ZHkzzBSSI9EhVRbP3m7557y5rNUYJT5VvckwxIYHeLQMRdYo9s4lBcvNGscebH%2BN%2FQE0pdtFfmMpCGBsbMsuvh%2BKBiWfW%2FogB2OvB%2BjPQ7tVXf5u5nsr6"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=10368000
accept-ranges: bytes
cf-ray: 7db9577289ac8c77-EWR
expires: Sat, 21 Oct 2023 02:36:07 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 57ms
24ms Script
text/javascript 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NHW6RDK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 23 Jun 2023 02:11:08 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 1499
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 23 Jun 2023 04:11:08 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 121 KB
47 KB 57ms
56ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-168915890-36&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NHW6RDK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8b1c82489e8159cfca9f526728dac376344c2f5f22cbb79197fef12807d10660

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47914
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Jun 2023 02:36:07 GMT

GET
DATA 200
OK truncated
/ 371 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f170e41fd143aba25a29a7f83762ca400d552d00ec7657c4fb0f2c7f31ef3e7

Request headers

Referer
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H2 200 GenerateAudioDocStream Show response
readaloud.googleapis.com/$rpc/google.search.readaloud.v1.ReadAloudService/ 5 KB
3 KB 128ms
121ms XHR
application/x-protobuf 2607:f8b0:4006:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://readaloud.googleapis.com/$rpc/google.search.readaloud.v1.ReadAloudService/GenerateAudioDocStream

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/readaloud/player/web/api/js/api.js?ver=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

526dab3da70b8c4ab1f8856129d2edb37b7897b8ff88f83e2ad684553a9f7b2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
accept-language: en-US,en;q=0.9
Authorization
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-protobuf
X-Goog-FieldMask: metadata,text,image
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
X-Goog-Api-Key: AIzaSyAk4mlRyaxd3TYwnoVAE8fPiIZHzZ9gaaQ
X-Goog-AuthUser
X-Accept-Content-Transfer-Encoding: base64

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/x-protobuf
access-control-allow-origin: https://www.ghacks.net
access-control-expose-headers: content-transfer-encoding,content-disposition,vary,vary,vary,content-encoding,transfer-encoding,date,server
cache-control: private
content-transfer-encoding: base64
content-disposition: attachment
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 639 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02879cae62ad89aabb9030bdeec952a3004c2bcb6453d21bfd50c6c4743f5080

Request headers

Referer
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e2b1a7f14cb9db010e10b9e983aab0c2e619a529ea7f29d8a310a032c8ef5e54

Request headers

Referer
Origin: https://www.ghacks.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

OPTIONS
H2 200 GenerateAudioDocStream
readaloud.googleapis.com/$rpc/google.search.readaloud.v1.ReadAloudService/ Frame 0
0 342ms
60ms Preflight
text/html 2607:f8b0:4006:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://readaloud.googleapis.com/$rpc/google.search.readaloud.v1.ReadAloudService/GenerateAudioDocStream

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-accept-content-transfer-encoding,x-goog-api-key,x-goog-authuser,x-goog-fieldmask,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type,x-accept-content-transfer-encoding,x-goog-api-key,x-goog-authuser,x-goog-fieldmask,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Fri, 23 Jun 2023 02:36:08 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 70ms
22ms XHR
application/javascript 108.138.107.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-107-138.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 21:46:59 GMT
x-amz-version-id: Zm_tZQQ808JKRizBfXGgSN2OWn8Z6JUU
content-encoding: gzip
via: 1.1 01b6e75b22243ae76d6d282c014927c6.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P3
age: 17350
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 26 May 2023 01:35:48 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: 6dXymrR2fP6OtHi-5xj2n6CDQ7YLqfbyN0Wo8VMQOYgQWSA2cHLYRw==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 470 B
821 B 45ms
45ms XHR
application/json 108.138.107.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3177&u=https%3A%2F%2Fwww.ghacks.net
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-107-138.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 8117ea09b5caab594dd88ba8826f107ef9f3a5f91e36b1f89672b03dc33ae48e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:07 GMT
via: 1.1 44ffe5f6f95421818455d39547956aa4.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P3
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.ghacks.net
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 470
x-amz-cf-id: RsP78Ai-mV1DpoSmvfm-YPQqxi-0rPsiJkXWTM5FiQFOAo3qkhSPnw==

GET
H2 204 state Show response
api.btloader.com/mw/ 0
101 B 92ms
43ms Fetch 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/mw/state?bt_env=prod
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 23 Jun 2023 02:36:08 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
933 B 108ms
36ms Image
image/gif 2606:4700:20::681a:346
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:346 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 675127
x-guploader-uploadid: ADPycdt08VwXe-9ohPV0Pfv2L0-yvbdQYgebwIIOBqa-7OgcrXlQGXs4pzrW8madIeZ4RwjneVpt_E5rKKVJ2ZUcwCmwxQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=acsu%2B%2BBJ20sXCFgaiVs9bre5Dcoed7YTBZsdKzIkTVHsQrJrEmFJmgwISMRlc%2BAUCoVXwiSLDYrILjGYWOPPlBuZGaVDpLOCTmo40e%2B35il5WMMcjiN5Mgab%2BJ%2BCnMTK5a8nnMcHiIF1gr7nnA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7db957768d934337-EWR
expires: Thu, 15 Jun 2023 08:03:34 GMT

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
571 B 81ms
13ms Image
image/x-icon 142.251.35.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 03:57:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81507
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 03:57:41 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
342 B 111ms
40ms Image
image/gif 2606:4700:20::681a:346
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.4605253628387538
Requested by: Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:346 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 675127
x-guploader-uploadid: ADPycdt08VwXe-9ohPV0Pfv2L0-yvbdQYgebwIIOBqa-7OgcrXlQGXs4pzrW8madIeZ4RwjneVpt_E5rKKVJ2ZUcwCmwxQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3nC8miiwbuDa9u835Mqz7BUXBZIDRWWZ1ePb7U2I1g4w7R7DhRBw7lQH2bousnwuqGNX8QVUySWiHEw6tOJuNjChcMsAf4kjlED46I%2FMoZ%2Be%2FKTI17fKr%2F7Xdm8WWe5eqrGUW5D%2FnpmF57lrkA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7db957768d974337-EWR
expires: Thu, 15 Jun 2023 08:03:34 GMT

GET
H2 200 current Show response
api.privacy-center.org/v1/locations/ 40 B
540 B 100ms
100ms XHR
application/json 2600:9000:2512:a200:d:2044:5c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.privacy-center.org/v1/locations/current?fields[]=country_code&fields[]=region_code

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2512:a200:d:2044:5c40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

55905f7b3c0cb367751791a71d4c4c6518d40275f764685a0cbf00ffec6a8804

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 cd1a98ac42a21b663c8fc8cd6f37232e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P7
x-dns-prefetch-control: off
x-cache: Miss from cloudfront
content-length: 40
x-xss-protection: 1; mode=block
etag: W/"28-wHiac1ydCP02hf5BtPgUzN+Jpvs"
x-download-options: noopen
x-frame-options: SAMEORIGIN
allow: GET
content-type: application/json; charset=utf-8
vary: Accept
access-control-allow-origin: *
cache-control: max-age=3600, private
x-amz-cf-id: do_pS40OrEfGWtEVvgTXwtcWFJi76mMucTqV9lsdfafn7MwG8tPRGg==

OPTIONS
H2 204 current
api.privacy-center.org/v1/locations/ Frame 0
0 189ms
98ms Preflight 2600:9000:2512:a200:d:2044:5c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.privacy-center.org/v1/locations/current?fields[]=country_code&fields[]=region_code
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2512:a200:d:2044:5c40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
access-control-max-age: 86400
date: Fri, 23 Jun 2023 02:36:08 GMT
vary: Access-Control-Request-Headers
via: 1.1 cd1a98ac42a21b663c8fc8cd6f37232e.cloudfront.net (CloudFront)
x-amz-cf-id: cNV9yozz-_8EqOz9-9SPHUzTCpuNxfi9XKTKPj6RG3AuZWY0qCKlQQ==
x-amz-cf-pop: JFK50-P7
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 65ms
17ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=908872676891328&ev=PageView&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&rl=&if=false&ts=1687487768143&sw=1600&sh=1200&v=2.9.108&r=stable&ec=0&o=30&fbp=fb.1.1687487768138.1086050992&it=1687487767298&coo=false&rqm=GET

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 23 Jun 2023 02:36:08 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
209 B 23ms
21ms XHR
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1551311643&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&ul=en-us&de=UTF-8&dt=Google%27s%20.zip%20Top%20Level%20domain%20is%20already%20used%20in%20phishing%20attacks%20-%20gHacks%20Tech%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=39718407&gjid=1061009858&cid=11174963.1687487768&tid=UA-111230-1&_gid=1361327954.1687487768&_r=1&_slc=1&gtm=45He36l0n81NHW6RDK&z=1117602837

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ghacks.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 20ms
19ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1551311643&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&dr=&ul=en-us&de=UTF-8&dt=&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=6OBAAUABAAAAACgDIE~&cid=1717480208.1687487767&tid=UA-168915890-36&_gid=1514233853.1687487768&gtm=457e36l0&z=1458720619

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 05:35:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 75648
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 20ms
19ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1551311643&t=event&_s=2&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&dr=&ul=en-us&de=UTF-8&dt=&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=GoogleReadAloudPlayer&ea=load&el=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&_u=6OBAAUABAAAAACgDIEC~&cid=1717480208.1687487767&tid=UA-168915890-36&_gid=1514233853.1687487768&gtm=457e36l0&cm1=1&z=1433293838

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 05:35:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 75648
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 101 KB
25 KB 81ms
20ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd08be9cbf5f35486ce3011abc8286e9e2f59ac1de1ff9840377332383263f19

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Jun 2023 08:35:03 GMT
server: cloudflare
x-amz-request-id: F364NC7NSZSQHBYX
age: 2718
etag: W/"bb626f116ff54963039a9ea05c53620b"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7db95778b8da429f-EWR
x-amz-id-2: 3t88lwhmRfjzGXa6aBSUuv5hXX/EY5JMQnMFLxHSCDmO7ht0Z7uCN01tpZHL/fbCQqhKlgAdjVY=

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 137 B
577 B 393ms
273ms XHR
text/javascript 108.138.126.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&pid=ZIflKO4hbMrF6&cb=0&ws=1600x1200&v=23.612.1758&t=1200&slots=%5B%7B%22sd%22%3A%22snhb-snhb_ghacks_sidebar_top-0__ad%22%2C%22s%22%3A%5B%22336x375%22%2C%22336x280%22%2C%22300x600%22%2C%22300x500%22%2C%22300x450%22%2C%22300x360%22%2C%22300x337%22%2C%22300x300%22%2C%22300x280%22%2C%22300x250%22%2C%22300x180%22%2C%22300x150%22%2C%22250x250%22%2C%22200x320%22%2C%22200x300%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FATF_MPU_First%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1524862513262-0__ad%22%2C%22s%22%3A%5B%22550x309%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FBTF_OOP_Seethrough%22%7D%2C%7B%22sd%22%3A%22snhb-sidebar_01-0__ad%22%2C%22s%22%3A%5B%22336x375%22%2C%22336x280%22%2C%22300x600%22%2C%22300x500%22%2C%22300x450%22%2C%22300x360%22%2C%22300x337%22%2C%22300x300%22%2C%22300x280%22%2C%22300x250%22%2C%22300x180%22%2C%22300x150%22%2C%22250x250%22%2C%22200x320%22%2C%22200x300%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FBTF_MPU_First%22%7D%2C%7B%22sd%22%3A%22snhb-snhb_ghacks_top-0__ad%22%2C%22s%22%3A%5B%22980x250%22%2C%22980x90%22%2C%22970x250%22%2C%22970x170%22%2C%22970x100%22%2C%22970x90%22%2C%22960x90%22%2C%22950x90%22%2C%22790x250%22%2C%22750x200%22%2C%22750x100%22%2C%22728x250%22%2C%22728x170%22%2C%22728x90%22%2C%22500x250%22%2C%22500x90%22%2C%22468x90%22%2C%22468x60%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FATF_Leaderboard_First%22%7D%2C%7B%22sd%22%3A%22snhb-sidebar_02-0__ad%22%2C%22s%22%3A%5B%22336x375%22%2C%22336x280%22%2C%22300x600%22%2C%22300x500%22%2C%22300x450%22%2C%22300x360%22%2C%22300x337%22%2C%22300x300%22%2C%22300x280%22%2C%22300x250%22%2C%22300x180%22%2C%22300x150%22%2C%22250x250%22%2C%22200x320%22%2C%22200x300%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F5302%2Fdesktop%2Fghacks-desktop-en%2FGH-Features%2FGH-Articlepage%2FBTF_MPU_Second%22%7D%5D&gdprl=%7B%22status%22%3A%22tcfv2-timeout%22%7D

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.126.121 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-126-121.jfk50.r.cloudfront.net

Software

Server /

Resource Hash

80cd4bb42ae5db873104aef0b9cb4f6e55d72ea7440eae108640d9779d258c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 eabcac050cde7358c94fc7ecf124ea4a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P4
x-amz-rid: E7507VR09T7G4MKDJ9MZ
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 137
x-amz-cf-id: llI7CTFewdIUSfBfgHiS_7RnlyGpEwh70CloWZj1xRG3kh7EwgxMGw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 137 B
576 B 390ms
275ms XHR
text/javascript 108.138.126.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.126.121 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-126-121.jfk50.r.cloudfront.net

Software

Server /

Resource Hash

ec7021417bccc9935ae1720f04f406f19180c7db0345c9c190167273b8dbabeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 eabcac050cde7358c94fc7ecf124ea4a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P4
x-amz-rid: RVD1GXTEM9JBKY99R9V3
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 137
x-amz-cf-id: QsDAUSVy-q1R4UYzlEOYubMzhcyHW10Ud8Ape28fVc5aErckHLGmJw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 137 B
577 B 379ms
272ms XHR
text/javascript 108.138.126.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.126.121 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-126-121.jfk50.r.cloudfront.net

Software

Server /

Resource Hash

18bea37622937ec27c9d10bb5fc1e49f747260846281dde3cb1890b24d70e079

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 eabcac050cde7358c94fc7ecf124ea4a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: JFK50-P4
x-amz-rid: 1G7F77N9GZC7250M79H0
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 137
x-amz-cf-id: t4Ggl_7Hws8JoQ3zxhDZS5GPHVkXx27bCuLC05BmO4PUHUtpIKEcmQ==

GET
H2 200 ui-gdpr-en-web.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js Show response
sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/ 227 KB
48 KB 18ms
17ms Script
application/javascript 2600:9000:2510:c600:5:b7cc:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/ui-gdpr-en-web.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js
Requested by: Host: sdk.privacy-center.org
URL: https://sdk.privacy-center.org/sdk/5272f7a23d08ceb27ae3ce27e030111ddd13b4b4/modern/sdk.5272f7a23d08ceb27ae3ce27e030111ddd13b4b4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2510:c600:5:b7cc:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 30c47497e599dc8a9c75d6919a956a9e289140c64d7ab7018885722be1ac8fcf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 07:39:36 GMT
content-encoding: gzip
via: 1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
last-modified: Wed, 21 Jun 2023 07:35:05 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1687332584/ctime:1687332584/gid:0/gname:root/md5:cd0b8cb55802f0359dc96dfb50e803b5/mode:33188/mtime:1687332584/uid:0/uname:root
x-amz-cf-pop: JFK50-P5
age: 154593
etag: W/"cd0b8cb55802f0359dc96dfb50e803b5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-cf-id: njQ4-2qc7edqzJCcVzsG29fzRwjZ3xdMH9hKg5xq7i4u9hSs2U1UHw==

GET
H2 200 country Show response
api.btloader.com/ 16 B
132 B 46ms
38ms Fetch
application/json 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/country
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 30c714bf4216e577686d238b98561d093672cb25bf90baab50dd956f75cda4b3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:08 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: *
cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16

GET
H2 204 pv Show response
api.btloader.com/ 0
66 B 46ms
46ms XHR
text/plain 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=kHadhKtlm6&w=5874461553721344&o=5633429348548608&cv=2.1.13-15-g6498499&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&sid=XcKy9GeK&upapi=true
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 23 Jun 2023 02:36:08 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 2 B
347 B 86ms
29ms XHR
text/plain 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-111230-1&cid=11174963.1687487768&jid=39718407&gjid=1061009858&_gid=1361327954.1687487768&_u=YEBAAEAAAAAAACAAI~&z=1402346461

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 23 Jun 2023 02:36:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ghacks.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 26ms
23ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1551311643&t=event&_s=3&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&dr=&ul=en-us&de=UTF-8&dt=&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=GoogleReadAloudPlayer&ea=firstView&el=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&_u=6OBAAUABAAAAACgDIEC~&cid=1717480208.1687487767&tid=UA-168915890-36&_gid=1514233853.1687487768&gtm=457e36l0&z=1286529051

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 05:35:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 75649
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 1B8A
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t

307 B
1 KB

45ms
45ms

Document
text/html

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

991af7dd3de951ca288e28e445bb9bea1787505ee067ff4d871964c216fc430d

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 307
Content-Type: text/html;charset=ISO-8859-1
Date: Fri, 23 Jun 2023 02:36:09 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: JGS9H5QB7S516GKPBGBR

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:09 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: K6Z2YW4WHD20ZA0KJ5CK

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 3B4A 0
72 B 29ms
28ms Document
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.ghacks.net
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.ghacks.net
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 02:36:09 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 75ms
27ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-111230-1&cid=11174963.1687487768&jid=39718407&_u=YEBAAEAAAAAAACAAI~&z=364784114

Requested by

Host: www.ghacks.net
URL: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 0C77 2 KB
3 KB 22ms
22ms Document
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

e568aab220beacccf405acfe23505a3ed107e0ea7890b7270570251dde211fa0

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 2137
Content-Type: text/html;charset=ISO-8859-1
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: CVRGTT7YEHFSHXNRR3WH

GET
H2 200 settings Show response
notix.io/ 73 B
326 B 96ms
96ms Fetch
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/settings?appId=100463775616ecb625f0290cd8eaf73&ver=0.11.0

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

a184d88796612148bc44440e8ac2a264e745e8f3774a82e2e3219c079134ac45

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:02 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 73

POST
H2 200 event
notix.io/ 15 B
268 B 94ms
93ms Ping
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/event

Requested by

Host: notix.io
URL: https://notix.io/ent/current/enot.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:02 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 15

OPTIONS
H2 200 event
notix.io/ Frame 0
0 265ms
87ms Preflight
text/plain 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/event
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 23 Jun 2023 02:36:02 GMT
server: nginx

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 0C77
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1687487770146
https://ad.turn.com/r/cs?pid=45&rndcb=2192153305
https://sync.1rx.io/usersync/turn/3195108133375671054?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-ddc61c9a-6b88-467e-8e84-53dfcb9d06b3-005?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-ddc61c9a-6b88-467e-8e84-53df...
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-ddc61c9a-6b88-467e-8e84-53dfcb9d06b3-005

43 B
479 B

23ms
22ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-ddc61c9a-6b88-467e-8e84-53dfcb9d06b3-005

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: CN8EGH4F06XH87VBCG97
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Tengine
ETag: RXddc61c9a6b88467e8e8453dfcb9d06b3005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-ddc61c9a-6b88-467e-8e84-53dfcb9d06b3-005
Content-Type: text/html
Connection: keep-alive

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame 8D48 4 KB
2 KB 138ms
19ms Document
text/html 3.225.218.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.218.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-218-40.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b25051621b8bf3eab8c8cb77d2666a131b4923a6c29ca39174029581c52957a7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 23 Jun 2023 02:36:10 GMT
etag: W/"05929296759c9cd91f82f418e89c82cb2"
server: nginx
timing-allow-origin: *

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame 73DB
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

2 KB
3 KB

15ms
13ms

Document
text/html

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 49c02bdd77f8e01a79baa8439e417e92530c03e67ff1b6d415fb885945621ff8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1917
Content-Type: text/html
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Keep-Alive: timeout=1, max=499
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

Redirect headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
Location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9CA8 16 KB
6 KB 60ms
20ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=123960
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Fri, 23 Jun 2023 02:36:10 GMT
expires: Sat, 24 Jun 2023 13:02:10 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame B787 281 B
554 B 77ms
22ms Document
text/html 104.127.172.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-127-172-242.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 23 Jun 2023 02:36:10 GMT
ETag: "40010-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame 26B1
Redirect Chain

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX...

693 B
732 B

33ms
32ms

Document
text/html

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 8b5b8c8b7357c754bdd95a0bf815c2b54106be0307253ced679b8c42ac5a7cc9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 400
content-type: text/html
date: Fri, 23 Jun 2023 02:36:10 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 23 Jun 2023 02:36:10 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
via: 1.1 google

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 7380
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=507124677645352015&gdpr=0&gdpr_consent=

43 B
479 B

82ms
42ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=507124677645352015&gdpr=0&gdpr_consent=

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: W6WG12K04E5NBKW1AQNC

Redirect headers

content-length: 0
date: Fri, 23 Jun 2023 02:36:10 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=507124677645352015&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 8D59
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2240945551553324476182

43 B
479 B

28ms
27ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2240945551553324476182

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 0EK532DR9Q0XT2FS0RXY

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Fri, 23 Jun 2023 02:36:10 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2240945551553324476182
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

POST
H2 200 event
notix.io/ 15 B
268 B 91ms
89ms Ping
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/event

Requested by

Host: notix.io
URL: https://notix.io/ent/current/enot.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:02 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 15

OPTIONS
H2 200 event
notix.io/ Frame 0
0 94ms
93ms Preflight
text/plain 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/event
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 23 Jun 2023 02:36:02 GMT
server: nginx

POST
H2 200 event
notix.io/ 15 B
268 B 164ms
162ms Ping
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/event

Requested by

Host: notix.io
URL: https://notix.io/ent/current/enot.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:02 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 15

POST
H2 200 event
notix.io/ 15 B
268 B 169ms
167ms Ping
application/json 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://notix.io/event

Requested by

Host: notix.io
URL: https://notix.io/ent/current/enot.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 02:36:02 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ghacks.net
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 15

OPTIONS
H2 200 event
notix.io/ Frame 0
0 90ms
83ms Preflight
text/plain 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/event
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 23 Jun 2023 02:36:02 GMT
server: nginx

OPTIONS
H2 200 event
notix.io/ Frame 0
0 89ms
84ms Preflight
text/plain 139.45.240.92
RUBY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://notix.io/event
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.240.92 , Russian Federation, ASN57304 (RUBY-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ghacks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.ghacks.net
access-control-max-age: 86400
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 23 Jun 2023 02:36:02 GMT
server: nginx

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame B787 34 KB
10 KB 37ms
36ms Script
text/html 104.127.172.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-127-172-242.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: fe27a67c0f975890e91c739a541aea039450017d92a83598d4510429bbbde288

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 02:36:10 GMT
Content-Encoding: gzip
Last-Modified: Fri, 23 Jun 2023 01:30:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=82500
Connection: keep-alive
Content-Length: 10113
Expires: Sat, 24 Jun 2023 01:31:10 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dapn%26i%3D%24UID
https://usersync.gumgum.com/usersync?b=apn&i=2314681699185709474

35 B
250 B

511ms
44ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=2314681699185709474
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Date: Fri, 23 Jun 2023 02:36:10 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 5.181.234.134; 5.181.234.134; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: a4f67a2f-b63b-4ee4-a14b-662bf88fe037
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://usersync.gumgum.com/usersync?b=apn&i=2314681699185709474
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&gdpr=&gdpr_consent=&us_privacy=
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=1b3bf3a9-a15b-4cf6-b005-9da6815cb966&ssp=gumgum2&expires=30&user_group=5&bsw_param=d083ad98-f0e3-4de4-b3e5-06f02856f38d
https://usersync.gumgum.com/usersync?b=bsw&i=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=&us_privacy=

35 B
250 B

36ms
29ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=&us_privacy=
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 8D48
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRd...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28eMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&obuid=ENC(eMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP)
https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51
https://s.ad.smaato.net/c/?adExInit=o&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmaato%26uid%3D%24UID%26obUid%3DeMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP%26gd...
https://sync.outbrain.com/cookie-sync?p=smaato&uid=47b0bd4&obUid=eMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&ini...

0
145 B

16ms
15ms

Image
text/plain

70.42.32.223
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=smaato&uid=47b0bd4&obUid=eMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 70.42.32.223 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: no-cache
X-TraceId: 1d9c3a1a4f5230d29b27ecaf56a80924
Content-Length: 0

Redirect headers

date: Fri, 23 Jun 2023 02:36:11 GMT
via: 1.1 6a2d00c5c73022efc4bc2786f44b3cdc.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: EWR53-P1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.outbrain.com/cookie-sync?p=smaato&uid=47b0bd4&obUid=eMSoIOv0enLqqb5-FDGAnV2YKVNQo7tCvttVYcACXswrpLSRl-03lzxewZuej6YP&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: qfC4xbwTrrVNZdQ1LQ_0iwDlN0M91jU8S796BC_Mh9jISciSyahNKA==

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=cac0f6ff-4205-050a-1f6b-b269d1fae803

35 B
250 B

538ms
41ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=cac0f6ff-4205-050a-1f6b-b269d1fae803
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 23 Jun 2023 02:36:10 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=cac0f6ff-4205-050a-1f6b-b269d1fae803
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-4ec415cb-95e1-538d-6230-0ad19cdf4f4a$ip$5.181.234.134

35 B
250 B

517ms
37ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-4ec415cb-95e1-538d-6230-0ad19cdf4f4a$ip$5.181.234.134
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-4ec415cb-95e1-538d-6230-0ad19cdf4f4a$ip$5.181.234.134
Date: Fri, 23 Jun 2023 02:36:10 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-Pbk0UvhE2pdH_yHrNngXCmJLQ1bMMyPEItwz~A

35 B
250 B

542ms
42ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-Pbk0UvhE2pdH_yHrNngXCmJLQ1bMMyPEItwz~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 23 Jun 2023 02:36:10 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-Pbk0UvhE2pdH_yHrNngXCmJLQ1bMMyPEItwz~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%...
https://usersync.gumgum.com/usersync?b=vnt&i=582f5e29-0699-4a31-a424-ccc0c640626a

35 B
250 B

515ms
35ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=582f5e29-0699-4a31-a424-ccc0c640626a
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=582f5e29-0699-4a31-a424-ccc0c640626a
Date: Fri, 23 Jun 2023 02:36:10 GMT
Connection: keep-alive
X-CI-RTID: 5702e09b-3197-4b39-ad72-a9f266770aab
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=6C9509C18A274A72AA6720B9342CCB7A

35 B
250 B

539ms
39ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=6C9509C18A274A72AA6720B9342CCB7A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 23 Jun 2023 02:36:10 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 39653423
location: https://usersync.gumgum.com/usersync?b=snc&i=6C9509C18A274A72AA6720B9342CCB7A
access-control-allow-origin: https://rtb.gumgum.com/
access-control-allow-credentials: true
content-length: 0

GET
H2 200 142
match.deepintent.com/usersync/ Frame 8D48 0
222 B 148ms
41ms Image
image/gif 38.91.45.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 23 Jun 2023 02:36:10 GMT
server: a
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=lvbBgY938I3hSZR8CkVq&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTJHVWHMYSCM5MTSMZYJEZWQU22KI4EG22WOE
https://usersync.gumgum.com/usersync?b=zem&i=lvbBgY938I3hSZR8CkVq

35 B
250 B

29ms
28ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=lvbBgY938I3hSZR8CkVq
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&i=lvbBgY938I3hSZR8CkVq
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 92
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=4ae05c80-c319-4767-a4df-5bcc83899ea8

35 B
250 B

34ms
30ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=4ae05c80-c319-4767-a4df-5bcc83899ea8
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=4ae05c80-c319-4767-a4df-5bcc83899ea8
access-control-allow-origin: *
date: Fri, 23 Jun 2023 02:36:10 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=wwyVaIRIrOpg&ev=1&pid=558355

35 B
250 B

51ms
48ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=wwyVaIRIrOpg&ev=1&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://usersync.gumgum.com/usersync?b=pln&i=wwyVaIRIrOpg&ev=1&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-stage-0
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 8D48
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=507124677645352015

35 B
250 B

40ms
35ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=507124677645352015
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=507124677645352015
date: Fri, 23 Jun 2023 02:36:10 GMT
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 8D48 43 B
479 B 51ms
50ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: JFZTN79E68YA48C6KWDD
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 9CA8 2 KB
2 KB 851ms
160ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=75702557&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 1eeef11fdd90d582c5e2441e34050173f563ca39eef1e914c79d871beec76641

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 23 Jun 2023 02:36:10 GMT
content-length: 1573
content-type: text/html; charset=UTF-8

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 6136
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=db226495-051a-4000-a988-5c7e629ad986&gdpr=&gdpr_consent=

35 B
250 B

83ms
38ms

Document
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=db226495-051a-4000-a988-5c7e629ad986&gdpr=&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: Fri, 23 Jun 2023 02:36:09 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 1031 59fd23a master ord ord-pixel-x50 config_version:"1969"
location: https://usersync.gumgum.com/usersync?b=mmh&i=db226495-051a-4000-a988-5c7e629ad986&gdpr=&gdpr_consent=

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 73DB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJUFGtNgPQ6lXIQH-YIvTAAADh4AAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm=&google_hm=ZJUFGtNgPQ6lXIQH-YIvTAAADh4AAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=&google_tc=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEBGoA9_BgUA-SGBEHNs9EIg&google_cver=1

43 B
766 B

16ms
15ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEBGoA9_BgUA-SGBEHNs9EIg&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEBGoA9_BgUA-SGBEHNs9EIg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 73DB
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJUFGtNgPQ6lXIQH.YIvTAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAlyHRGyOgie1YJxHF_ZGRI&google_cver=1&google_hm=2

43 B
632 B

17ms
15ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAlyHRGyOgie1YJxHF_ZGRI&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAlyHRGyOgie1YJxHF_ZGRI&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 73DB
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://match.adsrvr.org/track/cmb/casale?
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&expiration=1690079770&gdpr=0&gdpr_consent=

43 B
632 B

80ms
27ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&expiration=1690079770&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&expiration=1690079770&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 73DB 43 B
855 B 54ms
33ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZJUFGtNgPQ6lXIQH-YIvTAAADh4AAAAB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: BFSY9VZA3FKATWT8PGZ5
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 73DB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=ZJUFGgATy18NjQBL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJUFGgATy18NjQBL&_test=ZJUFGgATy18NjQBL

43 B
632 B

34ms
33ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJUFGgATy18NjQBL&_test=ZJUFGgATy18NjQBL
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

x-served-by: cache-lga21926-LGA
pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1687487771.525041,VS0,VE0
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJUFGgATy18NjQBL&_test=ZJUFGgATy18NjQBL
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 73DB
Redirect Chain

https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703298970&external_user_id=04cd3886-d7e5-4626-b584-b32c59343b7b

43 B
632 B

79ms
31ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703298970&external_user_id=04cd3886-d7e5-4626-b584-b32c59343b7b
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

date: Fri, 23 Jun 2023 02:36:10 GMT
via: 1.1 google
access-control-allow-methods: GET,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *.casalemedia.com
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703298970&external_user_id=04cd3886-d7e5-4626-b584-b32c59343b7b
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 157

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 73DB
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=f2d851c3-77e7-43d1-926b-5bfdd10b1764&expiration=1719110170

43 B
632 B

39ms
31ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=f2d851c3-77e7-43d1-926b-5bfdd10b1764&expiration=1719110170
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=f2d851c3-77e7-43d1-926b-5bfdd10b1764&expiration=1719110170
Date: Fri, 23 Jun 2023 02:36:10 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 73DB
Redirect Chain

https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=46a11ea3-841d-4501-bdde-d15eb10abe6f&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null

43 B
632 B

30ms
28ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=46a11ea3-841d-4501-bdde-d15eb10abe6f&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=46a11ea3-841d-4501-bdde-d15eb10abe6f&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
date: Fri, 23 Jun 2023 02:36:10 GMT
server: _
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 73DB 43 B
479 B 59ms
39ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZJUFGtNgPQ6lXIQH-YIvTAAADh4AAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: TS1FWQ7HPKY4PBTWV6EJ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 26B1 43 B
479 B 43ms
34ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=652b2ef2-76ba-86a6-b81e-2013719922a5

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QMK9VSDGYFJCHSPK2PM6
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 a93a34cb-fabc-af15-49c7-b471e6fd240c
pr-bh.ybp.yahoo.com/sync/openx/ Frame 26B1 43 B
601 B 87ms
33ms Image
image/gif 2600:1f18:4e9:5a07:6454:8b0d:b7ff:750
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/a93a34cb-fabc-af15-49c7-b471e6fd240c?gdpr=0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:6454:8b0d:b7ff:750 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:10 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 26B1 43 B
855 B 147ms
38ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=652b2ef2-76ba-86a6-b81e-2013719922a5

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 5ZBJ1FK530RTGVFJDNJE
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 26B1
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=3dfd528f-6a10-3d5c-7810-a28419aae945&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=3dfd528f-6a10-3d5c-7810-a28419aae945&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&ttd_puid=3dfd528f-6a10-3d5c-7810-a28419aae945&gdpr=0&gdpr_consent=

43 B
62 B

49ms
41ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&ttd_puid=3dfd528f-6a10-3d5c-7810-a28419aae945&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&ttd_puid=3dfd528f-6a10-3d5c-7810-a28419aae945&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 26B1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTE5MjgxNDUtYTM2Ny02M2Y4LTZkZjAtZjgzZGQzNDgyNzI1
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTE5MjgxNDUtYTM2Ny02M2Y4LTZkZjAtZjgzZGQzNDgyNzI1&google_tc=

170 B
243 B

43ms
39ms

Image
image/png

142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTE5MjgxNDUtYTM2Ny02M2Y4LTZkZjAtZjgzZGQzNDgyNzI1&google_tc=

Requested by

Protocol

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTE5MjgxNDUtYTM2Ny02M2Y4LTZkZjAtZjgzZGQzNDgyNzI1&google_tc=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 26B1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPo2tk2X1KwsR2-lysYNqlY&google_cver=1

43 B
61 B

36ms
34ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPo2tk2X1KwsR2-lysYNqlY&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPo2tk2X1KwsR2-lysYNqlY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 400
Bad Request user-sync Show response
sync.adkernel.com/ Frame 13E3 22 B
192 B 162ms
23ms Document
text/plain 174.137.133.32
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=&gdpr_consent=&ccpa=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: 4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 22
Date: Fri, 23 Jun 2023 02:36:10 GMT
Pragma: no-cache
Server: nginx

GET
H2

200

URnmbSKM Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame E67E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=&_test=ZJUFGgATww5K6QAn

85 B
159 B

27ms
27ms

Document
image/png

151.101.2.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=&_test=ZJUFGgATww5K6QAn
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 250
cache-control: no-cache
content-length: 85
content-type: image/png
date: Fri, 23 Jun 2023 02:36:10 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 907
x-served-by: cache-lga21926-LGA
x-timer: S1687487771.826257,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Fri, 23 Jun 2023 02:36:10 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=&_test=ZJUFGgATww5K6QAn
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-lga21926-LGA
x-timer: S1687487770.430742,VS0,VE8

GET
H3

200

pixel Show response
cm.g.doubleclick.net/ Frame 6F93
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV8zNGE5Y2YyMi1iZGY5LTQzY2MtYTdhMy1iM2M5NmQ4ZTEyYmE=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync...
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV8zNGE5Y2YyMi1iZGY5LTQzY2MtYTdhMy1iM2M5NmQ4ZTEyYmE=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync...

170 B
188 B

119ms
92ms

Document
image/png

142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV8zNGE5Y2YyMi1iZGY5LTQzY2MtYTdhMy1iM2M5NmQ4ZTEyYmE=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv&google_tc=

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 02:36:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 435
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 02:36:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV8zNGE5Y2YyMi1iZGY5LTQzY2MtYTdhMy1iM2M5NmQ4ZTEyYmE=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv&google_tc=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9B77 16 KB
6 KB 55ms
40ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=123960
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Fri, 23 Jun 2023 02:36:10 GMT
expires: Sat, 24 Jun 2023 13:02:10 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame CEB5
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=5eebcfb8-e278-488f-b8a2-8e2c72e8342a

35 B
250 B

44ms
35ms

Document
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=5eebcfb8-e278-488f-b8a2-8e2c72e8342a
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Fri, 23 Jun 2023 02:36:10 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=5eebcfb8-e278-488f-b8a2-8e2c72e8342a
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame ED06
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s8AANhrMPYAAAAA

35 B
250 B

28ms
27ms

Document
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s8AANhrMPYAAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:11 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=ZJUFG8Co5s8AANhrMPYAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 2
X-SO-Cluster-ID: 0
X-SO-HostName: m-ad236.dc4p.scaleout.jp
X-SO-IP: 5.181.234.134
X-SO-Key: ZJUFG8Co5s8AANhrMPYAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"5.181.234.134","key":"ZJUFG8Co5s8AANhrMPYAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad236"}
X-SO-LB-Hostname: a-tgng40011.dc2p.scaleout.jp
X-SO-Upstream-ID: m-ad236

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame D3F1
Redirect Chain

https://cs.admanmedia.com/sync/gumgum?puid=u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=&gdpr_consent=&ccpa=
https://usersync.gumgum.com/usersync?b=aad&i=e9c2641c-16df-4241-b89f-acb98e5dda9f

35 B
250 B

46ms
37ms

Document
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=aad&i=e9c2641c-16df-4241-b89f-acb98e5dda9f
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Location: https://usersync.gumgum.com/usersync?b=aad&i=e9c2641c-16df-4241-b89f-acb98e5dda9f
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Transfer-Encoding: chunked
X-Frame-Options: DENY

GET
H/1.1 200
OK usermatchredir Show response
ssum-sec.casalemedia.com/ Frame 6A29 43 B
766 B 14ms
13ms Document
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:10 GMT
Expires: 0
Keep-Alive: timeout=1, max=497
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 1A0D
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=Fm6e4GJQl7FYhMVArg0p&pi=gumgum&tc=1

35 B
250 B

28ms
28ms

Document
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=Fm6e4GJQl7FYhMVArg0p&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Fri, 23 Jun 2023 02:36:11 GMT Fri, 23 Jun 2023 02:36:11 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=Fm6e4GJQl7FYhMVArg0p&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 3068
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

147ms
147ms

Document
text/html

104.127.172.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-127-172-242.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 23 Jun 2023 02:36:11 GMT
ETag: "40010-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 23 Jun 2023 02:36:10 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame B787 284 B
921 B 838ms
143ms Image
image/jpg 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 b9pj45k4 Show response
sync-tm.everesttech.net/upi/pid/ Frame 28C8 85 B
250 B 33ms
33ms Document
image/png 151.101.2.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Fri, 23 Jun 2023 02:36:11 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-lga21926-LGA
x-timer: S1687487771.362918,VS0,VE8

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame 102F 43 B
479 B 34ms
33ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDF9E8B40E-FA4B-4829-B1B4-0D3C144F20AA

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:11 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: K8B2GV89VGHP6KSJSTFH

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9CA8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-ei0DvpLSCmxtA08FE8gqg%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

20ms
19ms

Image
text/html

72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:11 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=123959
accept-ranges: bytes
content-length: 5554
expires: Sat, 24 Jun 2023 13:02:10 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 9CA8
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=e2f0ea03-289e-4f5f-a1bd-a39e23bc0ac4%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&ttd_puid=e2f0ea03-289e-4f5f-a1bd-a39e23bc0ac4%2C%2C

95 B
123 B

44ms
43ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&ttd_puid=e2f0ea03-289e-4f5f-a1bd-a39e23bc0ac4%2C%2C

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&ttd_puid=e2f0ea03-289e-4f5f-a1bd-a39e23bc0ac4%2C%2C
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 359

GET
H2 200 xuid
eb2.3lift.com/ Frame 9CA8 37 B
354 B 30ms
27ms Image
image/gif 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7976&xuid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 23 Jun 2023 02:36:11 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

insync
thrtle.com/ Frame 9CA8
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&vxii_pid=12&vxii_pid1=10067&vxii_rcid=9af62d21-c101-4096-a1ff-c0e1de91ac2e

43 B
295 B

19ms
19ms

Image
image/gif

54.236.237.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&vxii_pid=12&vxii_pid1=10067&vxii_rcid=9af62d21-c101-4096-a1ff-c0e1de91ac2e
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 54.236.237.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-237-143.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Fri, 23 Jun 2023 02:36:11 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&vxii_pid=12&vxii_pid1=10067&vxii_rcid=9af62d21-c101-4096-a1ff-c0e1de91ac2e
date: Fri, 23 Jun 2023 02:36:11 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9CA8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjlFOEI0MEUtRkE0Qi00ODI5LUIxQjQtMEQzQzE0NEYyMEFB&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

273ms
26ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 00:40:45 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9CA8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELrCNr7v4shcd-sZzkVlvRI&google_cver=1

42 B
529 B

272ms
25ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELrCNr7v4shcd-sZzkVlvRI&google_cver=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 00:38:08 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELrCNr7v4shcd-sZzkVlvRI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9CA8
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:8E184FF7195341CDA169C2CC1F27D2A6

42 B
327 B

18ms
17ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:8E184FF7195341CDA169C2CC1F27D2A6
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Fri, 23 Jun 2023 02:36:11 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:8E184FF7195341CDA169C2CC1F27D2A6
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 22 Jun 2023 02:36:11 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9CA8
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3195108133375671054&gdpr=0&gdpr_consent=&us_privacy=

1 B
407 B

258ms
16ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3195108133375671054&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 23 Jun 2023 02:36:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3195108133375671054&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 23 Jun 2023 02:36:10 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9CA8
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&gdpr=0&gdpr_consent=

42 B
330 B

270ms
18ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_pm-db5_rbd_rx_ox-db5_smrt_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 355

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3068 34 KB
10 KB 19ms
16ms Script
text/html 104.127.172.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-127-172-242.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: fe27a67c0f975890e91c739a541aea039450017d92a83598d4510429bbbde288

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 02:36:11 GMT
Content-Encoding: gzip
Last-Modified: Fri, 23 Jun 2023 01:30:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=82499
Connection: keep-alive
Content-Length: 10113
Expires: Sat, 24 Jun 2023 01:31:10 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
20ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1551311643&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&ul=en-us&de=UTF-8&dt=Google%27s%20.zip%20Top%20Level%20domain%20is%20already%20used%20in%20phishing%20attacks%20-%20gHacks%20Tech%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=AdBlockDetection&ea=IsAdBlockingX10&el=false&_u=6ODAAUABAAAAACgDIEC~&jid=&gjid=&cid=11174963.1687487768&tid=UA-111230-1&_gid=1361327954.1687487768&gtm=45He36l0n81NHW6RDK&z=1959873797

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 05:35:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 75651
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
21ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1551311643&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&ul=en-us&de=UTF-8&dt=Google%27s%20.zip%20Top%20Level%20domain%20is%20already%20used%20in%20phishing%20attacks%20-%20gHacks%20Tech%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=AdBlockDetection&ea=IsAdBlockPlusX10&el=false&_u=6ODAAUABAAAAACgDIEC~&jid=&gjid=&cid=11174963.1687487768&tid=UA-111230-1&_gid=1361327954.1687487768&gtm=45He36l0n81NHW6RDK&z=1927824628

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 05:35:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 75651
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B787
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=LJ7YNDTX-C-328J
https://s.amazon-adsystem.com/ecm3?id=LJ7YNDTX-C-328J&ex=d-rubiconproject.com&status=ok

43 B
479 B

28ms
27ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LJ7YNDTX-C-328J&ex=d-rubiconproject.com&status=ok

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 0SSWZ727RX1NAMAPSSRT
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LJ7YNDTX-C-328J&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B787
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/zaEBPnx3LbI_EKvJa3qQqw?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-UdC6.05E2oKzR.7XnxDehCHwdjo0Pj.dJa4wOw--~A

42 B
678 B

567ms
126ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-UdC6.05E2oKzR.7XnxDehCHwdjo0Pj.dJa4wOw--~A
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Fri, 23 Jun 2023 02:36:11 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-UdC6.05E2oKzR.7XnxDehCHwdjo0Pj.dJa4wOw--~A
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B787
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEEWBxmPL1MJBIjYtzSq5Y9k&google_cver=1

42 B
678 B

576ms
135ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEEWBxmPL1MJBIjYtzSq5Y9k&google_cver=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEEWBxmPL1MJBIjYtzSq5Y9k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B787
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&gdpr=0&gdpr_consent=&expires=30

42 B
678 B

562ms
137ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&gdpr=0&gdpr_consent=&expires=30
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5eebcfb8-e278-488f-b8a2-8e2c72e8342a&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H2

200

setuid
px.ads.linkedin.com/ Frame B787
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ7YNDTX-C-328J

0
516 B

115ms
54ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ7YNDTX-C-328J
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:11 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 9AA326EE7C3B4126A188F769A93B957B Ref B: EWR30EDGE0209 Ref C: 2023-06-23T02:36:12Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX+wt04m8PF9K1cfEDQ7w==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ7YNDTX-C-328J
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B787
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWY2YjU2Y2I1NWZiYjY5MTI4MGQ4YzIyN2FiOGU2MzM4MTZlMWFjMg

170 B
188 B

48ms
47ms

Image
image/png

142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWY2YjU2Y2I1NWZiYjY5MTI4MGQ4YzIyN2FiOGU2MzM4MTZlMWFjMg

Protocol

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWY2YjU2Y2I1NWZiYjY5MTI4MGQ4YzIyN2FiOGU2MzM4MTZlMWFjMg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B787
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo3WU5EVFgtQy0zMjhK
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGHXRUQZPmkoAqYj3bniq_Y&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo3WU5EVFgtQy0zMjhK&google_push=

170 B
188 B

31ms
30ms

Image
image/png

142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo3WU5EVFgtQy0zMjhK&google_push=

Protocol

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo3WU5EVFgtQy0zMjhK&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B787
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=JOA-aQgMQUiQPB9zf_8emw&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=JOA-aQgMQUiQPB9zf_8emw

43 B
479 B

44ms
44ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=JOA-aQgMQUiQPB9zf_8emw

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 8D9R4SBSP58XDCHV0NCQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=JOA-aQgMQUiQPB9zf_8emw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame B787 43 B
855 B 544ms
171ms Image
image/gif 54.239.33.158
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.239.33.158 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: HGMDDHAEQ79NQ7RYEN19
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 3068
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=LJ7YNDTX-C-328J
https://usersync.gumgum.com/usersync?b=mag&i=LJ7YNDTX-C-328J

35 B
250 B

269ms
268ms

Image
image/gif

3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=LJ7YNDTX-C-328J
Protocol: HTTP/1.1
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:12 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usersync.gumgum.com/usersync?b=mag&i=LJ7YNDTX-C-328J
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 87d839cc3e00ba41df3f5dd9eab06282
Expires: 0

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 9CA8 0
261 B 123ms
36ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 9B77 2 KB
3 KB 365ms
364ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=32476450&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 190c4cea1e2d49848cd2dbc969b29375b231d1919904c97cb748f271791cb938

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Fri, 23 Jun 2023 02:36:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 7384
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716706107066

42 B
274 B

30ms
30ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716706107066
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:14 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716706107066
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame BD04 43 B
855 B 39ms
38ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 843HRXJPNXX8CH9W5CZM

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 82F4
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:db226495-051a-4000-a988-5c7e629ad986&gdpr=0&gdpr_consent=

42 B
406 B

33ms
32ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:db226495-051a-4000-a988-5c7e629ad986&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:14 GMT
Expires: Fri, 23 Jun 2023 02:36:13 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 1031 59fd23a master ord ord-pixel-x3 config_version:"1969"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:db226495-051a-4000-a988-5c7e629ad986&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 63CB
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCcDFVN0pLZ29BQUItOHlHWUxhZw&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AABp1U7JKgoAAB-8yGYLag&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_cu...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=2
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABp1U7JKgoAAB-8yGYLag&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=507124677645352015&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABp1U7JKgoAAB-8yGYLag&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D507124677645352015%26gdpr%3D0%26gdpr_consent...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=507124677645352015&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AABp1U7J...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABp1U7JKgoAAB-8yGYLag&gdpr=0&gdpr_consent=

42 B
199 B

22ms
21ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABp1U7JKgoAAB-8yGYLag&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Fri, 23 Jun 2023 02:36:14 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABp1U7JKgoAAB-8yGYLag&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame AC34
Redirect Chain

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_459e3ba870174a4daa4af

42 B
279 B

34ms
33ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_459e3ba870174a4daa4af
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
content-type: image/gif
date: Fri, 23 Jun 2023 02:36:13 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_459e3ba870174a4daa4af
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: a

GET
H/1.1 200 usersync Show response
usersync.gumgum.com/ Frame 6DC5 35 B
250 B 39ms
39ms Document
image/gif 3.213.224.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-224-199.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 23 Jun 2023 02:36:14 GMT
Expires: 0
Pragma: no-cache

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame 9B77 43 B
61 B 44ms
43ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:14 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK Martin
crb.kargo.com/api/v1/dsync/ Frame 9B77 43 B
504 B 235ms
39ms Image
image/gif 54.236.122.247
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.236.122.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-122-247.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 02:36:14 GMT
X-Accel-Expires: 0
Vary: Origin
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame 9B77 0
425 B 242ms
41ms Image
text/plain 52.54.245.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.245.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-245-27.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Connection: keep-alive
Date: Fri, 23 Jun 2023 02:36:13 GMT

GET
H/1.1 200 syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 9B77 0
397 B 525ms
111ms Image
text/plain 52.212.37.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.37.98 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-37-98.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 02:36:14 GMT
X-Clacks-Overhead: GNU Terry Pratchett
X-Adswizz-request-id: b91ec3e0-116e-11ee-a509-06126268c439
Connection: keep-alive
Content-Length: 0
X-Application-Context: application:production
Instance-id: i-09752a50c3ed6650b

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 9B77
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-AqzcaEJE2uUmOL3sCFiEal96GRuVcCk-~A&gdpr=0

0
129 B

40ms
36ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-AqzcaEJE2uUmOL3sCFiEal96GRuVcCk-~A&gdpr=0
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:14 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-AqzcaEJE2uUmOL3sCFiEal96GRuVcCk-~A&gdpr=0
date: Fri, 23 Jun 2023 02:36:14 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 9B77 43 B
601 B 39ms
37ms Image
image/gif 2600:1f18:4e9:5a07:6454:8b0d:b7ff:750
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA?gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:6454:8b0d:b7ff:750 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:14 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9B77
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=377845f35a34183c&is_secure=true&networkId=17100&version=1&nuid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHO7MYr_854wNqUE_sAAAAAAA&expiration=1687574174&nuid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&...

42 B
346 B

23ms
23ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHO7MYr_854wNqUE_sAAAAAAA&expiration=1687574174&nuid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&is_secure=true&gdpr_consent=&gdpr=0
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 23 Jun 2023 02:36:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 02:36:14 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHO7MYr_854wNqUE_sAAAAAAA&expiration=1687574174&nuid=F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9B77
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=582f5e29-0699-4a31-a424-ccc0c640626a&gdpr=0&gdpr_consent=

1 B
316 B

25ms
24ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=582f5e29-0699-4a31-a424-ccc0c640626a&gdpr=0&gdpr_consent=
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 23 Jun 2023 02:36:14 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=582f5e29-0699-4a31-a424-ccc0c640626a&gdpr=0&gdpr_consent=
Date: Fri, 23 Jun 2023 02:36:14 GMT
Connection: keep-alive
X-CI-RTID: da92e25a-880e-4994-8e62-3ff13a6d2584
Content-Length: 205
Content-Type: text/html; charset=utf-8

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9B77
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic
https://x.bidswitch.net/sync?dsp_id=59&user_id=f294f51b-1a97-4bcb-ba5c-84b09808cdee&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=&gdpr_pd=

1 B
166 B

12ms
11ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=&gdpr_pd=
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 23 Jun 2023 02:36:14 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=d083ad98-f0e3-4de4-b3e5-06f02856f38d&gdpr=&gdpr_consent=&gdpr_pd=
Date: Fri, 23 Jun 2023 02:36:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 126 B
514 B 551ms
115ms XHR
application/json 116.202.150.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.150.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: haproxy01.cl03.het.mrf.io
Software: istio-envoy /
Resource Hash: c4866c723c789cf04a4900008e83e9a923d0209e0ee11f32a679c3ece024e103

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 23 Jun 2023 02:36:14 GMT
content-encoding: gzip
server: istio-envoy
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.ghacks.net
access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 86

GET
H2 200 experiences Show response
flowcards.mrf.io/json/ 51 B
283 B 516ms
438ms Fetch
application/json 2606:4700:3033::6815:325a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://flowcards.mrf.io/json/experiences?site_id=2544&client_id=ce1aa444-12fd-46ea-8c36-3aaa9e89dfa5&user_type=0&canonical_url=https%3A%2F%2Fwww.ghacks.net%2F2023%2F05%2F15%2Fgoogles-zip-top-level-domain-is-already-used-in-phishing-attacks%2F&referrer=&recirculation_source=&previous_page=&geo=__INJECT_GEO__&session_duration=5&pageviews=1&first_visit=1687487769&page_technology=0
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:325a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c58ae9a450c0b6887adcbc1b278ecdab16a6abe92c35f3e91dae50d11cbee03d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:15 GMT
content-encoding: gzip
cf-cache-status: BYPASS
server: cloudflare
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private
x-envoy-upstream-service-time: 393
accept-ranges: bytes
cf-ray: 7db957a0dfc58c36-EWR
alt-svc: h3=":443"; ma=86400
content-length: 64

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 9B77 0
129 B 21ms
20ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 02:36:16 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 126 B
514 B 696ms
112ms Fetch
application/json 116.202.150.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.150.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: haproxy01.cl03.het.mrf.io
Software: istio-envoy /
Resource Hash: c4866c723c789cf04a4900008e83e9a923d0209e0ee11f32a679c3ece024e103

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 23 Jun 2023 02:36:17 GMT
content-encoding: gzip
server: istio-envoy
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.ghacks.net
access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 86

POST recirculation.php
events.newsroom.bi/ 0
0

POST
H2 200 recirculation.php
events.newsroom.bi/ 12 B
0 113ms
112ms XHR
application/json 116.202.150.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://events.newsroom.bi/recirculation.php
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.150.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: haproxy01.cl03.het.mrf.io
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://www.ghacks.net/2023/05/15/googles-zip-top-level-domain-is-already-used-in-phishing-attacks/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 23 Jun 2023 02:36:19 GMT
server: istio-envoy
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.ghacks.net
access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 12

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: events.newsroom.bi
URL: https://events.newsroom.bi/recirculation.php

Verdicts & Comments Add Verdict or Comment

106 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

124 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ghacks.net/	1970-01-20 12:44:49	Name: rv_test_position Value: 222
.ghacks.net/	1970-01-20 12:44:49	Name: rv_test_variant Value: 0
.ghacks.net/	1970-01-20 14:54:23	Name: _fbp Value: fb.1.1687487768138.1086050992
.ghacks.net/	1970-01-20 22:20:47	Name: _ga Value: GA1.2.11174963.1687487768
.ghacks.net/	1970-01-20 12:46:14	Name: _gid Value: GA1.2.1361327954.1687487768
.ghacks.net/	1970-01-20 12:44:47	Name: _gat_UA-111230-1 Value: 1
.ghacks.net/	1970-01-20 21:31:50	Name: didomi_token Value: eyJ1c2VyX2lkIjoiMTg4ZTYxYmUtNWNlZS02N2FhLTk1YjAtM2EzMGY1ZjQyMzg5IiwiY3JlYXRlZCI6IjIwMjMtMDYtMjNUMDI6MzY6MDguNTA3WiIsInVwZGF0ZWQiOiIyMDIzLTA2LTIzVDAyOjM2OjA4LjUwN1oiLCJ2ZXJzaW9uIjpudWxsfQ==
.amazon-adsystem.com/	1970-01-20 17:21:16	Name: ad-id Value: A4HHjIEXzUg2jqY5p7zrhRU
.amazon-adsystem.com/	1970-01-20 22:20:47	Name: ad-privacy Value: 0
.openx.net/	1970-01-20 21:30:23	Name: i Value: ee516dd6-c397-02ab-22c6-6a6c7d8ddab8\|1687487770
.casalemedia.com/	1970-01-20 21:30:23	Name: CMID Value: ZJUFGtNgPQ6lXIQH.YIvTAAA
.casalemedia.com/	1970-01-20 14:54:23	Name: CMPS Value: 3614
.casalemedia.com/	1970-01-20 14:54:23	Name: CMPRO Value: 3614
.gumgum.com/	1970-01-20 21:30:23	Name: vst Value: u_34a9cf22-bdf9-43cc-a7a3-b3c96d8e12ba
.3lift.com/	1970-01-20 14:54:23	Name: tluid Value: 2240945551553324476182
.openx.net/	1970-01-20 13:06:23	Name: pd Value: v2\|1687487770\|vMgavPkWgy
.smartadserver.com/	1970-01-20 22:15:02	Name: pid Value: 507124677645352015
.adnxs.com/	1970-01-20 14:54:23	Name: uuid2 Value: 2314681699185709474
.outbrain.com/	1970-01-20 14:54:23	Name: obuid Value: 4c1aa0c6-b8cf-4c0a-9d8c-79a6f15a40fb
.zemanta.com/	1970-01-20 21:30:23	Name: zuid Value: lvbBgY938I3hSZR8CkVq
.yahoo.com/	1970-01-20 21:30:45	Name: A3 Value: d=AQABBBoFlWQCEDLIFldmoMKqQbdRgJdhaL8FEgEBAQFWlmSeZAAAAAAA_eMAAA&S=AQAAAhmD8Uw_Uaxa-oS3w3sv270
.bidswitch.net/	1970-01-20 21:30:23	Name: tuuid Value: d083ad98-f0e3-4de4-b3e5-06f02856f38d
.bidswitch.net/	1970-01-20 21:30:23	Name: c Value: 1687487770
.bidswitch.net/	1970-01-20 21:30:23	Name: tuuid_lu Value: 1687487770
.technoratimedia.com/	1970-01-20 12:44:50	Name: tads_uidp_44 Value: LJ7WXVR6-O-EE6F
.technoratimedia.com/	1970-01-20 12:45:05	Name: tads_uidp_88 Value: 435567615421457462525
.technoratimedia.com/	1970-01-20 12:49:06	Name: tads_uidp_77 Value: _sMnSpIdnSDjweNgodpwlDadNNbwHICzhNyUWME1wyE
.technoratimedia.com/	1970-01-20 13:35:42	Name: tads_uidp_45 Value: 1D5FD583-3FB2-420F-9D5D-E37FA391B720
.technoratimedia.com/	1970-01-20 12:45:05	Name: tads_uidp_46 Value: 5574981382914482163
.technoratimedia.com/	1970-01-20 12:45:05	Name: tads_uidp_79 Value: acbbb8d5-ed91-4273-b19b-d98e36cb8b19
.technoratimedia.com/	1970-01-20 12:45:05	Name: tads_uidp_37 Value: 6310c7c1-b550-3361-93bd-76d8f3a9611e
.technoratimedia.com/	1970-01-20 12:44:50	Name: tads_uidp_48 Value: f91ede6d-532e-4c24-97c0-9c384ef0e080
.technoratimedia.com/	1970-01-20 12:45:05	Name: tads_uidp_49 Value: AAAIqwzZJaWUowNCQDBKAAAAAAA
.technoratimedia.com/	1970-01-20 13:48:02	Name: tads_uidp_90 Value: 8fdbc304-6b1b-4375-ac1f-60f3edbe1943
.technoratimedia.com/	1970-01-20 12:44:50	Name: tads_uidp_7 Value: eca31b93-adcb-4463-9e89-9ee2140f2de4
.technoratimedia.com/	1970-01-20 12:45:05	Name: tads_uidp_80 Value: y-k9_vTxBE2uGwU8YkAqU7ASxWEKjKmn3l~A
.technoratimedia.com/	1970-01-20 13:48:02	Name: tads_uidp_70 Value: 1664836083826-933092590846-007289-008-005688
.technoratimedia.com/	1970-01-20 12:44:50	Name: tads_uidp_82 Value: ZJT55ZZVaC4-wyGMdA4rMgAA&032
.technoratimedia.com/	1970-01-20 12:44:50	Name: tads_uidp_50 Value: 947752dc-a4a6-4fc4-9502-dc556c27c663
.technoratimedia.com/	1970-01-20 12:44:50	Name: tads_uidp_61 Value: 212191833773695
.technoratimedia.com/	1970-01-20 12:45:20	Name: tads_uidp_62 Value: 3304566610813220000V10
.technoratimedia.com/	1970-01-20 12:45:05	Name: tads_uidp_64 Value: 5h8jBRGGzrM4XToVOjZKnYFaNuVwDiYc
.technoratimedia.com/	1970-01-20 12:44:50	Name: tads_uidp_76 Value: RX-165f29bc-3f82-498c-8999-af2d7f02c50c-005
.technoratimedia.com/	1970-01-20 22:20:47	Name: tads_uid Value: 6C9509C18A274A72AA6720B9342CCB7A
.technoratimedia.com/	1970-01-20 22:20:47	Name: tads_uid_cd Value: 20220529214707+0000
.technoratimedia.com/	1970-01-20 22:20:47	Name: tads_zora Value: 2
.technoratimedia.com/	1970-01-20 12:46:14	Name: envelope_liveramp.com Value: 1681186223197
.deepintent.com/	1970-01-20 22:20:47	Name: CDIUSER Value: di_459e3ba870174a4daa4af
.mathtag.com/	1970-01-20 22:10:42	Name: uuid Value: db226495-051a-4000-a988-5c7e629ad986
.ipredictive.com/	1970-01-20 21:30:23	Name: cu Value: 582f5e29-0699-4a31-a424-ccc0c640626a\|1687487770429
sync.srv.stackadapt.com/	1970-01-20 21:30:23	Name: sa-user-id Value: s%3A0-4ec415cb-95e1-538d-6230-0ad19cdf4f4a.ThMKHCuF%2FJiNjxJhTPfbakT3gEbx7tQi6GLJSli%2BVUs
sync.srv.stackadapt.com/	1970-01-20 21:30:23	Name: sa-user-id-v2 Value: s%3ATsQVy5XhU41iMArRnN9PSgW16oY.i5mo9QoecSwoP0wOW%2BfnxOCMamrAGqlyxwUBXZLx5g4
.srv.stackadapt.com/	1970-01-20 21:30:23	Name: sa-user-id-v2 Value: s%3ATsQVy5XhU41iMArRnN9PSgW16oY.i5mo9QoecSwoP0wOW%2BfnxOCMamrAGqlyxwUBXZLx5g4
.everesttech.net/	1970-01-20 21:30:23	Name: everest_g_v2 Value: g_surferid~ZJUFGgATy18NjQBL
.turn.com/	1970-01-20 17:03:59	Name: uid Value: 3195108133375671054
.doubleclick.net/	1970-01-20 22:20:47	Name: IDE Value: AHWqTUkNiFO3fSuuPASqXj2NxK0CQm3H9jBRx9rTzLI1pP29jIpAi-yD6tEl5AaMZpY
.1rx.io/	1970-01-20 21:30:23	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-ddc61c9a-6b88-467e-8e84-53dfcb9d06b3-005%22%7D
.adsrvr.org/	1970-01-20 21:31:50	Name: TDID Value: 5eebcfb8-e278-488f-b8a2-8e2c72e8342a
.creative-serving.com/	1970-01-20 22:06:23	Name: tuuid Value: 1b3bf3a9-a15b-4cf6-b005-9da6815cb966
.creative-serving.com/	1970-01-20 22:06:23	Name: c Value: 1687487770
.creative-serving.com/	1970-01-20 22:06:23	Name: tuuid_lu Value: 1687487770
beacon.lynx.cognitivlabs.com/	1970-01-20 21:31:50	Name: UID Value: f2d851c3-77e7-43d1-926b-5bfdd10b1764
beacon.lynx.cognitivlabs.com/	1970-01-20 21:31:50	Name: ss Value: XbD2ixW1xRG3E8tapbyyfr5xR6EdKVbmhJxWJ7ILPj1htCI%2B1pGouu8YKLevJPIs9GhhAFOKt2uRWS190HP96Q%3D%3D
.admanmedia.com/	1970-01-20 13:04:57	Name: admtr Value: e9c2641c-16df-4241-b89f-acb98e5dda9f
.admanmedia.com/	1970-01-20 13:04:57	Name: ac_r Value: CS71
.company-target.com/	1970-01-20 22:20:47	Name: tuuid Value: 04cd3886-d7e5-4626-b584-b32c59343b7b
.company-target.com/	1970-01-20 22:20:47	Name: tuuid_lu Value: 1687487770\|ix:0
.360yield.com/	1970-01-20 14:54:23	Name: tuuid Value: 4ae05c80-c319-4767-a4df-5bcc83899ea8
.360yield.com/	1970-01-20 14:54:23	Name: tuuid_lu Value: 1687487770
.contextweb.com/	1970-01-20 21:23:11	Name: V Value: wwyVaIRIrOpg
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: d581de0f35aa9f0f
.csync.loopme.me/	1970-01-20 14:57:16	Name: viewer_token Value: 46a11ea3-841d-4501-bdde-d15eb10abe6f
.openx.net/	1970-01-20 13:06:23	Name: univ_id Value: 537072971\|5eebcfb8-e278-488f-b8a2-8e2c72e8342a\|1687487770998566
.pubmatic.com/	1970-01-20 21:30:23	Name: KADUSERCOOKIE Value: F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA
.socdm.com/	1970-01-20 22:20:47	Name: SOC Value: ZJUFG8Co5s8AANhrMPYAAAAA
.bluekai.com/	1970-01-20 17:08:18	Name: bku Value: ikG99OGakVELGN/y
.bluekai.com/	1970-01-20 17:08:18	Name: bkpa Value: KJhz0XamQp9R9mY73zz+IpLtwYps9SPQ4N9o5c9goUWWCA3j0UhbTXVe80d4tFVnUxw5fwtcFMr1UIlhgqb74AnwH4w3O6wNKE4qgoXw8tU8z/xIWZ9WVn+h+XZLFrNaET+KZ4zn9UjN57Sl0HOQfUiNQITJ1vwcL5PZIctD5RustHaTLQ6kE6fapC1u3Tqcm8WM7rnzWhkbGWe/1wwDw2IgbaA9P3g9H+uRkUa9Jz50od8KvkBKvR8NWSYcLLYZE3BsFjx9EXAtiQaDcF619Wt1uyA=
.targeting.unrulymedia.com/	1970-01-20 21:30:23	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-ddc61c9a-6b88-467e-8e84-53dfcb9d06b3-005%22%7D
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_22 Value: 14911-3195108133375671054&KRTB&23150-3195108133375671054
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_377 Value: 6810-5eebcfb8-e278-488f-b8a2-8e2c72e8342a&KRTB&22918-5eebcfb8-e278-488f-b8a2-8e2c72e8342a&KRTB&22926-5eebcfb8-e278-488f-b8a2-8e2c72e8342a&KRTB&23031-5eebcfb8-e278-488f-b8a2-8e2c72e8342a
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_80 Value: 22987-CAESELrCNr7v4shcd-sZzkVlvRI&KRTB&16514-CAESELrCNr7v4shcd-sZzkVlvRI&KRTB&23025-CAESELrCNr7v4shcd-sZzkVlvRI&KRTB&23386-CAESELrCNr7v4shcd-sZzkVlvRI
.tapad.com/	1970-01-20 14:11:11	Name: TapAd_TS Value: 1687487771402
.tapad.com/	1970-01-20 14:11:11	Name: TapAd_DID Value: e2f0ea03-289e-4f5f-a1bd-a39e23bc0ac4
.simpli.fi/	1970-01-20 21:31:50	Name: suid Value: 8E184FF7195341CDA169C2CC1F27D2A6
.smaato.net/	1970-01-20 13:15:02	Name: SCM Value: 47b0bd4
.smaato.net/	1970-01-20 12:59:54	Name: SCMo Value: 47b0bd4
.thrtle.com/	1970-01-20 17:32:47	Name: mc Value: eyJpZCI6IjlhZjYyZDIxLWMxMDEtNDA5Ni1hMWZmLWMwZTFkZTkxYWMyZSIsImwiOjE2ODc0ODc3NzE0MzUsInQiOjF9
.creativecdn.com/	1970-01-20 21:30:23	Name: u Value: Fm6e4GJQl7FYhMVArg0p
.creativecdn.com/	1970-01-20 21:30:23	Name: ts Value: 1687487771
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_148 Value: 19421-uid:8E184FF7195341CDA169C2CC1F27D2A6&KRTB&23489-uid:8E184FF7195341CDA169C2CC1F27D2A6
.tapad.com/	1970-01-20 14:11:11	Name: TapAd_3WAY_SYNCS Value: 1!4178
.rubiconproject.com/	1970-01-20 21:30:23	Name: khaos Value: LJ7YNDTX-C-328J
.adsrvr.org/	1970-01-20 21:31:50	Name: TDCPM Value: CAESFQoGY2FzYWxlEgsI8ovnt5Tn-TsQBRIXCghwdWJtYXRpYxILCMqhw7mU5_k7EAUSFAoFdGFwYWQSCwiCnaW9lOf5OxAFEhYKB3J1Ymljb24SCwjy-ZfAlOf5OxAFGAEgAigCMgsIgpWo6qrn-TsQBTgBWgV0YXBhZGAC
.linkedin.com/	1970-01-20 21:30:23	Name: bcookie Value: "v=2&064d1067-452b-4273-8f67-03a495bfda72"
.linkedin.com/	1970-01-20 12:46:14	Name: lidc Value: "b=VGST04:s=V:r=V:a=V:p=V:g=2948:u=1:x=1:i=1687487772:t=1687574172:v=2:sig=AQG8cFtXVCOb8BQyUXeujotYrshzHJEV"
.rubiconproject.com/	1970-01-20 21:30:23	Name: audit Value: 1\|LR4y4XKnt38E7PIdc3sInJ705mnNoS7lTjn7ZulLbdSMaGpsUGBQ3uWY73LGgcfYA58D8QG0j0YiZ07GJqnMno4BjqNRGrmz
.pubmatic.com/	1970-01-20 14:54:23	Name: chkChromeAb67Sec Value: 2
.pubmatic.com/	1970-01-20 12:46:14	Name: pi Value: 0:4
.pubmatic.com/	1970-01-20 14:54:23	Name: DPSync3 Value: 1688688000%3A259_258_201_263_262_261_260%7C1688083200%3A248
.pubmatic.com/	1970-01-20 14:54:23	Name: SyncRTB3 Value: 1688688000%3A13_166_21_54_71_46_231_7_104_220_22_250%7C1688342400%3A63%7C1688083200%3A15_2_223
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_279 Value: 22890-582f5e29-0699-4a31-a424-ccc0c640626a&KRTB&23011-582f5e29-0699-4a31-a424-ccc0c640626a&KRTB&23355-582f5e29-0699-4a31-a424-ccc0c640626a
.deepintent.com/	1970-01-20 22:20:47	Name: CDIPARTNERS Value: %7B%22141%22%3A%2220230623%22%7D
.analytics.yahoo.com/	1970-01-20 21:30:23	Name: IDSYNC Value: 18z8~2cde
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_1251 Value: 23269-di_459e3ba870174a4daa4af
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_27 Value: 16735-uid:db226495-051a-4000-a988-5c7e629ad986&KRTB&16736-uid:db226495-051a-4000-a988-5c7e629ad986&KRTB&23019-uid:db226495-051a-4000-a988-5c7e629ad986&KRTB&23114-uid:db226495-051a-4000-a988-5c7e629ad986
ads.avct.cloud/	1970-01-20 21:30:23	Name: uuid Value: f294f51b-1a97-4bcb-ba5c-84b09808cdee
.kargo.com/	1970-01-20 21:30:23	Name: ktcid Value: f6be72eb-7819-05e4-5b58-9d8fff1ee365
.bfmio.com/	1970-01-20 21:30:23	Name: __187_cid Value: F9E8B40E-FA4B-4829-B1B4-0D3C144F20AA
.bfmio.com/	1970-01-20 21:30:23	Name: __io_cid Value: afc67a4e71039e84d11c21302b8dc9d1662bda0f
.dotomi.com/	1970-01-20 12:44:47	Name: DotomiTest Value: 377845f35a34183c
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_32 Value: 11175-AAAHO7MYr_854wNqUE_sAAAAAAA&KRTB&22713-AAAHO7MYr_854wNqUE_sAAAAAAA&KRTB&22715-AAAHO7MYr_854wNqUE_sAAAAAAA
.bidr.io/	1970-01-20 22:13:21	Name: bito Value: AABp1U7JKgoAAB-8yGYLag
.bidr.io/	1970-01-20 22:13:21	Name: bitoIsSecure Value: ok
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_466 Value: 16530-d083ad98-f0e3-4de4-b3e5-06f02856f38d
.smartadserver.com/	1970-01-20 21:31:50	Name: csync Value: 127:AABp1U7JKgoAAB-8yGYLag
.rfihub.com/	1970-01-20 22:06:23	Name: rud Value: H4sIAAAAAAAA_-MSsjSzNLSwMDc0MzcwMzQAEmZCfIa6zr4RAeUGTpUWXo5JAHNLC3AkAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSsjSzNLSwMDc0MzcwMzQAEmZCfIa6zr4RAeUGTpUWXo5JAHNLC3AkAAAA
.rfihub.com/	1970-01-20 22:06:23	Name: eud Value: H4sIAAAAAAAA_9vEyGtoZmFuYmFubm5iZmkOAOw2W1oQAAAA
.contextweb.com/	1970-01-20 21:30:23	Name: pb_rtb_ev Value: 3-1lb9\|7dN.0.AABp1U7JKgoAAB-8yGYLag\|7bq.0.1
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_18 Value: 22947-969188716706107066
.pubmatic.com/	1970-01-20 13:27:59	Name: KRTBCOOKIE_699 Value: 22727-AABp1U7JKgoAAB-8yGYLag
.pubmatic.com/	1970-01-20 13:27:59	Name: PugT Value: 1687487774
.pubmatic.com/	1970-01-20 13:27:59	Name: SPugT Value: 1687487776
www.ghacks.net/	1970-01-20 12:44:48	Name: _dd_s Value: rum=0&expire=1687488667865

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=&gdpr_consent=&ccpa= Message: Failed to load resource: the server responded with a status of 400 (Bad Request)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-eu.amazon-adsystem.com
aax.amazon-adsystem.com
ad-delivery.net
ad.360yield.com
ad.doubleclick.net
ad.turn.com
ads.avct.cloud
ads.creative-serving.com
ads.pubmatic.com
api.btloader.com
api.privacy-center.org
b1sync.zemanta.com
beacon.lynx.cognitivlabs.com
bh.contextweb.com
btloader.com
c.amazon-adsystem.com
cdn.id5-sync.com
cm.g.doubleclick.net
connect.facebook.net
crb.kargo.com
creativecdn.com
cs.admanmedia.com
csync.loopme.me
dsum-sec.casalemedia.com
eb2.3lift.com
eus.rubiconproject.com
events.newsroom.bi
flowcards.mrf.io
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
imasdk.googleapis.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
notix.io
p.rfihub.com
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
pixel.tapad.com
polyfill.io
pr-bh.ybp.yahoo.com
pubmatic-match.dotomi.com
px.ads.linkedin.com
readaloud.googleapis.com
rtb-csync.smartadserver.com
rtb.gumgum.com
s.ad.smaato.net
s.amazon-adsystem.com
s.company-target.com
sdk.mrf.io
sdk.privacy-center.org
secure-assets.rubiconproject.com
secure.adnxs.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
spn-v1.revampcdn.com
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
stags.bluekai.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.adkernel.com
sync.bfmio.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.technoratimedia.com
synchroscript.deliveryengine.adswizz.com
tg.socdm.com
thrtle.com
token.rubiconproject.com
u.openx.net
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
usersync.gumgum.com
www.baesystems.zip
www.datadoghq-browser-agent.com
www.facebook.com
www.ghacks.net
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
x.bidswitch.net
events.newsroom.bi
104.127.172.242
104.36.115.113
107.20.114.132
108.138.107.138
108.138.126.121
116.202.150.116
13.225.224.171
130.211.23.194
139.45.240.92
142.251.35.166
142.251.41.2
15.197.193.217
151.101.2.49
151.101.65.91
162.248.18.37
174.137.133.32
185.184.8.90
192.40.39.223
198.148.27.139
199.127.204.171
199.38.167.130
202.241.208.56
216.200.232.253
23.105.12.143
23.105.12.151
23.197.21.62
2600:1f18:4e9:5a07:6454:8b0d:b7ff:750
2600:9000:2209:7800:1b:5138:8a40:93a1
2600:9000:2510:c600:5:b7cc:d3c0:93a1
2600:9000:2512:a200:d:2044:5c40:93a1
2603:c020:400d:3000:7130:bb0b:d7e:bee2
2606:4700:10::ac43:266a
2606:4700:20::681a:346
2606:4700:20::681a:fa
2606:4700:20::ac43:4686
2606:4700:3033::6815:325a
2606:4700:3033::ac43:9fa2
2606:ae80:1451:14::1050
2607:f8b0:4004:c08::9d
2607:f8b0:4006:80f::200a
2607:f8b0:4006:80f::200e
2607:f8b0:4006:81c::2004
2607:f8b0:4006:81f::200a
2607:f8b0:4006:820::2003
2607:f8b0:4006:821::2008
2607:f8b0:4006:821::2013
2607:f8b0:4006:824::2002
2620:112:f002:bbbb::21
2620:1ec:21::14
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42::282
3.213.224.199
3.225.218.40
34.111.113.62
34.133.71.175
34.200.65.202
34.96.71.22
34.98.64.218
35.211.178.172
35.214.199.183
35.71.139.29
38.91.45.7
44.193.243.239
44.205.102.24
44.208.128.231
52.212.37.98
52.46.155.104
52.54.245.27
52.6.34.133
54.172.162.57
54.235.195.83
54.236.122.247
54.236.237.143
54.239.33.158
68.67.160.186
70.42.32.223
70.42.32.95
72.247.71.192
8.28.7.83
8.28.7.84
8.43.72.98
80.77.87.162
00bf6629654c4bdef1a8aacb834c7522d0798c4fc681fb85761e3b9ae2913db6
02563f6dd488eac87d5c8280cdc49326a311cde34be86fe6ec5f5793385d7ad7
02879cae62ad89aabb9030bdeec952a3004c2bcb6453d21bfd50c6c4743f5080
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
11ec9bb8e81592df9f2c0e18c6dae852561b7ed0dca2d47d5dc50edc8d2a90a6
124e61a3b158acb4ab3d8b81c92f3d11d3444ae08413e03e23aa4c14ea4d308a
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
18bea37622937ec27c9d10bb5fc1e49f747260846281dde3cb1890b24d70e079
190c4cea1e2d49848cd2dbc969b29375b231d1919904c97cb748f271791cb938
1eeef11fdd90d582c5e2441e34050173f563ca39eef1e914c79d871beec76641
2464528204e216b4f6b2e8f52b577c86621d2297d0f0b69e848abe643aa6896c
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
25d617eac8e9a101e470e45fefe975a9c7c7420f5d3f0eff1a3ffe6a535a03dd
27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3086c49956d51c2cba2562ba86a083aedf01d66f41c264f158f5d4f6e632c3eb
30c47497e599dc8a9c75d6919a956a9e289140c64d7ab7018885722be1ac8fcf
30c714bf4216e577686d238b98561d093672cb25bf90baab50dd956f75cda4b3
34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf
3664be3a8c387d48a6ba88f70f557117597213f1d377d6b54810de6a6abe20c5
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791
3b13fc50b6ed0a616dc2581175f19de22c59207a54ab0099f32b96c5e13fd71d
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
42acc026706304b5193dbb474671c1258d2ab58d51512fa283e2ec02718fc531
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4919ddf6337285052dc0fe47fd60298fceb2679267a3fd1a85938d2b52538ef2
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
49c02bdd77f8e01a79baa8439e417e92530c03e67ff1b6d415fb885945621ff8
4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
526dab3da70b8c4ab1f8856129d2edb37b7897b8ff88f83e2ad684553a9f7b2e
5422371e9dc5032144463d1bba86e009030131126cfe22315a3e51cefed2a451
554f3ff96cba4f2f33ff2c37c48282006ab24a85cf9ca0ac8b22b0a06126c1d4
55905f7b3c0cb367751791a71d4c4c6518d40275f764685a0cbf00ffec6a8804
59cb9485f12fbd706268412d6ac360905369d2aca4889973b8fbfe8ba834db2a
5b477c9694f19d0c1f986ba24a394caaf31be4d2b06e4df9b30be12f9cb1e76e
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
6a482d2d94c0d1bc6937a1759389d01b475e6b28a0d9b5d7eaa3f9cc8f59f3cd
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a
6f170e41fd143aba25a29a7f83762ca400d552d00ec7657c4fb0f2c7f31ef3e7
70d9311702ac457eb90a7133063593c379191d9d9ca1d3c9549d78481283be6f
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48
7378fe642cc87c3a1343b20efdd53f4e560319daf19f95c4312163a3b788585c
75e0fe33a139622cde1d4bacdef52e609e623b514c56b113c69568fa16c23a12
80cd4bb42ae5db873104aef0b9cb4f6e55d72ea7440eae108640d9779d258c14
8117ea09b5caab594dd88ba8826f107ef9f3a5f91e36b1f89672b03dc33ae48e
8276d99808a3a111dcb2dc61c895388c21341d48be9c3f87d905787a49c2b832
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8564419bba762b0ce4e3bc45fe5c478fcdaac5cc92e78862ce30a6581e11a3f0
8aa3471bd234c6963a168e8501f9aeb622c42ffe00fba96072a487f71a00029b
8b1c82489e8159cfca9f526728dac376344c2f5f22cbb79197fef12807d10660
8b5b8c8b7357c754bdd95a0bf815c2b54106be0307253ced679b8c42ac5a7cc9
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
9615d053779f17698d32327e1fe8296c8fb45353770837879e4795f9c28cad38
991af7dd3de951ca288e28e445bb9bea1787505ee067ff4d871964c216fc430d
9cca958d544314da08debbbdc0614a7310a50846cf880c26746104cde227de84
9d8c5621c9f8cbe6b7a788a8f34d405a443c511cc5135f38452da0c6d901ba6d
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a184d88796612148bc44440e8ac2a264e745e8f3774a82e2e3219c079134ac45
a558ceae2f0ab0ad8a509bf14731225828b3c4fec3e07169da9d5a9259cb216d
aaf69f969c85107828b863ad90f70534c60fc64cbb1a7f3e28d78692d8854db5
ac8cd48b7a9d1e1e1e9bb3939b1f76cfaf430ab142be8d36593b0a4b8204e6ce
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
aea4e7430290383948b2c8a639f25a8a6998ee0cba5eba1f49de44b34f6d1487
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1215d4981afb248c13294b152d9f8366af3b5bda4c670fdff59ec2a62b4fba3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b25051621b8bf3eab8c8cb77d2666a131b4923a6c29ca39174029581c52957a7
b3e051a82490a96f88cc2342630f59cac4c7c4bcab275ee30f9cbecd8e8a62b3
b6738331b4ac9f5a9c6c2cad8fa28ea9a6834d28bdc5ebcb545ec7a4acd6795e
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
b8898a324d47c121f750f567f66777129c9a6980d0590cdc93a90043963f110c
b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd08be9cbf5f35486ce3011abc8286e9e2f59ac1de1ff9840377332383263f19
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c1e8df27eefed0250a8e2785a341a5d35d838d8136f4ffde3168c57e9137aa2b
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c3b0c961624b56351ac1fdcfed1a3ce5c68e73921d08887d89713a1d0df83427
c4866c723c789cf04a4900008e83e9a923d0209e0ee11f32a679c3ece024e103
c56ae0ce6a61669700b75187f654ea8b5fe23cb1377e463c7fc93d052eade027
c58ae9a450c0b6887adcbc1b278ecdab16a6abe92c35f3e91dae50d11cbee03d
c793dd0c17a874af11c48cf5decfc60297b14b8739a867bffb4586db64e8c868
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d36ac645d9f3443fe2b4ee6306a14b305bc3d93f3ed72e913d067d02200e889c
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e00e9bc52a415fc6e22f2332ba8c16d996f59962d5d80ff84f2de86b23782e2d
e03c4dee893e4ab667b0e92e791bd76021c03a88925e4a6124e0115372b85d55
e2b1a7f14cb9db010e10b9e983aab0c2e619a529ea7f29d8a310a032c8ef5e54
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e477cf8c725f201e70140a5806a96b2b62fb58e92ae48b107b8129d952f5b163
e47839620ae791505f14bcf06a9ada7a2ecf1a0268cbda2c9efc883d77558449
e4ea1a836c9e61ca541b43dec61bcd3314ee017b899177e00355034775adce14
e568aab220beacccf405acfe23505a3ed107e0ea7890b7270570251dde211fa0
e808c4a589bbe7ad73f3e66b99f651c32d1a10079973e9db31bd2cce64855c16
ec7021417bccc9935ae1720f04f406f19180c7db0345c9c190167273b8dbabeb
ec922a202c99fe67c6a7a2d4cddb5947f4f9ba6a501768b9900114d32ab43315
ed3307c62c0d78bf73af142b4c660e3257374d97385b2f50b28b1003a5c00513
edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b
eee2cc0688e4321b02687d1644a880232b97ba8bbaa2effb391b98da84cb408f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fe27a67c0f975890e91c739a541aea039450017d92a83598d4510429bbbde288
ff481473ceb28fd40f49e1d1dce9a969cc0d52f89be7fd2c687044cc2ff98cce

www.ghacks.net Open in urlscan Pro 2606:4700:20::681a:fa Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

188 Requests

76 %HTTPS

31 %IPv6

66 Domains

91 Subdomains

54 IPs

7 Countries

1503 kBTransfer

4641 kBSize

124 Cookies

16 Outgoing links

Page URL History

Redirected requests

188 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.ghacks.net Open in urlscan Pro
2606:4700:20::681a:fa Public Scan

Screenshot
Live screenshot

Full Image

188
Requests

76 %
HTTPS

31 %
IPv6

66
Domains

91
Subdomains

54
IPs

7
Countries

1503 kB
Transfer

4641 kB
Size

124
Cookies

188 HTTP transactions
13 data transactions