snyk.io Open in urlscan Pro
2a02:26f0:133:294::ecd  Public Scan

18 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 38

• https://widget.intercom.io/widget/ksrvzmf2 HTTP 302
• https://js.intercomcdn.com/shim.latest.js

Request Chain 43

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=970508&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&time=1599928240093 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D970508%26url%3Dhttps%253A%252F%252Fsnyk.io%252Fblog%252Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%252F%26time%3D1599928240093%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=970508&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&time=1599928240093&liSync=true

Request Chain 51

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/923832244/?random=102932173&cv=9&fst=*&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/&tiba=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=sPdcX5O3Cpyv3gPAwJyYCw&sscte=1&crd= HTTP 302
• https://www.google.com/pagead/1p-conversion/923832244/?random=102932173&cv=9&fst=*&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/&tiba=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=sPdcX5O3Cpyv3gPAwJyYCw&cid=CAQSKQCNIrLMkD97yTGLDgkEjud0pNdd7AwlxTSVqaywhYsaq6WpooSqHTTQ&random=2744433126&resp=GooglemKTybQhCsO HTTP 302
• https://www.google.de/pagead/1p-conversion/923832244/?random=102932173&cv=9&fst=*&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/&tiba=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=sPdcX5O3Cpyv3gPAwJyYCw&cid=CAQSKQCNIrLMkD97yTGLDgkEjud0pNdd7AwlxTSVqaywhYsaq6WpooSqHTTQ&random=2744433126&resp=GooglemKTybQhCsO&ipr=y

83 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/	61 KB 14 KB	621ms 590ms	Document text/html	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash adc83f17cc60e298ff2dd6705f61fa6dd4bbf54fdfbe1ddc4b9c19ccdc885315 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers :method GET :authority snyk.io :scheme https :path /blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 server nginx content-type text/html; charset=UTF-8 pragma no-cache x-cacheable SHORT x-cache-group normal x-orig-cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 14140 x-edgeconnect-midmile-rtt 0 0 x-edgeconnect-origin-mex-latency 565 565 cache-control must-revalidate, max-age=562 expires Sat, 12 Sep 2020 16:40:01 GMT date Sat, 12 Sep 2020 16:30:39 GMT vary Accept-Encoding x-frame-options deny x-content-type-options nosniff x-xss-protection 1; mode=block strict-transport-security max-age=31536000; preload
GET H2	200	css2 fonts.googleapis.com/	2 KB 588 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:814::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=PT+Serif:wght@700&display=swap Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c66cd00f192c51b34255385a22e7599f7dc483141050f408a123a18211bbf34f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 12 Sep 2020 16:30:39 GMT server ESF date Sat, 12 Sep 2020 16:30:39 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 12 Sep 2020 16:30:39 GMT
GET H2	200	css2 fonts.googleapis.com/	5 KB 771 B	23ms 22ms	Stylesheet text/css	2a00:1450:4001:814::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600&display=swap Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 6fa2ca16421cdd1e6c331551a68537c0b5c6b3ab6a03ab8ff4aaacc54b9c9ad9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 12 Sep 2020 15:37:20 GMT server ESF date Sat, 12 Sep 2020 16:30:39 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 12 Sep 2020 16:30:39 GMT
GET H2	200	style.min.css snyk.io/wp-includes/css/dist/block-library/	52 KB 8 KB	14ms 13ms	Stylesheet text/css	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snyk.io/wp-includes/css/dist/block-library/style.min.css?ver=5.4.2 Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 24 Apr 2020 15:32:14 GMT server nginx status 200 etag W/"5ea3067e-d159" x-frame-options deny content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 strict-transport-security max-age=31536000; preload vary Accept-Encoding content-length 7855 x-xss-protection 1; mode=block
GET H2	200	main-1109.css snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/	888 KB 145 KB	21ms 20ms	Stylesheet text/css	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/main-1109.css Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 904d6fe8843b9be08c57eb0abac497a1758329d8dadedf046bbfcd43a2521455 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 11 Sep 2020 11:42:47 GMT server nginx status 200 etag W/"5f5b62b7-ddeed" x-frame-options deny content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 strict-transport-security max-age=31536000; preload vary Accept-Encoding content-length 147818 x-xss-protection 1; mode=block
GET H2	200	jquery3.4.1.min.js Show response snyk.io/wp-content/themes/snyk_v2_etyhadar/resources/assets/scripts/	86 KB 31 KB	9ms 8ms	Script application/javascript	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snyk.io/wp-content/themes/snyk_v2_etyhadar/resources/assets/scripts/jquery3.4.1.min.js?ver=5.4.2 Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 031031f55ba20314364979f7e38c94081eadc50bfe250b290055e5ac3bc35b03 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding gzip x-content-type-options nosniff last-modified Sun, 25 Aug 2019 08:27:50 GMT server nginx status 200 etag W/"5d624686-15866" x-frame-options deny content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 strict-transport-security max-age=31536000; preload vary Accept-Encoding content-length 30920 x-xss-protection 1; mode=block
GET H2	200	lux.js Show response cdn.speedcurve.com/js/	22 KB 7 KB	112ms 37ms	Script application/javascript	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.speedcurve.com/js/lux.js?id=80837559 Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Apache / Resource Hash 409e15e44f869fe67d0fb0615264896d9b59d582e7bbb34a07088c5b72ced2af Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Origin https://snyk.io Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=15768000 content-encoding gzip age 3145 x-cache HIT status 200 content-length 6908 x-served-by cache-hhn4033-HHN access-control-allow-origin * last-modified Sat, 12 Sep 2020 15:38:14 GMT server Apache x-timer S1599928239.296609,VS0,VE1 date Sat, 12 Sep 2020 16:30:39 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 via 1.1 varnish expires Sat, 19 Sep 2020 15:38:14 GMT cache-control max-age=604800 x-ua-compatible IE=edge accept-ranges bytes timing-allow-origin * x-cache-hits 1
GET H2	200	5698.js Show response script.crazyegg.com/pages/scripts/0082/	5 KB 2 KB	33ms 14ms	Script text/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0082/5698.js Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a511bbc463bfebf684ad855e0eda027ad790505c59e5f2e07c4314fabf50ba8a Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding gzip cf-cache-status HIT ce-version 11.1.68 age 83261 cf-polished origSize=5596 status 200 cf-request-id 0524c09c730000e00bd4318200000001 last-modified Fri, 11 Sep 2020 17:22:58 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 cf-ray 5d1b03a718c4e00b-FRA cf-bgj minify
GET H2	200	snyk-wordmark.svg snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/images/svg/	1 KB 894 B	14ms 10ms	Image image/svg+xml	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/images/svg/snyk-wordmark.svg Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash e92a3b8acbb1c63765361e86bbd651315782091aa8d792fe4a9768d3605b6282 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding gzip x-content-type-options nosniff status 200 vary Accept-Encoding content-length 613 x-xss-protection 1; mode=block last-modified Tue, 14 May 2019 08:26:40 GMT server nginx x-frame-options deny etag W/"5cda7bc0-420" strict-transport-security max-age=31536000; preload content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31032767 expires Mon, 06 Sep 2021 20:43:26 GMT
GET H2	200	blog-main-2048x521.png snyk.io/wp-content/uploads/	385 KB 386 KB	35ms 32ms	Image image/png	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://snyk.io/wp-content/uploads/blog-main-2048x521.png Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 7cc18abdb44f648d8667a181f2a6b88b8bf1289eaeee1b12435396ca70d9c042 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT x-content-type-options nosniff last-modified Mon, 24 Aug 2020 11:34:27 GMT server nginx status 200 etag "5f43a5c3-604d5" x-frame-options deny content-type image/png access-control-allow-origin * cache-control public, max-age=29878316 strict-transport-security max-age=31536000; preload accept-ranges bytes content-length 394453 x-xss-protection 1; mode=block expires Tue, 24 Aug 2021 12:02:35 GMT
GET H2	200	v2.js Show response js.hsforms.net/forms/	471 KB 117 KB	47ms 30ms	Script application/javascript	2606:4700::6811:b949 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsforms.net/forms/v2.js Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b949 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 87084c63177018304f268bc9aa7d9f634f18e6350da0d19727c6da86acff4d7e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT via 1.1 08f45c153a856ff7955174d0e6f60745.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status HIT age 41 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront status 200 x-amz-replication-status COMPLETED content-encoding br content-type application/javascript; charset=utf-8 cf-request-id 0524c09c3900002b223da78200000001 last-modified Tue, 25 Aug 2020 11:42:36 UTC server cloudflare etag W/"8a61476307dd2bf8710a1920187b2d0e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-version-id VtG_xLog2aijo4fP2MlCLEZx5yNY4rbV access-control-allow-origin * cache-control s-maxage=600, max-age=0 x-amz-cf-pop IAD89-C3 cf-ray 5d1b03a6ce322b22-FRA x-amz-cf-id e_f0hW5tSxf04fcVH7fIh2nJ18xGjEpcKJyNFVI9lzHlzw1jG6YfsQ==
GET H/1.1	200 OK	widgets.js Show response platform.twitter.com/	95 KB 29 KB	156ms 40ms	Script application/javascript	192.229.233.25 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets.js Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 192.229.233.25 Los Angeles, United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (mil/6CE7) / Resource Hash a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 12 Sep 2020 16:30:39 GMT Content-Encoding gzip Vary Accept-Encoding Age 187 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Content-Length 28881 x-tw-cdn VZ Last-Modified Tue, 01 Sep 2020 20:40:54 GMT Server ECS (mil/6CE7) Etag "a58136137a93f33c1d165df7d4d973f8+gzip" Access-Control-Max-Age 3000 Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control public, max-age=1800
GET H2	200	20200228_201942.jpg snyk.io/wp-content/uploads/	74 KB 75 KB	17ms 14ms	Image image/jpeg	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://snyk.io/wp-content/uploads/20200228_201942.jpg Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 4fe0af150eea6e7105f2e0c30e198906eaa2b4f53f2b5297d1a7f1c2d122816b Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT x-content-type-options nosniff last-modified Wed, 25 Mar 2020 17:38:29 GMT server nginx status 200 etag "5e7b9715-1295d" x-frame-options deny content-type image/jpeg access-control-allow-origin * cache-control public, max-age=27994720 strict-transport-security max-age=31536000; preload accept-ranges bytes content-length 76125 x-xss-protection 1; mode=block expires Mon, 02 Aug 2021 16:49:19 GMT
GET H2	200	Group-18-1-1.png snyk.io/wp-content/uploads/	61 KB 61 KB	19ms 17ms	Image image/png	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://snyk.io/wp-content/uploads/Group-18-1-1.png Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash b927e69b10cd7716da11ba8cd0a8f1a070abdb2e4cb4ead42130d66d13b3e232 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT x-content-type-options nosniff last-modified Mon, 24 Aug 2020 13:11:17 GMT server nginx status 200 etag "5f43bc75-f3b2" x-frame-options deny content-type image/png access-control-allow-origin * cache-control public, max-age=31224482 strict-transport-security max-age=31536000; preload accept-ranges bytes content-length 62386 x-xss-protection 1; mode=block expires Thu, 09 Sep 2021 01:58:41 GMT
GET H2	200	logo.svg snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/images/svg/	8 KB 4 KB	26ms 24ms	Image image/svg+xml	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/images/svg/logo.svg Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 433000795cb0a9c8d636bd06a642060e15d14784b51d8d678a0b10046a0cb3a1 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding gzip x-content-type-options nosniff status 200 vary Accept-Encoding content-length 3575 x-xss-protection 1; mode=block last-modified Tue, 14 May 2019 08:26:40 GMT server nginx x-frame-options deny etag W/"5cda7bc0-1e78" strict-transport-security max-age=31536000; preload content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=27272639 expires Sun, 25 Jul 2021 08:14:38 GMT
GET H2	200	main-1009.js Show response snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/scripts/	371 KB 100 KB	27ms 25ms	Script application/javascript	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/scripts/main-1009.js Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 1788423e809b7110c04bf0d36acfc44390fceb2e35cc96abfd96a60217d4d5b8 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 10 Sep 2020 10:05:35 GMT server nginx status 200 etag W/"5f59fa6f-5ccf8" x-frame-options deny content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 strict-transport-security max-age=31536000; preload vary Accept-Encoding content-length 102231 x-xss-protection 1; mode=block
GET H2	200	wp-embed.min.js Show response snyk.io/wp-includes/js/	1 KB 1 KB	33ms 31ms	Script application/javascript	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snyk.io/wp-includes/js/wp-embed.min.js?ver=5.4.2 Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding gzip x-content-type-options nosniff last-modified Sat, 26 Oct 2019 00:17:07 GMT server nginx status 200 etag W/"5db39083-59a" x-frame-options deny content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 strict-transport-security max-age=31536000; preload vary Accept-Encoding content-length 769 x-xss-protection 1; mode=block
GET H3-Q050	200	css fonts.googleapis.com/	14 KB 1 KB	36ms 23ms	Stylesheet text/css	2a00:1450:4001:814::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,500i Requested by Host: snyk.io URL: https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/main-1109.css Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 7b2794043603e97ec35a95f6884a96780f80286fc30112ac68d804b3fb2d00bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/main-1109.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 12 Sep 2020 16:23:30 GMT server ESF date Sat, 12 Sep 2020 16:30:39 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 12 Sep 2020 16:30:39 GMT
GET H2	200	analytics.min.js Show response cdn.segment.com/analytics.js/v1/UspolAZH46ZIH3mN3bdf7rx63q24gitb/	401 KB 79 KB	763ms 691ms	Script text/javascript	99.86.0.85 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.segment.com/analytics.js/v1/UspolAZH46ZIH3mN3bdf7rx63q24gitb/analytics.min.js Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 99.86.0.85 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-0-85.fra6.r.cloudfront.net Software AmazonS3 / Resource Hash bbf7bee22473780d18c561dfba8e8d8aa6f998c0beba65c84ab24c48e8d47eb4 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id 6mr7wD0snBwzV7x2_7gP3tOaFR4cGJBY content-encoding gzip etag "d37b2149338c14bc90d140dbeb391bd6" x-amz-cf-pop FRA6-C1 x-cache RefreshHit from cloudfront status 200 x-amz-replication-status COMPLETED content-length 79829 access-control-allow-origin * last-modified Fri, 04 Sep 2020 20:51:13 GMT server AmazonS3 date Sat, 12 Sep 2020 16:30:40 GMT access-control-max-age 3000 access-control-allow-methods GET, HEAD content-type text/javascript; charset=utf-8 via 1.1 3095e870e1a1a1b03178e40ab1872de5.cloudfront.net (CloudFront) cache-control public, max-age=300 accept-ranges bytes x-amz-cf-id 6el5_nvJ1hTkZZWEdUEOoC2VKAFFn9pKB1mqoCLFlVCsSyVAjpjnaA==
GET DATA	200 OK	truncated /	200 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0ffad23e9072a87e4086aa3cfd3cd8812d70cdf1555d5c3883ca178871d84ec4 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	180 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cc5fb6461d3b1d62fd3953a5db6eae25d87dba2e6345417416648cc16a70eb54 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	prenton-regular.woff snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/fonts/	119 KB 120 KB	32ms 31ms	Font font/woff	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/fonts/prenton-regular.woff Requested by Host: snyk.io URL: https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/main-1109.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 27aa4691b6b6c4124e48c31507d5f4d06ce5b8e605539f26dc1ab8a9d4607c90 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Origin https://snyk.io Referer https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/main-1109.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT x-content-type-options nosniff last-modified Tue, 14 May 2019 08:26:40 GMT server nginx status 200 etag "5cda7bc0-1dc7e" x-frame-options deny content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 strict-transport-security max-age=31536000; preload accept-ranges bytes content-length 121982 x-xss-protection 1; mode=block
GET H2	200	prenton-medium.woff snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/fonts/	121 KB 122 KB	37ms 36ms	Font font/woff	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/fonts/prenton-medium.woff Requested by Host: snyk.io URL: https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/main-1109.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 02172ae8e82ddc260a421e15a727c4737c8051a169b9de6ab6f56ba8d6519f24 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Origin https://snyk.io Referer https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/main-1109.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 123 date Sat, 12 Sep 2020 16:30:39 GMT x-content-type-options nosniff x-edgeconnect-midmile-rtt 0 status 200 content-length 124121 x-xss-protection 1; mode=block last-modified Tue, 14 May 2019 08:26:40 GMT server nginx x-frame-options deny etag "5cda7bc0-1e4d9" strict-transport-security max-age=31536000; preload content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes
GET H2	200	58ba0d4b-160b-4760-90e7-ff84e98a46d0 Show response forms.hsforms.com/embed/v3/form/1699665/	24 KB 5 KB	276ms 260ms	Script application/javascript	2606:4700::6810:5505 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hsforms.com/embed/v3/form/1699665/58ba0d4b-160b-4760-90e7-ff84e98a46d0?callback=hs_reqwest_0&hutk= Requested by Host: js.hsforms.net URL: https://js.hsforms.net/forms/v2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5505 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 63c37c262100547deedf97493c72047e711aaeecb6b2f8f381aa49aa1b67746c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC status 200 content-disposition attachment; filename=no-rfd.txt vary Accept-Encoding cf-request-id 0524c09caa00001f31e5265200000001 server cloudflare x-trace 2BBDAB5A066F5FE77CB96D1517DD2BF55A4C3EB336000000000000000000 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript;charset=utf-8 cache-control max-age=0, no-cache, no-store access-control-allow-credentials false cf-ray 5d1b03a77eb51f31-FRA
GET H2	200	fontawesome-webfont_af7ae505.woff2 snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/vendor/	75 KB 76 KB	9ms 8ms	Font font/woff2	2a02:26f0:133:294::ecd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/vendor/fontawesome-webfont_af7ae505.woff2 Requested by Host: snyk.io URL: https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/main-1109.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:133:294::ecd , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software nginx / Resource Hash 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Origin https://snyk.io Referer https://snyk.io/wp-content/themes/snyk_v2_etyhadar/dist/styles/main-1109.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT x-content-type-options nosniff last-modified Tue, 14 May 2019 08:26:40 GMT server nginx status 200 etag "5cda7bc0-12d68" x-frame-options deny content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 strict-transport-security max-age=31536000; preload accept-ranges bytes content-length 77160 x-xss-protection 1; mode=block
GET H2	200	MMuL5MaQeLM www.youtube.com/embed/ Frame C54D	0 0	94ms 72ms	Document text/html	2a00:1450:4001:820::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/embed/MMuL5MaQeLM?feature=oembed Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software YouTube Frontend Proxy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority www.youtube.com :scheme https :path /embed/MMuL5MaQeLM?feature=oembed pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Response headers status 200 strict-transport-security max-age=31536000 x-content-type-options nosniff expires Tue, 27 Apr 1971 19:44:06 GMT content-length 10772 p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." content-encoding br cache-control no-cache content-type text/html; charset=utf-8 date Sat, 12 Sep 2020 16:30:39 GMT server YouTube Frontend Proxy x-xss-protection 0 set-cookie VISITOR_INFO1_LIVE=2lhQ2LyiY8M; path=/; domain=.youtube.com; secure; expires=Thu, 11-Mar-2021 16:30:39 GMT; httponly; samesite=None YSC=4PKQa0SVFn0; path=/; domain=.youtube.com; secure; httponly; samesite=None GPS=1; path=/; domain=.youtube.com; expires=Sat, 12-Sep-2020 17:00:39 GMT VISITOR_INFO1_LIVE=2lhQ2LyiY8M; path=/; domain=.youtube.com; secure; expires=Thu, 11-Mar-2021 16:30:39 GMT; httponly; samesite=None alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	15 KB 7 KB	131ms 40ms	Script application/javascript	104.111.229.31 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.229.31 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-229-31.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash f8e9b5bec9f48d639838d32b29d6713fece521a5d96913cc37a267a69b7e598b Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 12 Sep 2020 16:30:39 GMT Content-Encoding gzip Last-Modified Tue, 28 Jul 2020 17:10:34 GMT Server nginx/1.14.0 (Ubuntu) ETag "5f205c0a-3a07" Vary Accept-Encoding Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Access-Control-Max-Age 86400 Access-Control-Allow-Credentials true Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 6080
GET H2	200	11.1.68.js Show response script.crazyegg.com/pages/versioned/common-scripts/	70 KB 23 KB	16ms 16ms	Script text/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/11.1.68.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0082/5698.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 48d02d1758575a3ee0e7ba8a0a1c29666b4f55a00d1bf15fd1703897febf4cdb Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT content-encoding gzip cf-cache-status HIT age 83387 cf-polished origSize=71592 status 200 cf-request-id 0524c09d0c0000e00bd431d200000001 last-modified Fri, 17 Jul 2020 16:40:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000, s-maxage=31536000 cf-ray 5d1b03a81a45e00b-FRA cf-bgj minify
GET H/1.1	200 OK	widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html platform.twitter.com/widgets/ Frame 1BC4	0 0	58ms 37ms	Document text/html	192.229.233.25 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fsnyk.io Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 192.229.233.25 Los Angeles, United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (mil/6CF6) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Response headers Content-Encoding gzip Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 244999 Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Sat, 12 Sep 2020 16:30:39 GMT Etag "9fa476ae827f556d5b037fe43632370d+gzip" Last-Modified Tue, 01 Sep 2020 17:58:17 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (mil/6CF6) Vary Accept-Encoding X-Cache HIT x-tw-cdn VZ Content-Length 5825
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 363 B	123ms 39ms	XHR text/plain	104.111.229.31 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.229.31 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-229-31.deploy.static.akamaitechnologies.com Software / Resource Hash 8a2a052841200e6e1b4fa7f5dd2c93b930e6ca50a4b53b40dc9c1356df8743aa Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 12 Sep 2020 16:30:39 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://snyk.io Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 699 B	130ms 47ms	XHR application/json	185.33.221.13 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.17.9 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Sat, 12 Sep 2020 16:30:39 GMT X-Proxy-Origin 185.156.175.131; 185.156.175.131; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.108:80 AN-X-Request-Uuid 310ae542-41a1-4183-aae6-220e69cd419b Server nginx/1.17.9 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://snyk.io Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	204	/ lux.speedcurve.com/error/	0 149 B	114ms 38ms	Image text/plain	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://lux.speedcurve.com/error/?v=206&id=80837559&fn=https%3A%2F%2Fsnyk.io%2Fwp-content%2Fthemes%2Fsnyk_v2_etyhadar%2Fresources%2Fassets%2Fscripts%2Fjquery3.4.1.min.js%3Fver%3D5.4.2&ln=2&cn=31118&msg=Uncaught%20TypeError%3A%20Cannot%20read%20property%20%27replace%27%20of%20null&l=Sourmint-malicious-code-ad-fraud-and-data-leak-in-ios&ct=4G Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:39 GMT via 1.1 varnish server Varnish x-timer S1599928240.581770,VS0,VE1 x-served-by cache-hhn4074-HHN x-cache HIT status 204 accept-ranges bytes access-control-allow-origin * retry-after 0 x-cache-hits 0
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	306ms 216ms	Image image/gif	104.111.229.31 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=50d389da3b3e04f03e03d1239ba98024&svisitor=36bb1002547d0000aff75c5fc3010000ef0d0000&visitor=e4e712d9-5be5-41b8-8c80-b3c6ae52dd66&session=374240b7-a151-490e-8e47-1ce52c15783a&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Snyk%20research%20team%20has%20uncovered%20malicious%20code%20used%20for%20ad%20fraud%20in%20a%20popular%20Advertising%20SDK%20used%20by%20over%201%2C200%20apps%20in%20the%20AppStore.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk%22%7D&cb=28239610&r=&thirdParty=%7B%7D&pageURL=https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.229.31 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-229-31.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 12 Sep 2020 16:30:39 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	p Show response api.segment.io/v1/	21 B 136 B	599ms 199ms	XHR application/json	35.161.94.74 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.segment.io/v1/p Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/UspolAZH46ZIH3mN3bdf7rx63q24gitb/analytics.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.161.94.74 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-161-94-74.us-west-2.compute.amazonaws.com Software / Resource Hash 12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers status 200 date Sat, 12 Sep 2020 16:30:40 GMT access-control-allow-origin https://snyk.io content-length 21 vary Origin content-type application/json
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	135 KB 34 KB	20ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/UspolAZH46ZIH3mN3bdf7rx63q24gitb/analytics.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 34302 x-xss-protection 0 pragma public x-fb-debug WwzxskMkjfRxMdliYb+g6kbvWFDaFCwDNLBfqmWNkiO5cU3tm2rychf0pzxa5/5LRJEfEsxsrc+P3dGDaYIw7g== x-fb-trip-id 664085054 x-frame-options DENY date Sat, 12 Sep 2020 16:30:40 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	29 KB 12 KB	100ms 37ms	Script text/javascript	172.217.16.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/UspolAZH46ZIH3mN3bdf7rx63q24gitb/analytics.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s46-in-f2.1e100.net Software cafe / Resource Hash 2d25f06ba5a1e228262948c457155e24a1d91bfb5dad460bd1dcfe2106011f20 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:40 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 11315 x-xss-protection 0 server cafe etag 17904044164015545428 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Sat, 12 Sep 2020 16:30:40 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	964 B 759 B	32ms 10ms	Script application/x-javascript	2a02:26f0:10c:5b5::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/UspolAZH46ZIH3mN3bdf7rx63q24gitb/analytics.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:5b5::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash b5840616d8bf9540bbe45a42f6841f92b78c70dabd3b8ee60abb51e79c47d5d6 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 12 Sep 2020 16:30:40 GMT Content-Encoding gzip Last-Modified Thu, 03 Sep 2020 20:41:55 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=36640 Connection keep-alive Accept-Ranges bytes Content-Length 446
GET H2	200	analytics.js Show response www.google-analytics.com/	45 KB 18 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:80b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/UspolAZH46ZIH3mN3bdf7rx63q24gitb/analytics.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 19 Aug 2020 20:46:40 GMT server Golfe2 age 7019 date Sat, 12 Sep 2020 14:33:41 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18323 expires Sat, 12 Sep 2020 16:33:41 GMT
GET H2	200	1699665.js Show response js.hs-analytics.net/analytics/1599928500000/	60 KB 18 KB	190ms 172ms	Script text/javascript	2606:4700::6811:46b0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1599928500000/1699665.js Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/UspolAZH46ZIH3mN3bdf7rx63q24gitb/analytics.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6811:46b0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1aa8484e4ac5dc01fe1bbbd2d41d909ffac3471e9b976698088effd9dd99af73 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:40 GMT content-encoding br cf-cache-status MISS x-amz-request-id BE78FAD3A3FA06B1 x-amz-server-side-encryption AES256 cf-ray 5d1b03ac6dd1c286-FRA status 200 x-amz-id-2 hjC7NwzhOP6Mn5lqVvBnn889O2t3jG5xEjIJpxvs07XabbB/24nrVCnuPw3cT4H1K4axvP05fEM= last-modified Thu, 10 Sep 2020 12:03:37 GMT server cloudflare etag W/"9f7715f0e3cd42d21152694aea8c1b94" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-amz-version-id null cache-control max-age=300, public access-control-allow-credentials false cf-request-id 0524c09fc00000c2867a34c200000001 content-type text/javascript expires Sat, 12 Sep 2020 16:35:40 GMT
GET H2	200	shim.latest.js Show response js.intercomcdn.com/ Redirect Chain https://widget.intercom.io/widget/ksrvzmf2 https://js.intercomcdn.com/shim.latest.js	7 KB 3 KB	110ms 34ms	Script application/javascript	99.86.2.19 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.intercomcdn.com/shim.latest.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 99.86.2.19 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-2-19.fra6.r.cloudfront.net Software AmazonS3 / Resource Hash 10419c83b64260a49d77b9a5f8a40fd2877e9b51e8300949f95afb07c92a6e35 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:03 GMT content-encoding gzip age 37 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront status 200 content-length 2946 last-modified Fri, 11 Sep 2020 17:07:42 GMT server AmazonS3 etag "5c02be5b1ab2f87977fee686284d5333" content-type application/javascript; charset=UTF-8 via 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront) cache-control max-age=300, s-maxage=300, public x-amz-cf-pop FRA6-C1 accept-ranges bytes x-amz-cf-id 72pBKQvh_3gXlQqycgr2jP35xjqv92cFvbQkc4YB_YZbIZMcMySQdg== Redirect headers date Fri, 11 Sep 2020 13:21:41 GMT via 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront) server AmazonS3 age 97740 status 302 x-cache Hit from cloudfront location https://js.intercomcdn.com/shim.latest.js x-amz-cf-pop FRA6-C1 content-length 0 x-amz-cf-id Y8H7fRaNSqlqiVOEZuMREvV0NjoVbiIsDgH0otOGt5KH4wyXOghD3g==
GET H3-Q050	200	js Show response www.google-analytics.com/gtm/	100 KB 36 KB	43ms 30ms	Script application/javascript	2a00:1450:4001:80b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-K59728M&cid=652994526.1599928240 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 89b6c1ff3aa8b0f1147b382eeb3225dcb9c44bb547d42aa9f505ca8ec2003c22 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:40 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control status 200 vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36070 x-xss-protection 0 expires Sat, 12 Sep 2020 16:30:40 GMT
GET H2	200	identity.js Show response connect.facebook.net/signals/plugins/	43 KB 11 KB	6ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/plugins/identity.js?v=2.9.24 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash b72031ab9ee0b637634d8b4c5ea7d5c9c1286acaa1a5f3f8c43d3a8f5fa82664 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 10760 x-xss-protection 0 pragma public x-fb-debug v4I4C/vapqrA3BxcHBfpsqEOKOG19IyQVeJ9NSEtFqMbSPflaH4qWdXceuiSLxCKmVl9RfRu4Z8xm/As9mFqMA== x-fb-trip-id 664085054 x-frame-options DENY date Sat, 12 Sep 2020 16:30:40 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self'; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	451468715046970 Show response connect.facebook.net/signals/config/	524 KB 132 KB	66ms 66ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/451468715046970?v=2.9.24&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 198b5dd4d259de009790c13c07e81526c7637d3085f03f9e9a500335378f0b38 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 x-xss-protection 0 pragma public x-fb-debug YPskwX2rAIHAQlrdD4QOiZat/RI1pqFNSD5ef0GXsqplVpesl1888TTe6d8MooLdCGxMQZnvneKrIzR7lwYFjg== x-fb-trip-id 664085054 x-frame-options DENY date Sat, 12 Sep 2020 16:30:40 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	3 KB 2 KB	10ms 9ms	Script application/x-javascript	2a02:26f0:10c:5b5::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:5b5::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 12 Sep 2020 16:30:40 GMT Content-Encoding gzip Last-Modified Thu, 03 Sep 2020 20:29:41 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=25552 Connection keep-alive Accept-Ranges bytes Content-Length 1576
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=970508&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&time=1599928240093 https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D970508%26url%3Dhttps%253A%252F%252Fsnyk.io%252Fblog%252Fsourmint-malicious-code-a... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=970508&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&time=1599928240093&liSync=true	0 57 B	103ms 102ms	Image application/javascript	2a05:f500:10:101::b93f:9105 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=970508&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&time=1599928240093&liSync=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:40 GMT server Play linkedin-action 1 x-li-fabric prod-lva1 status 200 x-li-proto http/2 x-li-pop prod-efr5 content-type application/javascript content-length 0 x-li-uuid FGOPA0IWNBYgk2173CoAAA== Redirect headers content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-content-type-options nosniff linkedin-action 1 status 302 content-length 0 x-li-uuid Y8tW/UEWNBYALTCpAysAAA== pragma no-cache x-li-pop afd-prod-edc2 x-msedge-ref Ref A: B72AA453351344A18A53C80BA62839D7 Ref B: FRAEDGE1114 Ref C: 2020-09-12T16:30:40Z x-frame-options sameorigin date Sat, 12 Sep 2020 16:30:39 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" strict-transport-security max-age=2592000 x-li-fabric prod-lva1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=970508&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&time=1599928240093&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 81 B	14ms 14ms	XHR text/plain	2a00:1450:400c:c00::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j85&tid=UA-69111857-1&cid=652994526.1599928240&jid=701946048&gjid=1871439551&_gid=330223345.1599928240&_u=aGBAgEADQAAAAE~&z=1673105227 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Sat, 12 Sep 2020 16:30:40 GMT status 200 content-type text/plain access-control-allow-origin https://snyk.io cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	collect www.google-analytics.com/	35 B 210 B	6ms 6ms	Image image/gif	2a00:1450:4001:80b::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j85&a=566588457&t=pageview&_s=1&dl=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&dp=%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&ul=en-us&de=UTF-8&dt=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgEADQ~&jid=701946048&gjid=1871439551&cid=652994526.1599928240&tid=UA-69111857-1&_gid=330223345.1599928240&z=351174158 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 11 Sep 2020 19:28:08 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 75752 status 200 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 106 B	18ms 18ms	Image image/gif	2a00:1450:4001:800::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j85&tid=UA-69111857-1&cid=652994526.1599928240&jid=701946048&_u=aGBAgEADQAAAAE~&z=908035444 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 12 Sep 2020 16:30:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 106 B	17ms 17ms	Image image/gif	2a00:1450:4001:81b::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j85&tid=UA-69111857-1&cid=652994526.1599928240&jid=701946048&_u=aGBAgEADQAAAAE~&z=908035444 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 12 Sep 2020 16:30:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ Show response www.googleadservices.com/pagead/conversion/923832244/	2 KB 1 KB	16ms 15ms	Script text/javascript	2a00:1450:4001:821::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion/923832244/?random=1599928240158&cv=9&fst=1599928240158&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&tiba=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 1ad1dd5fa26305acc92318a07297474a2b43bfa0934635d380c953d748854cfa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 12 Sep 2020 16:30:40 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 1092 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/923832244/	3 KB 1 KB	22ms 21ms	Script text/javascript	2a00:1450:4001:821::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/923832244/?random=1599928240162&cv=9&fst=1599928240162&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&data=path%3D%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F%3Breferrer%3D%3Bsearch%3D%3Btitle%3DSourMint%3A%20malicious%20code%5C%2C%20ad%20fraud%5C%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk%3Burl%3Dhttps%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&frm=0&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&tiba=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 32919a7e36c9fdfd6bbcdabad80b397817f7bec5d881065f6ae74877d5f0ba8a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 12 Sep 2020 16:30:40 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 1120 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 265 B	18ms 5ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=451468715046970&ev=PageView&dl=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&rl=&if=false&ts=1599928240180&sw=1600&sh=1200&v=2.9.24&r=stable&a=seg&ec=0&o=30&fbp=fb.1.1599928240179.1164027557&it=1599928240079&coo=false&dpo=LDU&dpoco=0&dpost=0&exp=s1&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:40 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Sat, 12 Sep 2020 16:30:40 GMT
GET H3-Q050	200	/ www.google.de/pagead/1p-conversion/923832244/ Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/923832244/?random=102932173&cv=9&fst=*&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_t... https://www.google.com/pagead/1p-conversion/923832244/?random=102932173&cv=9&fst=*&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_... https://www.google.de/pagead/1p-conversion/923832244/?random=102932173&cv=9&fst=*&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_n...	42 B 65 B	24ms 22ms	Image image/gif	2a00:1450:4001:81b::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-conversion/923832244/?random=102932173&cv=9&fst=*&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/&tiba=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=sPdcX5O3Cpyv3gPAwJyYCw&cid=CAQSKQCNIrLMkD97yTGLDgkEjud0pNdd7AwlxTSVqaywhYsaq6WpooSqHTTQ&random=2744433126&resp=GooglemKTybQhCsO&ipr=y Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 12 Sep 2020 16:30:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Sat, 12 Sep 2020 16:30:40 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type image/gif location https://www.google.de/pagead/1p-conversion/923832244/?random=102932173&cv=9&fst=*&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/&tiba=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=sPdcX5O3Cpyv3gPAwJyYCw&cid=CAQSKQCNIrLMkD97yTGLDgkEjud0pNdd7AwlxTSVqaywhYsaq6WpooSqHTTQ&random=2744433126&resp=GooglemKTybQhCsO&ipr=y cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.com/pagead/1p-user-list/923832244/	42 B 65 B	76ms 27ms	Image image/gif	2a00:1450:4001:800::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/923832244/?random=1599928240162&cv=9&fst=1599926400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&data=path%3D%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F%3Breferrer%3D%3Bsearch%3D%3Btitle%3DSourMint%3A%20malicious%20code%5C%2C%20ad%20fraud%5C%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk%3Burl%3Dhttps%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&frm=0&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&tiba=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&async=1&fmt=3&is_vtc=1&random=2939600793&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 12 Sep 2020 16:30:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.de/pagead/1p-user-list/923832244/	42 B 538 B	76ms 27ms	Image image/gif	2a00:1450:4001:81b::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/923832244/?random=1599928240162&cv=9&fst=1599926400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&data=path%3D%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F%3Breferrer%3D%3Bsearch%3D%3Btitle%3DSourMint%3A%20malicious%20code%5C%2C%20ad%20fraud%5C%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk%3Burl%3Dhttps%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&frm=0&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&tiba=SourMint%3A%20malicious%20code%2C%20ad%20fraud%2C%20and%20data%20leak%20in%20iOS%20%7C%20Snyk&async=1&fmt=3&is_vtc=1&random=2939600793&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 12 Sep 2020 16:30:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	1699665.js Show response js.hs-scripts.com/	793 B 860 B	146ms 129ms	Script application/javascript	2606:4700::6811:d6cc CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/1699665.js Requested by Host: js.hs-analytics.net URL: https://js.hs-analytics.net/analytics/1599928500000/1699665.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6811:d6cc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d13af50075e9391a2aca15b977d3c8dfed0bb94159159774a0563f3677d800ce Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:40 GMT content-encoding br vary Accept-Encoding cf-cache-status EXPIRED status 200 cf-request-id 0524c0a091000005c49c2df200000001 server cloudflare x-trace 2BA7E418E821B48C5051719FDF9E2C1E74BFCD2D9C000000000000000000 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://snyk.io cache-control public, max-age=60 access-control-allow-credentials true cf-ray 5d1b03adbe6905c4-FRA expires Sat, 12 Sep 2020 16:31:40 GMT
GET H2	200	__ptq.gif track.hubspot.com/	45 B 128 B	44ms 27ms	Image image/gif	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=17&fi=58ba0d4b-160b-4760-90e7-ff84e98a46d0&fci=832510d0-8635-48ec-b889-5e2f3e16d664&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2017058934&v=1.1&a=1699665&rcu=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&pu=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&t=SourMint%3A+malicious+code%2C+ad+fraud%2C+and+data+leak+in+iOS+%7C+Snyk&cts=1599928240246&vi=00ecdbd914797eb060a8a7c08f7c6481&nc=true&ce=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cf-ray 5d1b03adbd6c178a-FRA date Sat, 12 Sep 2020 16:30:40 GMT cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding p3p CP="NOI CUR ADM OUR NOR STA NID" status 200 cache-control no-cache, no-store, no-transform access-control-allow-credentials false strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/gif content-length 45 cf-request-id 0524c0a0910000178a3204a200000001 x-robots-tag none
GET H2	200	__ptq.gif track.hubspot.com/	45 B 128 B	42ms 25ms	Image image/gif	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=15&fi=58ba0d4b-160b-4760-90e7-ff84e98a46d0&fci=832510d0-8635-48ec-b889-5e2f3e16d664&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2017058934&v=1.1&a=1699665&rcu=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&pu=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&t=SourMint%3A+malicious+code%2C+ad+fraud%2C+and+data+leak+in+iOS+%7C+Snyk&cts=1599928240252&vi=00ecdbd914797eb060a8a7c08f7c6481&nc=true&ce=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cf-ray 5d1b03adbd6e178a-FRA date Sat, 12 Sep 2020 16:30:40 GMT cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding p3p CP="NOI CUR ADM OUR NOR STA NID" status 200 cache-control no-cache, no-store, no-transform access-control-allow-credentials false strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/gif content-length 45 cf-request-id 0524c0a0910000178a3204b200000001 x-robots-tag none
GET H2	200	__ptq.gif track.hubspot.com/	45 B 527 B	37ms 20ms	Image image/gif	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2017058934&v=1.1&a=1699665&rcu=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&pu=https%3A%2F%2Fsnyk.io%2Fblog%2Fsourmint-malicious-code-ad-fraud-and-data-leak-in-ios%2F&t=SourMint%3A+malicious+code%2C+ad+fraud%2C+and+data+leak+in+iOS+%7C+Snyk&cts=1599928240254&vi=00ecdbd914797eb060a8a7c08f7c6481&nc=true&ce=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cf-ray 5d1b03adbd70178a-FRA date Sat, 12 Sep 2020 16:30:40 GMT cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding p3p CP="NOI CUR ADM OUR NOR STA NID" status 200 cache-control no-cache, no-store, no-transform access-control-allow-credentials false strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/gif content-length 45 cf-request-id 0524c0a0910000178a3204c200000001 x-robots-tag none
GET H2	200	/ Show response lux.speedcurve.com/lux/	44 B 141 B	38ms 38ms	Script application/javascript	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://lux.speedcurve.com/lux/?v=206&id=80837559&sid=159992823940063831&uid=159992823940063831&l=Sourmint-malicious-code-ad-fraud-and-data-leak-in-ios&NT=1599928238492fs0ds1de19cs19sc24ce32qs32bs622be623ol625oi845os874oe874oc1550ls1550le1553sr746fc746lc920&LJS=d2t73f37c1n113e1r100x6908l707s908&PS=ns24bs1is6469ss4bc4ic36529ia3it15dd10nd609vh1200vw1600dh7799dw1600ds14140ct4G_er1nt0dm8&CPU=s|0,n|0,d|0,x|0,i|746&HN=snyk.io&CLS=0.010735&UT=LUX_end|1765 Requested by Host: cdn.speedcurve.com URL: https://cdn.speedcurve.com/js/lux.js?id=80837559 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash 259401767b8c5270a3c1eb53ae8097afa6b78f8865078181cfbbcebe624f1cef Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 16:30:40 GMT via 1.1 varnish server Varnish x-timer S1599928240.290365,VS0,VE0 x-served-by cache-hhn4074-HHN x-cache HIT content-type application/javascript status 200 accept-ranges bytes access-control-allow-origin * content-length 44 retry-after 0 x-cache-hits 0
GET H2	200	frame-modern.6e7ffae8.js Show response js.intercomcdn.com/ Frame 6EC7	225 KB 63 KB	41ms 41ms	Script application/javascript	99.86.2.19 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.intercomcdn.com/frame-modern.6e7ffae8.js Requested by Host: widget.intercom.io URL: https://widget.intercom.io/widget/ksrvzmf2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 99.86.2.19 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-2-19.fra6.r.cloudfront.net Software AmazonS3 / Resource Hash 272d8a32f09298557de3cf352dd234ad2cbf26839d3666ea890d6596afa760d2 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 15:07:54 GMT content-encoding gzip age 4967 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront status 200 content-length 63556 last-modified Fri, 11 Sep 2020 16:51:16 GMT server AmazonS3 etag "0fd9e20ea7e1aff9c0df4b3425716785" content-type application/javascript; charset=UTF-8 via 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront) cache-control max-age=31536000, s-maxage=7200, public x-amz-cf-pop FRA6-C1 accept-ranges bytes x-amz-cf-id bTsLtp2shVE4eDSTUBAXivtY5T0gC_HHkNb19pf22FcmkVjbzui29w==
GET H2	200	vendor-modern.bb732e20.js Show response js.intercomcdn.com/ Frame 6EC7	173 KB 52 KB	41ms 41ms	Script application/javascript	99.86.2.19 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.intercomcdn.com/vendor-modern.bb732e20.js Requested by Host: widget.intercom.io URL: https://widget.intercom.io/widget/ksrvzmf2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 99.86.2.19 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-2-19.fra6.r.cloudfront.net Software AmazonS3 / Resource Hash ac64f60bc9b2e105dcc02a7df96d0fcb9933eb403ccc2d019f794c0b4d69a9c0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 15:07:52 GMT content-encoding gzip age 4969 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront status 200 content-length 52752 last-modified Fri, 11 Sep 2020 16:51:16 GMT server AmazonS3 etag "6e33116b4b4c50301db3a7360d73ee0d" content-type application/javascript; charset=UTF-8 via 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront) cache-control max-age=31536000, s-maxage=7200, public x-amz-cf-pop FRA6-C1 accept-ranges bytes x-amz-cf-id i70mC8iz0OhkLeG6j5hAORF2A7gyk0KKWPRQbkvY7UJvjqZFM5IBXA==
GET H2	200	main.js Show response assets.trendemon.com/scripts/2025/	196 KB 57 KB	144ms 53ms	Script application/javascript	143.204.215.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets.trendemon.com/scripts/2025/main.js Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.88 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-88.fra53.r.cloudfront.net Software / Express Resource Hash bc2253ee5ca0415b3461dbe0d04ee995278f6ce98628d95e934c1981ce1a5b53 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 12:53:12 GMT content-encoding gzip age 51942 x-powered-by Express x-cache Hit from cloudfront status 200 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) trd-ts 2020-09-09T09:08:47.629Z last-modified Wed, 09 Sep 2020 09:07:05 GMT x-sent true etag W/"30f3b-174721e5918" vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * x-timestamp 1599642527632 cache-control public, max-age=86400 x-amz-cf-pop FRA53-C1 accept-ranges bytes x-amz-cf-id RAVsf3D5LJvxJUww6nIBu2vF5oeF7qxrcXciX798uOturQZ-XcgEwQ==
GET H2	200	1699665.js Show response js.hs-banner.com/	46 KB 12 KB	28ms 13ms	Script text/javascript	2606:4700::6812:14bf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/1699665.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/1699665.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14bf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 943f6108d5fe6570a70abad0a44dcdf878d745fc4cfe39f4622b2cd9901822c6 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-goog-hash crc32c=Wwhwuw==, md5=ubVHDXHj1vwMGlmYRpX09A== date Sat, 12 Sep 2020 16:30:40 GMT content-encoding br cf-cache-status HIT age 44 x-guploader-uploadid ABg5-UxwnYeJ6Cad2fsDfYPAxV9lZff3FTGCcGkGstI48e_FrLzres8K9ZHht2PlytyaPCDDq2iSa7qpWLf9azAmcwQ x-goog-storage-class STANDARD status 200 access-control-max-age 604800 x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type text/javascript cf-request-id 0524c0a123000005bb9895b200000001 timing-allow-origin * last-modified Thu, 10 Sep 2020 12:03:35 GMT server cloudflare etag W/"b9b5470d71e3d6fc0c1a59984695f4f4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-goog-generation 1599739415159854 access-control-allow-origin https://snyk.io access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300, public access-control-allow-credentials true x-goog-stored-content-length 47209 cf-ray 5d1b03ae9c6805bb-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id expires Sat, 12 Sep 2020 16:34:56 GMT
POST H2	200	ping Show response api-iam.intercom.io/messenger/web/ Frame 6EC7	14 KB 3 KB	854ms 628ms	XHR application/json	99.83.219.81 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api-iam.intercom.io/messenger/web/ping Requested by Host: js.intercomcdn.com URL: https://js.intercomcdn.com/frame-modern.6e7ffae8.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.219.81 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ad8b87a22ce463223.awsglobalaccelerator.com Software nginx / Resource Hash 8d45c4c91bc4565718ba05017f4c4d7eb8ecc5f4bde93cdae6ea6decc402171a Security Headers Name Value Strict-Transport-Security max-age=31556952; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Sat, 12 Sep 2020 16:30:41 GMT content-encoding gzip x-ami-version ami-0f9452c11d300ef41 status 200, 200 OK strict-transport-security max-age=31556952; includeSubDomains; preload vary Accept-Encoding x-xss-protection 1; mode=block x-request-id 0027thvjrp4rrngf02f0 x-runtime 0.503095 server nginx x-frame-options SAMEORIGIN etag W/"8d45c4c91bc4565718ba05017f4c4d7e" x-ratelimit-remaining 19987 access-control-allow-methods POST, GET, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://snyk.io x-intercom-version 2f2d6229af71a069dfd5b896e749dc7de767bfe3 cache-control max-age=0, private, must-revalidate access-control-allow-credentials true x-ratelimit-reset 1599928260 x-ratelimit-limit 20000 access-control-allow-headers Content-Type x-content-type-options nosniff
GET H2	200	fingerprint.min.js Show response assets.trendemon.com/global/	30 KB 11 KB	39ms 39ms	Script application/javascript	143.204.215.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets.trendemon.com/global/fingerprint.min.js Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/scripts/2025/main.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.88 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-88.fra53.r.cloudfront.net Software / Express Resource Hash 83793d0fd52ae9ac7262b4f7c12cf075127719f0db78e8aa5d26af95ee3a8b1e Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 15:00:23 GMT content-encoding gzip age 5443 x-powered-by Express x-cache Hit from cloudfront status 200 access-control-allow-origin * trd-ts 2020-09-09T09:08:15.550Z last-modified Wed, 09 Sep 2020 09:03:14 GMT etag W/"77fa-174721ad050" vary Accept-Encoding content-type application/javascript; charset=UTF-8 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control public, max-age=86400 x-amz-cf-pop FRA53-C1 accept-ranges bytes x-amz-cf-id obpK7Q5Y8zQsgjrw7eUPrjDHk8fGuHn1dWdvskfXmUyKo9r91kcioQ==
POST H2	200	/ www.facebook.com/tr/	0 77 B	6ms 5ms	Other text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt date Sat, 12 Sep 2020 16:30:40 GMT status 200 content-type text/plain access-control-allow-origin https://snyk.io access-control-allow-credentials true alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 0
GET H2	200	me Show response trackingapi.trendemon.com/api/Identity/	94 B 507 B	393ms 126ms	Script application/x-javascript	3.94.71.171 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://trackingapi.trendemon.com/api/Identity/me?accountId=2025&DomainCookie=15999282405109662&fingerPrint=a7da0b4fd0f1260a48e065fb50a26e3a&callback=jsonp253264&vid= Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/scripts/2025/main.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.71.171 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-71-171.compute-1.amazonaws.com Software Kestrel / Resource Hash 0ef72a8e89bb815266bf2317c7ea4c051cd6a9ece521dee4607e0886ed4aba95 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 pragma no-cache date Sat, 12 Sep 2020 16:30:41 GMT cache-control no-store,no-cache server Kestrel content-length 94 content-type application/x-javascript; charset=UTF-8
GET H2	200	MarketingAutomation Show response trackingapi.trendemon.com/api/	94 B 231 B	126ms 126ms	Script application/x-javascript	3.94.71.171 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://trackingapi.trendemon.com/api/MarketingAutomation?AccountId=2025&ClientUrl=aHR0cHM6Ly9zbnlrLmlvL2Jsb2cvc291cm1pbnQtbWFsaWNpb3VzLWNvZGUtYWQtZnJhdWQtYW5kLWRhdGEtbGVhay1pbi1pb3Mv&CookieId=15999282405109662&MaCookie=MDBlY2RiZDkxNDc5N2ViMDYwYThhN2MwOGY3YzY0ODE%3D&MaCookieName=aHVic3BvdHV0aw%3D%3D&MaName=hubspot&callback=jsonp925928&vid=2025:15999282405109662 Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/scripts/2025/main.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.71.171 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-71-171.compute-1.amazonaws.com Software Kestrel / Resource Hash 98701d3edfd2ec9af1f30ca7d5926ff90953709ad9677c79941591e8447d6acf Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 pragma no-cache date Sat, 12 Sep 2020 16:30:41 GMT cache-control no-store,no-cache server Kestrel content-length 94 content-type application/x-javascript; charset=UTF-8
GET H2	200	cta.css assets.trendemon.com/global/	3 KB 1 KB	34ms 34ms	Stylesheet text/css	143.204.215.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets.trendemon.com/global/cta.css Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/scripts/2025/main.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.88 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-88.fra53.r.cloudfront.net Software / Express Resource Hash f9b841b51667180d3f615b5a62a59e0b496dbe9c7787963e10c6a801c72d89d8 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 09:06:51 GMT content-encoding gzip age 26630 x-powered-by Express x-cache Hit from cloudfront status 200 access-control-allow-origin * trd-ts 2020-09-09T09:06:48.281Z last-modified Wed, 09 Sep 2020 09:01:28 GMT etag W/"a31-17472193240" vary Accept-Encoding content-type text/css; charset=UTF-8 via 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront) cache-control public, max-age=86400 x-amz-cf-pop FRA53-C1 accept-ranges bytes x-amz-cf-id Yp1wSsje-W-ggIeyzpCfWl8sNIkOWwh8BWWuv1gkEp5QXW9Eq2iA1w==
GET H2	200	embedded.json Show response assets.trendemon.com/templates/2025/	23 KB 5 KB	108ms 37ms	XHR application/json	143.204.215.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets.trendemon.com/templates/2025/embedded.json Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/scripts/2025/main.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.88 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-88.fra53.r.cloudfront.net Software / Express Resource Hash 820b77ddeabd33889cebc06c424c2f804aefce7777eff3237f8ca89ca77f13f4 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 14:48:24 GMT content-encoding gzip trd-ts 2020-09-11T14:40:47.045Z age 6137 status 200 x-powered-by Express vary Accept-Encoding x-cache Hit from cloudfront content-type application/json; charset=utf-8 access-control-allow-origin * etag W/"5b72-Dmm8kn+weYbqThOuM1tpnqd9Fxw" x-amz-cf-pop FRA53-C1 x-amz-cf-id uc3BhLt5uQSxZI-nayNVs4I6WWltWNy5XpFUH5Z1mnpGez-HwudDTw== via 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
GET H2	200	pageview trackingapi.trendemon.com/api/events/	43 B 234 B	145ms 144ms	Image image/gif	3.94.71.171 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trackingapi.trendemon.com/api/events/pageview?accountId=2025&url=aHR0cHM6Ly9zbnlrLmlvL2Jsb2cvc291cm1pbnQtbWFsaWNpb3VzLWNvZGUtYWQtZnJhdWQtYW5kLWRhdGEtbGVhay1pbi1pb3Mv&cookie=15999282405109662&referral=&vid=2025:15999282405109662&r=1599928241230 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.71.171 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-71-171.compute-1.amazonaws.com Software Kestrel / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 12 Sep 2020 16:30:41 GMT server Kestrel age 1691358 content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate content-length 43 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response trackingapi.trendemon.com/api/cta/personal/	140 B 240 B	122ms 122ms	Script application/x-javascript	3.94.71.171 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://trackingapi.trendemon.com/api/cta/personal/?AccountId=2025&ClientUrl=aHR0cHM6Ly9zbnlrLmlvL2Jsb2cvc291cm1pbnQtbWFsaWNpb3VzLWNvZGUtYWQtZnJhdWQtYW5kLWRhdGEtbGVhay1pbi1pb3Mv&FirstVisitTime=1599928241&ClientCookies=dHJkX2V4aXRpbnRlbnRjbGllbnQ9MTU5OTkyODI0MTIzMTc4OTcmdHJkX3NpZD0xNTk5OTI4MjQxMjI5MzAyNiZ0cmRfY2lkPTE1OTk5MjgyNDA1MTA5NjYyJnRyZF9wdz0xJnRyZF9wd3M9MSZ0cmRfZmlyc3RfdmlzaXQ9MTU5OTkyODI0MSZ0cmRfY3RhaGlzdG9yeT1bXQ%3D%3D&callback=jsonp840090&vid=2025:15999282405109662 Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/scripts/2025/main.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.71.171 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-71-171.compute-1.amazonaws.com Software Kestrel / Resource Hash 3e40dc8da9336d9a6074ed14837c1fcf511ef18e0ff525592715037f17303330 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sat, 12 Sep 2020 16:30:41 GMT server Kestrel content-length 140 content-type application/x-javascript; charset=UTF-8
GET H3-Q050	200	css fonts.googleapis.com/	2 KB 642 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:814::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans&subset=latin,cyrillic-ext Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/global/cta.css Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash a8252492db56de6a43a1e52010746aa4b09c216f522dfaa82a62169a811e3405 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://assets.trendemon.com/global/cta.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 12 Sep 2020 16:30:41 GMT server ESF date Sat, 12 Sep 2020 16:30:41 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 12 Sep 2020 16:30:41 GMT
POST H2	200	ping Show response api-iam.intercom.io/messenger/web/ Frame 6EC7	14 KB 3 KB	670ms 670ms	XHR application/json	99.83.219.81 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api-iam.intercom.io/messenger/web/ping Requested by Host: js.intercomcdn.com URL: https://js.intercomcdn.com/frame-modern.6e7ffae8.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.219.81 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ad8b87a22ce463223.awsglobalaccelerator.com Software nginx / Resource Hash 590a1bde8cc6997d5ed115b9ee370d719c0151f7ea9b7e1b78c4f35a37894f3b Security Headers Name Value Strict-Transport-Security max-age=31556952; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Sat, 12 Sep 2020 16:30:41 GMT content-encoding gzip x-ami-version ami-0f9452c11d300ef41 status 200, 200 OK strict-transport-security max-age=31556952; includeSubDomains; preload vary Accept-Encoding x-xss-protection 1; mode=block x-request-id 0026navua4ogi5ha1eig x-runtime 0.543820 server nginx x-frame-options SAMEORIGIN etag W/"590a1bde8cc6997d5ed115b9ee370d71" x-ratelimit-remaining 19986 access-control-allow-methods POST, GET, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://snyk.io x-intercom-version 2f2d6229af71a069dfd5b896e749dc7de767bfe3 cache-control max-age=0, private, must-revalidate access-control-allow-credentials true x-ratelimit-reset 1599928260 x-ratelimit-limit 20000 access-control-allow-headers Content-Type x-content-type-options nosniff
GET H2	200	recommend Show response trackingapi.trendemon.com/api/content/	2 KB 2 KB	145ms 145ms	Script application/x-javascript	3.94.71.171 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://trackingapi.trendemon.com/api/content/recommend?AccountId=2025&Url=aHR0cHM6Ly9zbnlrLmlvL2Jsb2cvc291cm1pbnQtbWFsaWNpb3VzLWNvZGUtYWQtZnJhdWQtYW5kLWRhdGEtbGVhay1pbi1pb3Mv&Limit=3&WidgetType=Embedded&UserPagesHistoryStr=%5B%5D&TrdCookie=15999282405109662&ExposureRate=100&callback=jsonp904002&vid=2025:15999282405109662 Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/scripts/2025/main.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.71.171 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-71-171.compute-1.amazonaws.com Software Kestrel / Resource Hash f639e33582a40f3688936a532be8859551c6c0cd25f6f5a88b637772d0d1ee6b Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sat, 12 Sep 2020 16:30:41 GMT server Kestrel content-length 2079 content-type application/x-javascript; charset=UTF-8
GET H/1.1	200 OK	3yYpNlMfwa3woxH.png d1ysmqklpsb9ih.cloudfront.net/autotask_logo/2025/	42 KB 43 KB	147ms 65ms	Image image/png	99.84.144.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1ysmqklpsb9ih.cloudfront.net/autotask_logo/2025/3yYpNlMfwa3woxH.png Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 99.84.144.70 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-144-70.txl52.r.cloudfront.net Software AmazonS3 / Resource Hash 3b5a496db60e64ccabb476f652157899ac961119b594fa92fd3f0c89238107ed Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 Date Sat, 12 Sep 2020 07:11:28 GMT Via 1.1 9d11c99c18949c4780bf1400ceca8369.cloudfront.net (CloudFront) Last-Modified Mon, 18 Mar 2019 09:54:39 GMT Server AmazonS3 Age 33554 ETag "17e38b98624ddadc44d1e9dbcef1c3c9" X-Cache Hit from cloudfront Content-Type image/png Connection keep-alive X-Amz-Cf-Pop TXL52-C1 Accept-Ranges bytes Content-Length 43328 X-Amz-Cf-Id K92_-zFgEm-5vwS6Oad2OpYwWZF1gwr1D4ZCYQkB6Py88mhVb0Id3g== Expires Sun, 18 Mar 2029 09:54:38 GMT
GET H/1.1	200 OK	0HiceJLdlnFgPP2.png d1ysmqklpsb9ih.cloudfront.net/autotask_logo/2025/	46 KB 46 KB	125ms 43ms	Image image/png	99.84.144.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1ysmqklpsb9ih.cloudfront.net/autotask_logo/2025/0HiceJLdlnFgPP2.png Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 99.84.144.70 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-144-70.txl52.r.cloudfront.net Software AmazonS3 / Resource Hash cbb7a50dd8706d1fbb369a711d01f6928df76a123c792f683d122c95044a4dd5 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 Date Sat, 12 Sep 2020 07:11:28 GMT Via 1.1 b88825ad151091557d336c3519215162.cloudfront.net (CloudFront) Last-Modified Wed, 03 Jun 2020 11:47:38 GMT Server AmazonS3 Age 33554 ETag "c67d6e3aaa0ca093c1b6707d3a5db510" X-Cache Hit from cloudfront Content-Type image/png Connection keep-alive X-Amz-Cf-Pop TXL52-C1 Accept-Ranges bytes Content-Length 46898 X-Amz-Cf-Id 5JCdE4Okh9Adakhe73Bh3HiwlMPxmUC487rqi3Imeu_J799Cvdh9aw== Expires Mon, 03 Jun 2030 11:47:36 GMT
GET H/1.1	200 OK	7OaOYBsYM0psXFo.jpg d1ysmqklpsb9ih.cloudfront.net/autotask_logo/2025/	26 KB 26 KB	145ms 58ms	Image image/jpeg	99.84.144.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1ysmqklpsb9ih.cloudfront.net/autotask_logo/2025/7OaOYBsYM0psXFo.jpg Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 99.84.144.70 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-144-70.txl52.r.cloudfront.net Software AmazonS3 / Resource Hash 6c854b33aa17070cb5f27d15ce496fe8560a40866a6f331c6575dadc300d6a4f Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 Date Sat, 12 Sep 2020 07:11:28 GMT Via 1.1 d91c21a06968968452d701ff77f35a70.cloudfront.net (CloudFront) Last-Modified Tue, 01 Sep 2020 16:47:44 GMT Server AmazonS3 Age 33554 ETag "f33d09a3c9447fc2805a14c40ccd2349" X-Cache Hit from cloudfront Content-Type image/jpeg Connection keep-alive X-Amz-Cf-Pop TXL52-C1 Accept-Ranges bytes Content-Length 26273 X-Amz-Cf-Id dwn_bhC_8kttDp3XkGOxyo0ii2mjdgMzKz-zzDpnLw4KsfeGcBuisQ== Expires Sun, 01 Sep 2030 16:47:43 GMT
GET H2	200	lift_swider.json Show response assets.trendemon.com/templates/2025/	15 KB 4 KB	37ms 36ms	XHR application/json	143.204.215.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets.trendemon.com/templates/2025/lift_swider.json?v=2025.1599642423430 Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/scripts/2025/main.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.88 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-88.fra53.r.cloudfront.net Software / Express Resource Hash 63b8c2568f757794a707abd33fbccf4c44d028e691fa205a160f12fe4cf6c53e Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 12 Sep 2020 09:16:23 GMT content-encoding gzip trd-ts 2020-09-09T09:08:21.163Z age 29110 status 200 x-powered-by Express vary Accept-Encoding x-cache Hit from cloudfront content-type application/json; charset=utf-8 access-control-allow-origin * etag W/"3d88-/IqJb+wsK0SVfInVEP83QrdVBVA" x-amz-cf-pop FRA53-C1 x-amz-cf-id xyP1jTarrpzlo8soFab8vam7I4ny_xqX01-toT8nOBDz9fFW2TG6ig== via 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
GET H2	200	recommend Show response trackingapi.trendemon.com/api/content/	605 B 705 B	259ms 258ms	Script application/x-javascript	3.94.71.171 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://trackingapi.trendemon.com/api/content/recommend?AccountId=2025&Url=aHR0cHM6Ly9zbnlrLmlvL2Jsb2cvc291cm1pbnQtbWFsaWNpb3VzLWNvZGUtYWQtZnJhdWQtYW5kLWRhdGEtbGVhay1pbi1pb3Mv&Limit=1&WidgetType=Slider&UserPagesHistoryStr=%5B%5D&TrdCookie=15999282405109662&ExposureRate=100&callback=jsonp196377&vid=2025:15999282405109662 Requested by Host: assets.trendemon.com URL: https://assets.trendemon.com/scripts/2025/main.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.71.171 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-71-171.compute-1.amazonaws.com Software Kestrel / Resource Hash be6c450684ea5b7b949569b1aa5cf88eaf88614d1730a7b1093935551df2b5d1 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sat, 12 Sep 2020 16:30:41 GMT server Kestrel content-length 605 content-type application/x-javascript; charset=UTF-8
GET H3-Q050	200	css fonts.googleapis.com/	2 KB 573 B	15ms 15ms	Stylesheet text/css	2a00:1450:4001:814::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans&subset=latin,cyrillic-ext Requested by Host: snyk.io URL: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash a8252492db56de6a43a1e52010746aa4b09c216f522dfaa82a62169a811e3405 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 12 Sep 2020 16:30:41 GMT server ESF date Sat, 12 Sep 2020 16:30:41 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 12 Sep 2020 16:30:41 GMT
GET H3-Q050	200	mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 fonts.gstatic.com/s/opensans/v17/	9 KB 9 KB	26ms 13ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans&subset=latin,cyrillic-ext Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://snyk.io Referer https://fonts.googleapis.com/css?family=Open+Sans&subset=latin,cyrillic-ext User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 07 Sep 2020 11:04:06 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 19:30:49 GMT server sffe age 451595 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9132 x-xss-protection 0 expires Tue, 07 Sep 2021 11:04:06 GMT
GET H/1.1	200 OK	2y64ShG1ytANYB4.png d1ysmqklpsb9ih.cloudfront.net/autotask_logo/2025/	38 KB 38 KB	447ms 447ms	Image image/png	99.84.144.70 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1ysmqklpsb9ih.cloudfront.net/autotask_logo/2025/2y64ShG1ytANYB4.png Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 99.84.144.70 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-144-70.txl52.r.cloudfront.net Software AmazonS3 / Resource Hash 97c6c65effc9513adf42dc315cdd148ad9925526a949d51167cd8065a5b5d7f4 Request headers Referer https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 Date Sat, 12 Sep 2020 16:30:43 GMT Via 1.1 9d11c99c18949c4780bf1400ceca8369.cloudfront.net (CloudFront) Last-Modified Sun, 05 May 2019 06:45:10 GMT Server AmazonS3 X-Amz-Cf-Pop TXL52-C1 ETag "27fd18932c902de8b0545f5bbd0edcee" X-Cache Miss from cloudfront Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 38565 X-Amz-Cf-Id _sZONLz-UyJ3LpGpi21zyDCt_jIZvwxosRf7USEwuEf_lc3ofDCSLg== Expires Sat, 05 May 2029 06:45:09 GMT
GET H3-Q050	200	mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 fonts.gstatic.com/s/opensans/v17/	9 KB 9 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans&subset=latin,cyrillic-ext Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://snyk.io Referer https://fonts.googleapis.com/css?family=Open+Sans&subset=latin,cyrillic-ext User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 07 Sep 2020 11:04:00 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 19:30:49 GMT server sffe age 451601 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9132 x-xss-protection 0 expires Tue, 07 Sep 2021 11:04:00 GMT