www.malwarebytes.com Open in urlscan Pro
192.0.66.233  Public Scan

38 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 54

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1728557343277&li_adsId=ba0ac73a-b6c4-4549-b5a2-914310d4ce9c&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1728557343277&li_adsId=ba0ac73a-b6c4-4549-b5a2-914310d4ce9c&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2594100%26time%3D1728557343277%26li_adsId%3Dba0ac73a-b6c4-4549-b5a2-914310d4ce9c%26url%3Dhttps%253A%252F%252Fwww.malwarebytes.com%252Fblog%252Fnews%252F2024%252F10%252Flarge-scale-google-ads-campaign-targets-utility-software%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1728557343277&li_adsId=ba0ac73a-b6c4-4549-b5a2-914310d4ce9c&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&cookiesTest=true&liSync=true

77 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request large-scale-google-ads-campaign-targets-utility-software Show response www.malwarebytes.com/blog/news/2024/10/	179 KB 46 KB	66ms 19ms	Document text/html	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f1e3965a08b9f22c0597e7f810cb7c3f9948cb3795b3871937d0904f69df4b77 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers accept-ranges bytes cache-control max-age=300, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Thu, 10 Oct 2024 10:49:02 GMT host-header a9130478a60e5f9135f765b23f26593b link <https://www.malwarebytes.com/wp-json/>; rel="https://api.w.org/" <https://www.malwarebytes.com/wp-json/wp/v2/posts/118408>; rel="alternate"; type="application/json" <https://www.malwarebytes.com/?p=118408>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000 vary Accept-Encoding, Origin x-cache STALE x-content-type-options nosniff x-frame-options DENY x-rq yyz2 85 188 443
GET H2	200	/ www.malwarebytes.com/_static/	163 KB 13 KB	22ms 20ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyFjEEKwzAMBD9UR6S4NJfSt7iuIgSOLCIF09/XpJceArktOzsLTUOu4igOWjZiMSCsnlZCZ6GmoNurcIZsfyT8ymFhGTq4wMFNQyrV4c3muzyvfRB6OjOSKph/ChoItjCXRLvzXB7jfbxdpxin+AXNXUTs Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 24c613a2bb6db3e4b670cd5ab76d56edd869f3472bc463d8e8431421deb324d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 accept-ranges bytes x-cache HIT date Thu, 10 Oct 2024 10:49:02 GMT content-type text/css;charset=utf-8 vary Accept-Encoding server nginx last-modified Thu, 09 May 2024 19:54:44 GMT
GET H2	200	/ www.malwarebytes.com/_static/	280 KB 51 KB	22ms 21ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 2fc56042b61afe1fb286ebf22b0dfb083bdf951e2040bdcf810c2ff43d9bb14f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 accept-ranges bytes x-cache HIT date Thu, 10 Oct 2024 10:49:02 GMT content-type text/css;charset=utf-8 vary Accept-Encoding server nginx last-modified Fri, 04 Oct 2024 17:52:48 GMT
GET H2	200	front-js.js Show response www.malwarebytes.com/wp-content/plugins/weglot/dist/	5 KB 2 KB	22ms 21ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/plugins/weglot/dist/front-js.js?m=1717179845g Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 43f92926fd6c2ae121fb4df766fa966c8fdc4f898190e1e785c701e73c5b2013 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 187 443 etag W/"665a15c5-1239" accept-ranges bytes x-cache HIT date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript last-modified Fri, 31 May 2024 18:24:05 GMT server nginx vary Accept-Encoding
GET H2	200	NEW-NavBug.svg www.malwarebytes.com/wp-content/uploads/sites/2/2023/04/	1 KB 849 B	39ms 38ms	Image image/svg+xml	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/04/NEW-NavBug.svg Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5f114a7afff8759ea3f28a6af87355ab3fc278d4b93eaaf865b3fc3fd49b7575 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 89 80 443 etag W/"38f845bd119a0420" accept-ranges bytes x-cache HIT date Thu, 10 Oct 2024 10:49:02 GMT content-type image/svg+xml vary Accept-Encoding server nginx last-modified Tue, 24 Sep 2024 22:18:49 GMT
GET H2	200	product-menu-screen.webp www.malwarebytes.com/wp-content/uploads/sites/2/2023/09/	16 KB 16 KB	39ms 38ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/09/product-menu-screen.webp?w=356 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 2fc88556de1ebed9f55afb87d495d90d43f939a515f3afa5d59e953b8fc0ab20 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 86 237 443 etag "25263da38e013f35" accept-ranges bytes, bytes x-cache HIT content-length 16616 date Thu, 10 Oct 2024 10:49:02 GMT content-type image/webp last-modified Mon, 06 May 2024 23:44:38 GMT server nginx vary Accept
GET H2	200	malwarebytes-state-of-malware-report-2023.jpg www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/	5 KB 6 KB	24ms 20ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/malwarebytes-state-of-malware-report-2023.jpg?resize=300,145 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 09bb3c251f7addb6569c0c3e6f90b152c20f79c9e13a8dcd2413a24bc461c8dd Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 87 95 443 etag "e0cade8b0169cc5e" accept-ranges bytes, bytes x-cache HIT content-length 5410 date Thu, 10 Oct 2024 10:49:02 GMT content-type image/webp last-modified Thu, 09 May 2024 16:42:52 GMT server nginx vary Accept
GET H2	200	Untitled-2-1.png www.malwarebytes.com/wp-content/uploads/sites/2/2024/10/	10 KB 11 KB	38ms 37ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/10/Untitled-2-1.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f6563ca75ec75e08e68512633213ab3e2d68c6d9ea47acc9eb7d815656d73c3d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 87 227 443 etag "3f77b945963a909b" accept-ranges bytes, bytes x-cache HIT content-length 10694 date Thu, 10 Oct 2024 10:49:02 GMT content-type image/webp last-modified Mon, 07 Oct 2024 18:11:17 GMT server nginx vary Accept
GET H2	200	image_a98607.png www.malwarebytes.com/wp-content/uploads/sites/2/2024/10/	13 KB 13 KB	24ms 21ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/10/image_a98607.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 218ea80a41fae4d91db86209b449b206bbcbf33b23ddc61ac71658eef79a8174 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 87 131 443 etag "1e94917f14f7a347" accept-ranges bytes, bytes x-cache HIT content-length 12928 date Thu, 10 Oct 2024 10:49:02 GMT content-type image/webp last-modified Mon, 07 Oct 2024 17:43:43 GMT server nginx vary Accept
GET H2	200	image_58412b.png www.malwarebytes.com/wp-content/uploads/sites/2/2024/10/	7 KB 8 KB	25ms 21ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/10/image_58412b.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash cf1385c4bfcbd3565a3b2b579d243c7782449b73f9b9e84c25bcb4385b08296f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 80 86 443 etag "fe1ecceccca03352" accept-ranges bytes, bytes x-cache HIT content-length 7634 date Thu, 10 Oct 2024 10:49:02 GMT content-type image/webp last-modified Mon, 07 Oct 2024 17:46:29 GMT server nginx vary Accept
GET H/1.1	200 OK	count.js Show response malwarebytesunpacked.disqus.com/	1 KB 2 KB	88ms 20ms	Script application/javascript	199.232.192.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/count.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.192.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Content-Encoding gzip ETag "67070982-367" Age 10 X-Content-Type-Options nosniff X-Amz-Cf-Id wYFNznM-z8-2BYsmEHVwAQaErvXk0MSWbEb4ShuOEbST1QdxSjDp3A== Date Thu, 10 Oct 2024 10:49:02 GMT Content-Type application/javascript; charset=utf-8 Last-Modified Wed, 09 Oct 2024 22:53:54 GMT Vary Accept-Encoding Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Cache-Control public, max-age=300 Connection keep-alive Cross-Origin-Resource-Policy cross-origin Content-Length 871 X-XSS-Protection 1; mode=block X-Amz-Cf-Pop DFW3-C1 Server nginx
GET H2	200	jquery.min.js Show response www.malwarebytes.com/wp-includes/js/jquery/	86 KB 31 KB	25ms 21ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-includes/js/jquery/jquery.min.js?ver=1.0 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 187 443 etag W/"66e06619-15601" accept-ranges bytes x-cache HIT date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript last-modified Tue, 10 Sep 2024 15:30:33 GMT server nginx vary Accept-Encoding
GET H2	200	/ Show response www.malwarebytes.com/_static/	82 KB 26 KB	24ms 22ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyVj8FOxDAMRH+IrtmVYLkgvsVNh+BuYkexq4r9eqLlgrj1OJ6ZZw3tbUqmAQ1qZcuiThkW3DNCNO+N2jYXSbT+Mabf22n1JzoCqKLkKEghd5yG+k+IL1SMHJedO+bvGILdEU7zJmUZzqGS98dfJKsVPYG2kCIhI5HMboLjrIbuplzkziGmI9pvj6VT4tpYsvrhVZ8dmBbbtRgvo/1R38/Xy+vL+fL8dl1/AAEfn+M= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash ff44c82dfca46a5b018ab0dc82e9fc2e4650ed67af4f250320d167d0c26a7d8c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 accept-ranges bytes x-cache HIT date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript vary Accept-Encoding server nginx last-modified Mon, 16 Sep 2024 18:41:27 GMT
GET H2	200	e-202441.js Show response stats.wp.com/	7 KB 3 KB	67ms 23ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202441.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control max-age=31536000 content-encoding br x-nc HIT yyz etag W/14421-1717166113433.13 x-minify t x-minify-cache hit access-control-allow-methods GET, HEAD expires Mon, 06 Oct 2025 20:11:53 GMT access-control-allow-origin * alt-svc h3=":443"; ma=86400 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript vary Accept-Encoding server nginx
GET H2	200	gtm.js Show response www.googletagmanager.com/	513 KB 154 KB	164ms 88ms	Script application/javascript	142.251.40.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.40.232 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s39-in-f8.1e100.net Software Google Tag Manager / Resource Hash f591a8380694379bb32e8f8b914e0fd6b747d838b3ec3753c90e7f69adbdc79f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding gzip report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Thu, 10 Oct 2024 10:49:02 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Thu, 10 Oct 2024 09:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 156589 x-xss-protection 0 server Google Tag Manager
GET H2	200	script.js Show response plausible.io/js/	1 KB 1 KB	99ms 29ms	Script application/javascript	138.199.40.58 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://plausible.io/js/script.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB), Reverse DNS 138-199-40-58.bunnyinfra.net Software BunnyCDN-NY1-885 / Resource Hash e3409ac09af396e35fd67c5e024386d36c52138b7541e6a4644c31a94a2d33a4 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cdn-status 200 content-encoding br x-content-type-options nosniff date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript vary Accept-Encoding cdn-cachedat 10/10/2024 09:56:16 cdn-cache HIT cdn-requestpullcode 200 cache-control public, must-revalidate, max-age=86400 cdn-requestpullsuccess True cdn-requesttime 0 cdn-uid 153cb5b1-399a-48ef-b5bf-098c03770254 cdn-requestid 3102aa5708ea944a2b2a58c8c9974dd9 cross-origin-resource-policy cross-origin cdn-pullzone 682664 cdn-proxyver 1.04 application 127.0.0.1 permissions-policy interest-cohort=() access-control-allow-origin * cdn-edgestorageid 885 server BunnyCDN-NY1-885 cdn-requestcountrycode CA
GET H/1.1	200 OK	embed.js Show response malwarebytesunpacked.disqus.com/	80 KB 26 KB	128ms 64ms	Script application/javascript	199.232.192.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/embed.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.192.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software openresty / Resource Hash 96766bf66e0b91e7b5bcfeba0a0866be7e7717e7629e40a296f1c740b02d84cb Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Cache-Control private, max-age=60 x-service router content-encoding gzip Age 0 Connection keep-alive Cross-Origin-Resource-Policy cross-origin Content-Length 26333 Date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript; charset=utf-8 Vary Accept-Encoding server openresty
POST H3	200	pageviews Show response api.weglot.com/	2 B 2 KB	220ms 189ms	XHR application/json	104.18.38.142 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.weglot.com/pageviews?api_key=wg_ab7feeaf115f3476db3eec82a65b414c4 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.38.142 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 Security Headers Name Value Content-Security-Policy default-src 'self' *.weglot.com; base-uri 'self'; connect-src 'self' *; font-src 'self' cdn.jsdelivr.net https://fonts.gstatic.com data:; form-action 'self' *.weglot.com api.workos.com error.workos.com announcekit.app https://accounts.google.com https://login.microsoftonline.com https://pi.zebra.com https://*.okta.com https://*.jumpcloud.com; frame-src 'self' *.weglot.io announcekit.app https://www.google.com https://js.stripe.com https://app.goentri.com https://www.youtube.com https://www.youtube-nocookie.com https://td.doubleclick.net https://js.refiner.io blob:; img-src 'self' * data: blob:; object-src 'none'; media-src 'self' blob:; script-src 'nonce-c9a40dbb014019b6abec6101ed290d3a' 'strict-dynamic'; style-src 'self' 'unsafe-inline' *.weglot.com https://app.productfruits.com; worker-src 'self' blob:; block-all-mixed-content;report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3bd6aeebbc69014092e8cc554aa628f3&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env:prod;frame-ancestors 'none'; Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://www.malwarebytes.com/ Response headers content-encoding gzip cf-cache-status DYNAMIC access-control-allow-methods GET,POST,PUT,PATCH,DELETE x-content-type-options nosniff expires Thu, 10 Oct 2024 10:49:02 GMT alt-svc h3=":443"; ma=86400 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/json x-frame-options SAMEORIGIN access-control-allow-headers Content-Type, Weglot-Source, Authorization strict-transport-security max-age=31536000; includeSubDomains; preload content-security-policy default-src 'self' *.weglot.com; base-uri 'self'; connect-src 'self' *; font-src 'self' cdn.jsdelivr.net https://fonts.gstatic.com data:; form-action 'self' *.weglot.com api.workos.com error.workos.com announcekit.app https://accounts.google.com https://login.microsoftonline.com https://pi.zebra.com https://*.okta.com https://*.jumpcloud.com; frame-src 'self' *.weglot.io announcekit.app https://www.google.com https://js.stripe.com https://app.goentri.com https://www.youtube.com https://www.youtube-nocookie.com https://td.doubleclick.net https://js.refiner.io blob:; img-src 'self' * data: blob:; object-src 'none'; media-src 'self' blob:; script-src 'nonce-c9a40dbb014019b6abec6101ed290d3a' 'strict-dynamic'; style-src 'self' 'unsafe-inline' *.weglot.com https://app.productfruits.com; worker-src 'self' blob:; block-all-mixed-content;report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3bd6aeebbc69014092e8cc554aa628f3&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env:prod;frame-ancestors 'none'; cache-control max-age=0, must-revalidate, no-store, private referrer-policy strict-origin-when-cross-origin cf-ray 8d060a9db85f543d-YYZ permissions-policy accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=() access-control-allow-origin * x-xss-protection 1; mode=block server cloudflare
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 63ccbd40f783b34fe6bc9ef9e971de08e32012b91ee81dd54b325ecf527c1dac Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	Roboto-Regular.b009a76a.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	25ms 21ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Regular.b009a76a.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 188 443 etag "64e71be1-3d80" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15744 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/font-woff2 last-modified Thu, 24 Aug 2023 08:59:13 GMT server nginx
GET DATA	200 OK	truncated /	577 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b556aa0c99a333220bef9718a277f81139f356534c0c707430252f445f769b8b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	436 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 242aa88120783594cb0c56ff247407db601e2a09c4f598f7c7d40b9b2ba6369e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	Roboto-Bold.227c9319.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	25ms 22ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Bold.227c9319.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "64e71be1-3df4" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15860 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/font-woff2 last-modified Thu, 24 Aug 2023 08:59:13 GMT server nginx
GET H2	200	Roboto-Medium.f25d774e.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	16 KB 16 KB	27ms 24ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Medium.f25d774e.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "64e71be1-3e30" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15920 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/font-woff2 last-modified Thu, 24 Aug 2023 08:59:13 GMT server nginx
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c2bf4235c36480dd023ae5a3161be4b1d3c5f4728c753788d43530cece558812 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	Graphik-Light.8512717f.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	41 KB 41 KB	25ms 22ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Light.8512717f.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 039bb21133a0657e78917ed224bc151347123282bbd3bf1e0c5da81bccb93da6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "64e71be1-a410" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 42000 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/font-woff2 last-modified Thu, 24 Aug 2023 08:59:13 GMT server nginx
GET H2	200	Graphik-Medium.3ff48deb.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	42 KB 42 KB	25ms 23ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Medium.3ff48deb.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash fc4c4327594c7559168718f24efe82754660fdd55f62aa796baefee1e9b8d3d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "64e71be1-a738" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 42808 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/font-woff2 last-modified Thu, 24 Aug 2023 08:59:13 GMT server nginx
GET H2	200	Graphik-Regular.3fdd19ea.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	38 KB 38 KB	25ms 23ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Regular.3fdd19ea.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 9e1c5b7f15bcd940814677515f306113aa93921b6e7f0d184a6de904d07b6f43 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "64e71be1-97a8" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 38824 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/font-woff2 last-modified Thu, 24 Aug 2023 08:59:13 GMT server nginx
GET H2	200	Roboto-Black.2e8becfc.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	25ms 23ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Black.2e8becfc.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "64e71be1-3d88" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15752 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/font-woff2 last-modified Thu, 24 Aug 2023 08:59:13 GMT server nginx
GET H2	200	Graphik-Semibold.b023d334.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	42 KB 42 KB	25ms 23ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Semibold.b023d334.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 33441b6e44fb33343a5769858ca65653ce482e5e0c58c6eb1cee0e50aa06ddf6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/_static/??-eJyNjEsKgDAMBS9kjT+0G/EsqUYsNFWaSPH2FryAy8fMPMiXWc+oFBX0ICYBxpAxkXu0DBQhFXC3D1shPtarSAX/quBdwvRASWAvusFMcjLV/P0sPLdTZ5tx6Ef7Al56Mx4= Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 188 443 etag "64e71be1-a63c" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 42556 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/font-woff2 last-modified Thu, 24 Aug 2023 08:59:13 GMT server nginx
GET H2	200	8ff7688dd7aaf66effb89c65203ee7c3 secure.gravatar.com/avatar/	10 KB 10 KB	73ms 20ms	Image image/jpeg	192.0.73.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://secure.gravatar.com/avatar/8ff7688dd7aaf66effb89c65203ee7c3?size=300 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4ca7509272fd378d23ad6d1c7f7bfce000ae1569832b6347b8bce568816ed159 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers link <https://gravatar.com/avatar/8ff7688dd7aaf66effb89c65203ee7c3?size=300>; rel="canonical" cache-control max-age=300 x-nc HIT yyz 1 expires Thu, 10 Oct 2024 10:54:02 GMT accept-ranges bytes access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 10272 date Thu, 10 Oct 2024 10:49:02 GMT content-type image/jpeg last-modified Thu, 19 Nov 2020 20:30:53 GMT server nginx content-disposition inline; filename="8ff7688dd7aaf66effb89c65203ee7c3.jpg"
GET H2	200	locate Show response genesis.malwarebytes.com/api/v1/	397 B 579 B	142ms 40ms	XHR application/json	23.20.225.83 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://genesis.malwarebytes.com/api/v1/locate Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyVj8FOxDAMRH+IrtmVYLkgvsVNh+BuYkexq4r9eqLlgrj1OJ6ZZw3tbUqmAQ1qZcuiThkW3DNCNO+N2jYXSbT+Mabf22n1JzoCqKLkKEghd5yG+k+IL1SMHJedO+bvGILdEU7zJmUZzqGS98dfJKsVPYG2kCIhI5HMboLjrIbuplzkziGmI9pvj6VT4tpYsvrhVZ8dmBbbtRgvo/1R38/Xy+vL+fL8dl1/AAEfn+M= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.20.225.83 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-23-20-225-83.compute-1.amazonaws.com Software / Resource Hash edaffc653851545d1864d23b0f9a65ed79a44a7b7bf4bbb87fe3f0d3f682dfb1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers access-control-allow-origin https://www.malwarebytes.com content-length 397 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/json vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	g.gif pixel.wp.com/	50 B 177 B	22ms 20ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&blog=227197325&post=118408&tz=-7&srv=www.malwarebytes.com&hp=vip&j=1%3A13.8.1&host=www.malwarebytes.com&ref=&fcp=235&rand=0.5690571884992477 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache access-control-allow-origin * content-length 50 alt-svc h3=":443"; ma=86400 date Thu, 10 Oct 2024 10:49:02 GMT content-type image/gif server nginx
GET H/1.1	200 OK	count-data.js Show response malwarebytesunpacked.disqus.com/	355 B 938 B	21ms 21ms	Script application/javascript	199.232.192.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/count-data.js?1=118406&1=118541&1=118619&1=118640&1=118674 Requested by Host: malwarebytesunpacked.disqus.com URL: https://malwarebytesunpacked.disqus.com/count.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.192.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 0991b0812c9cf2e7ec6e6d0aab41ff6fc37d7cf237a911c2cd6cc0ccf68def6c Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Cache-Control public, max-age=600 Age 200 Connection keep-alive Cross-Origin-Resource-Policy cross-origin X-Content-Type-Options nosniff Content-Length 355 p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" X-XSS-Protection 1; mode=block Date Thu, 10 Oct 2024 10:49:02 GMT Content-Type application/javascript; charset=UTF-8 Vary Accept-Encoding Server nginx X-Frame-Options SAMEORIGIN
POST H2	202	event Show response plausible.io/api/	2 B 510 B	200ms 141ms	XHR text/plain	138.199.40.58 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://plausible.io/api/event Requested by Host: plausible.io URL: https://plausible.io/js/script.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB), Reverse DNS 138-199-40-58.bunnyinfra.net Software BunnyCDN-NY1-885 / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.malwarebytes.com/ Response headers x-request-id F_0RvrbjR5X51YY6vGYL date Thu, 10 Oct 2024 10:49:02 GMT content-type text/plain; charset=utf-8 cdn-cachedat 10/10/2024 10:49:02 cdn-requestpullcode 202 cache-control must-revalidate, max-age=0, private cdn-requestpullsuccess True cdn-requesttime 0 cdn-uid 153cb5b1-399a-48ef-b5bf-098c03770254 cdn-requestid f0b17d9ce423b27517a1856a4c5525e9 access-control-allow-credentials true cdn-pullzone 682664 cdn-proxyver 1.04 application 127.0.0.1 permissions-policy interest-cohort=() x-plausible-dropped 2 access-control-allow-origin * content-length 2 cdn-edgestorageid 885 server BunnyCDN-NY1-885 cdn-requestcountrycode CA
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	22 KB 8 KB	87ms 36ms	Script application/javascript	104.18.87.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.87.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 uiXk8gw/ehyoMvZ3GeQiaQ== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCE8175C84449A x-ms-lease-status unlocked cf-cache-status HIT age 9103 x-content-type-options nosniff date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript last-modified Wed, 09 Oct 2024 04:03:41 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id a192417c-001e-006a-7e50-1acf21000000 cf-ray 8d060aa08c61a214-YYZ accept-ranges bytes access-control-allow-origin * content-length 7214 x-ms-blob-type BlockBlob server cloudflare
GET H/1.1	200 OK	/ disqus.com/embed/comments/ Frame A216	0 0	111ms 49ms	Document text/html	151.101.128.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=118408&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fcybercrime%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&t_d=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software&t_t=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software&s_o=default Requested by Host: malwarebytesunpacked.disqus.com URL: https://malwarebytesunpacked.disqus.com/embed.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.128.134 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Age 0 Cache-Control stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5 Connection keep-alive Content-Encoding gzip Content-Length 3010 Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Content-Type text/html; charset=utf-8 Cross-Origin-Resource-Policy cross-origin Date Thu, 10 Oct 2024 10:49:02 GMT ETag W/"lounge:view:10339020212.d08259a299eb3bd6f30a8aeff7d03f94.2" Last-Modified Thu, 03 Oct 2024 22:20:41 GMT Link <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch Referrer-Policy no-referrer-when-downgrade Server nginx Strict-Transport-Security max-age=300; includeSubdomains Timing-Allow-Origin * Vary Accept-Encoding X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
GET H2	200	82971089-2677-4e1e-8fab-44444f76330b.json Show response cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/	7 KB 3 KB	80ms 38ms	XHR application/json	104.18.87.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/82971089-2677-4e1e-8fab-44444f76330b.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.87.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e1076e28bf1095b534cec675b71f48f79e71571b0d1e0b6299bfc1598a16b8b3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 LOjydsZgVdt5i4x1RnXibg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DC420742BB00AF age 72956 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Fri, 11 Oct 2024 10:49:02 GMT date Thu, 10 Oct 2024 10:49:02 GMT content-type application/json last-modified Mon, 11 Mar 2024 20:10:13 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id 0dede623-901e-004f-5523-8b48d7000000 cf-ray 8d060aa10d15a1ff-YYZ accept-ranges bytes access-control-allow-origin * content-length 1953 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	68 B 306 B	93ms 37ms	XHR application/json	104.18.32.137 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.32.137 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0a1309d2ccff026ab4dcf050977befc877505115e4777e240fa328b1781c63ae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 accept application/json Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip access-control-allow-methods GET, OPTIONS cf-ray 8d060aa1aa09aad4-YYZ access-control-allow-origin * date Thu, 10 Oct 2024 10:49:02 GMT content-type application/json vary Accept-Encoding server cloudflare access-control-allow-headers Content-Type
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/202402.1.0/	430 KB 105 KB	34ms 33ms	Script application/javascript	104.18.87.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.87.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e912efba4dd82b798fb061f872b0016687932d1648098f501dff644a7ad77a35 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 XwXx/WxMZ+UJJ5CmkZRGfQ== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCA5DEBBF484DE x-ms-lease-status unlocked cf-cache-status HIT age 10594 x-content-type-options nosniff date Thu, 10 Oct 2024 10:49:03 GMT content-type application/javascript last-modified Tue, 16 Jul 2024 21:32:03 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 25a8232f-f01e-00de-55c8-d7c323000000 cf-ray 8d060aa1ed22a214-YYZ accept-ranges bytes access-control-allow-origin * content-length 106948 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	en.json Show response cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/018e2f1e-12b2-7a41-ab63-6c6e010fa4d9/	108 KB 26 KB	38ms 37ms	Fetch application/json	104.18.87.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/018e2f1e-12b2-7a41-ab63-6c6e010fa4d9/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.87.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c8bd9aa9a411bd3248cea9f41fa191e5b57a31528dbb92663fb5191375938bcd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 BhZPJjb/noHRZ0epWvH2Fw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DC420751763AC1 age 72956 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Fri, 11 Oct 2024 10:49:03 GMT date Thu, 10 Oct 2024 10:49:03 GMT content-type application/json last-modified Mon, 11 Mar 2024 20:10:37 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id 07c6e188-701e-000a-414e-799d34000000 cf-ray 8d060aa25e16a1ff-YYZ accept-ranges bytes access-control-allow-origin * content-length 26286 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	js Show response www.googletagmanager.com/gtag/	362 KB 110 KB	73ms 71ms	Script application/javascript	142.251.40.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.40.232 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s39-in-f8.1e100.net Software Google Tag Manager / Resource Hash 1901b14ffa3199bc6fc9793228678e5ae01c9b656bf6fb6f44e872912b925b0e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Thu, 10 Oct 2024 10:49:03 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:49:03 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 112725 x-xss-protection 0 server Google Tag Manager
GET H2	200	malwarebytes.min.js Show response d2jjzw81hqbuqv.cloudfront.net/integration/clients/	48 KB 12 KB	131ms 39ms	Script text/javascript	18.173.132.110 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2jjzw81hqbuqv.cloudfront.net/integration/clients/malwarebytes.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.173.132.110 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-173-132-110.jfk52.r.cloudfront.net Software AmazonS3 / Resource Hash f3c7167cb6b1f62f874561343fe3d0bc6a0a4d0b6bf2c68e7f0d88c90512dfca Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers vary Accept-Encoding, Origin cache-control max-age=600, public content-encoding gzip etag W/"bb1b8c70f10c0cbebd8ac13aa2096a29" age 457 via 1.1 38385695b10551583d750b943a475982.cloudfront.net (CloudFront) expires Fri, 04 Oct 2024 17:50:07 GMT x-cache Hit from cloudfront x-amz-cf-id kYgem3l365lyuHhq9zLYXg6m56L8Z1hDI9VPZT-wwcD--4xTUxHDAQ== date Thu, 10 Oct 2024 10:41:27 GMT content-type text/javascript last-modified Fri, 04 Oct 2024 17:40:08 GMT server AmazonS3 x-amz-cf-pop JFK52-P2 x-amz-server-side-encryption AES256
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	108ms 33ms	Script application/javascript	104.117.182.74 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.117.182.74 New York, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-117-182-74.deploy.static.akamaitechnologies.com Software / Resource Hash 4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control max-age=71922 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Thu, 10 Oct 2024 10:49:03 GMT last-modified Thu, 22 Aug 2024 11:06:54 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	bat.js Show response bat.bing.com/	49 KB 15 KB	173ms 48ms	Script application/javascript	150.171.27.10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding gzip etag "803483b3aaadb1:0" accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: F9E0665582034714B8EE89A18AFF438A Ref B: YTO01EDGE0713 Ref C: 2024-10-10T10:49:03Z accept-ranges bytes x-cache CONFIG_NOCACHE content-length 14402 date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript last-modified Thu, 19 Sep 2024 15:43:41 GMT vary Accept-Encoding
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	115ms 32ms	Script text/javascript	142.251.35.174 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.35.174 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s78-in-f14.1e100.net Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding gzip age 2579 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],} x-content-type-options nosniff expires Thu, 10 Oct 2024 12:06:04 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:06:04 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 20994 server Golfe2
GET H2	200	destination Show response www.googletagmanager.com/gtag/	282 KB 97 KB	58ms 58ms	Script application/javascript	142.251.40.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-407675570&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.40.232 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s39-in-f8.1e100.net Software Google Tag Manager / Resource Hash 5147d4ba83952bb1124750f5c3b5b6deabd66fac6b9f06f3559335acb09cbae2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],} expires Thu, 10 Oct 2024 10:49:03 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:49:03 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Thu, 10 Oct 2024 09:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 98566 x-xss-protection 0 server Google Tag Manager
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 2 KB	122ms 38ms	Script application/x-javascript	23.204.6.193 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.204.6.193 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-204-6-193.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Content-Encoding gzip ETag "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763" Connection keep-alive Accept-Ranges bytes P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Length 729 Date Thu, 10 Oct 2024 10:49:03 GMT Content-Type application/x-javascript Last-Modified Fri, 17 Mar 2023 01:24:48 GMT Server AkamaiNetStorage Vary Accept-Encoding
GET H2	200	js Show response www.googletagmanager.com/gtag/	282 KB 96 KB	58ms 58ms	Script application/javascript	142.251.40.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-930356311 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.40.232 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s39-in-f8.1e100.net Software Google Tag Manager / Resource Hash a454ecaf7b939a2cae9b57b379904e64165eaf773cd633ddf204643fc01c69ab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Thu, 10 Oct 2024 10:49:03 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:49:03 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Thu, 10 Oct 2024 09:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 98476 x-xss-protection 0 server Google Tag Manager
GET H2	200	otPcPanel.json Show response cdn.cookielaw.org/scripttemplates/202402.1.0/assets/v2/	64 KB 13 KB	31ms 31ms	Fetch application/json	104.18.87.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202402.1.0/assets/v2/otPcPanel.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.87.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0ed759f9b0f407aa73df997bddf186c37a1927d2b0f8d2f7031067ecacf7581d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 Hx2FPnZ0+GDc+xiJF4si9A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCA5DEB854B960 x-ms-lease-status unlocked cf-cache-status HIT age 46705 x-content-type-options nosniff date Thu, 10 Oct 2024 10:49:03 GMT content-type application/json last-modified Tue, 16 Jul 2024 21:31:57 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id e06ea288-501e-0079-25e9-d7fac0000000 cf-ray 8d060aa2fe90a1ff-YYZ accept-ranges bytes access-control-allow-origin * content-length 12960 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	otCommonStyles.css Show response cdn.cookielaw.org/scripttemplates/202402.1.0/assets/	21 KB 4 KB	31ms 31ms	Fetch text/css	104.18.87.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202402.1.0/assets/otCommonStyles.css Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.87.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 c7xAZ9MSGAobGaTYg/Qtag== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 46705 content-encoding gzip x-content-type-options nosniff date Thu, 10 Oct 2024 10:49:03 GMT content-type text/css last-modified Tue, 16 Jul 2024 21:32:07 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 573841aa-e01e-000d-3e07-d87c86000000 cf-ray 8d060aa2fe93a1ff-YYZ access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	ot_guard_logo.svg Show response cdn.cookielaw.org/logos/static/	497 B 495 B	31ms 30ms	Fetch image/svg+xml	104.18.87.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.87.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 tXyZydHjxQshFMbbBT1/8A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 72609 content-encoding gzip x-content-type-options nosniff date Thu, 10 Oct 2024 10:49:03 GMT content-type image/svg+xml last-modified Wed, 09 Oct 2024 04:03:42 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 9c48cc6d-101e-00fd-1255-1aace8000000 cf-ray 8d060aa33ec8a1ff-YYZ access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	MWB_logo_horizontal_RGB.png cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/	46 KB 46 KB	36ms 35ms	Image mage/png	104.18.87.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/MWB_logo_horizontal_RGB.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.87.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fdf7a139210ad25e0576a0721d45086e047dee38f88ba2995ce745643212c532 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 g65E4kh32bbdSPqSevAl8Q== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DA459D0252D23C age 46704 cf-cache-status HIT x-content-type-options nosniff date Thu, 10 Oct 2024 10:49:03 GMT content-type mage/png last-modified Fri, 03 Jun 2022 20:09:47 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 3de8db86-b01e-0067-79bf-21297f000000 cf-ray 8d060aa34e49a214-YYZ accept-ranges bytes access-control-allow-origin * content-length 47111 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	powered_by_logo.svg cdn.cookielaw.org/logos/static/	5 KB 2 KB	33ms 32ms	Image image/svg+xml	104.18.87.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/powered_by_logo.svg Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.87.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 Y+c301RBZNK39PvKQWrIBw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 19292 content-encoding gzip x-content-type-options nosniff date Thu, 10 Oct 2024 10:49:03 GMT content-type image/svg+xml last-modified Wed, 09 Oct 2024 19:35:40 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id b8237de5-d01e-0005-7386-1a67f5000000 cf-ray 8d060aa34e4ba214-YYZ access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 1002 B	227ms 151ms	XHR application/json	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=2594100&time=1728557343277&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept * Referer https://www.malwarebytes.com/ Response headers content-encoding gzip x-li-fabric prod-lor1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} access-control-allow-methods GET, OPTIONS x-li-proto http/2 x-cache CONFIG_NOCACHE date Thu, 10 Oct 2024 10:49:03 GMT content-type application/json access-control-allow-headers * x-li-pop afd-prod-lva1-x nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-fs-uuid 0006241d1e6cf72300b9015206d88e31 x-msedge-ref Ref A: 37F35B7AA08E46E7B64EE5A0A3C3487F Ref B: YTO01EDGE0815 Ref C: 2024-10-10T10:49:03Z x-restli-protocol-version 1.0.0 x-li-uuid AAYkHR5s9yMAuQFSBtiOMQ== access-control-allow-origin * x-li-source-fabric prod-lva1
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1728557343277&li_adsId=ba0ac73a-b6c4-4549-b5a2-914310d4ce9c&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1728557343277&li_adsId=ba0ac73a-b6c4-4549-b5a2-914310d4ce9c&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2594100%26time%3D1728557343277%26li_adsId%3Dba0ac73a-b6c4-4549-b5a2-914310d4ce9c%... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1728557343277&li_adsId=ba0ac73a-b6c4-4549-b5a2-914310d4ce9c&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-...	0 166 B	114ms 114ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1728557343277&li_adsId=ba0ac73a-b6c4-4549-b5a2-914310d4ce9c&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&cookiesTest=true&liSync=true Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-msedge-ref Ref A: 7872A41FEFEF4D618C9BC21465DE5AAA Ref B: YTO01EDGE0515 Ref C: 2024-10-10T10:49:03Z x-li-fabric prod-lor1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-uuid AAYkHR50N+PSpq1hhGTxOg== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Thu, 10 Oct 2024 10:49:03 GMT content-type application/javascript Redirect headers linkedin-action 1 cf-cache-status DYNAMIC x-li-fabric prod-lor1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-content-type-options nosniff expires Thu, 01 Jan 1970 00:00:00 GMT x-li-proto http/2 date Thu, 10 Oct 2024 10:49:03 GMT x-frame-options sameorigin strict-transport-security max-age=31536000 x-li-pop cf-prod-lor1-x content-security-policy frame-ancestors 'self' nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1728557343277&li_adsId=ba0ac73a-b6c4-4549-b5a2-914310d4ce9c&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&cookiesTest=true&liSync=true cache-control no-cache, no-store pragma no-cache cf-ray 8d060aa62d46a24a-YYZ x-li-uuid AAYkHR5yo9xJAvUUz1foKw== content-length 0 server cloudflare
POST H3	200	407675570 google.com/pagead/form-data/	0 0	137ms 49ms	Ping text/html	142.251.32.110 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://google.com/pagead/form-data/407675570?gtm=45be4a70v9137103858z86688972za201zb6688972&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&did=dYWJhMj&gdid=dYWJhMj&npa=0&frm=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&em=tv.1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/destination?id=AW-407675570&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.32.110 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s77-in-f14.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers
POST H3	204	407675570 google.com/ccm/form-data/	0 20 B	136ms 48ms	Ping text/plain	142.251.32.110 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://google.com/ccm/form-data/407675570?gtm=45be4a70v9137103858z86688972za201zb6688972&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&did=dYWJhMj&gdid=dYWJhMj&npa=0&frm=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&em=tv.1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/destination?id=AW-407675570&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.32.110 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s77-in-f14.1e100.net Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:57:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:57:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:49:03 GMT content-type text/plain server Golfe2
POST H2	204	collect analytics.google.com/g/	0 0	130ms 48ms	Fetch text/plain	142.250.80.46 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://analytics.google.com/g/collect?v=2&tid=G-K8KCHE3KSC&gtm=45je4a70v872204243z86688972za200zb6688972&_p=1728557342312&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101686685&gdid=dYWJhMj&cid=2040072898.1728557343&ul=en-ca&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=1&dl=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&sid=1728557343&sct=1&seg=0&dt=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&en=page_view&_fv=1&_nsi=1&_ss=1&ep.content_group=Blog&tfd=1240 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.80.46 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s34-in-f14.1e100.net Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:49:03 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 558 B	127ms 45ms	Ping text/plain	172.253.63.155 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K8KCHE3KSC&cid=2040072898.1728557343&gtm=45je4a70v872204243z86688972za200zb6688972&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101671035~101686685 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.253.63.155 , United States, ASN15169 (GOOGLE, US), Reverse DNS bi-in-f155.1e100.net Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:49:03 GMT content-type text/plain server Golfe2
GET H2	200	rul td.doubleclick.net/td/ga/ Frame 1A37	0 0	131ms 58ms	Document text/html	142.250.176.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://td.doubleclick.net/td/ga/rul?tid=G-K8KCHE3KSC&gacid=2040072898.1728557343&gtm=45je4a70v872204243z86688972za200zb6688972&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101671035~101686685&z=1749341551 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.176.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s37-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, must-revalidate content-encoding br content-length 16 content-type text/html; charset=UTF-8 cross-origin-resource-policy cross-origin date Thu, 10 Oct 2024 10:49:03 GMT expires Fri, 01 Jan 1990 00:00:00 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma no-cache server cafe timing-allow-origin * x-content-type-options nosniff x-xss-protection 0
GET H3	200	ga-audiences www.google.ca/ads/	42 B 63 B	95ms 49ms	Image image/gif	142.250.65.227 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K8KCHE3KSC&cid=2040072898.1728557343&gtm=45je4a70v872204243z86688972za200zb6688972&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101671035~101686685&tag_exp=101671035~101686685&z=639037079 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s73-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Thu, 10 Oct 2024 10:49:03 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	200	linkid.js Show response www.google-analytics.com/plugins/ua/	2 KB 995 B	37ms 35ms	Script text/javascript	142.251.35.174 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/plugins/ua/linkid.js Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.35.174 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s78-in-f14.1e100.net Software sffe / Resource Hash 92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br age 3248 report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} x-content-type-options nosniff expires Thu, 10 Oct 2024 10:54:55 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 09:54:55 GMT last-modified Fri, 30 Jun 2023 18:58:00 GMT content-type text/javascript vary Accept-Encoding cache-control public, max-age=3600 cross-origin-resource-policy cross-origin accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" content-length 697 x-xss-protection 0 server sffe
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/	6 KB 2 KB	122ms 56ms	Script text/javascript	142.251.40.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/?random=1728557343486&cv=11&fst=1728557343486&bg=ffffff&guid=ON&async=1&gtm=45be4a70v9137103858za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&hn=www.googleadservices.com&frm=0&tiba=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s81-in-f2.1e100.net Software cafe / Resource Hash 1662de5ca2452b34fc1e9e47524635897646de0aedd742f43710906e40b08918 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, must-revalidate timing-allow-origin * content-encoding br pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-length 2400 date Thu, 10 Oct 2024 10:49:03 GMT x-xss-protection 0 content-type text/javascript; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	930356311 td.doubleclick.net/td/rul/ Frame 81C4	0 0	80ms 62ms	Document text/html	142.250.176.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://td.doubleclick.net/td/rul/930356311?random=1728557343486&cv=11&fst=1728557343486&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a70v9137103858za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&hn=www.googleadservices.com&frm=0&tiba=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.176.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s37-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, must-revalidate content-encoding br content-length 16 content-type text/html; charset=UTF-8 cross-origin-resource-policy cross-origin date Thu, 10 Oct 2024 10:49:03 GMT expires Fri, 01 Jan 1990 00:00:00 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma no-cache server cafe timing-allow-origin * x-content-type-options nosniff x-xss-protection 0
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/407675570/	6 KB 2 KB	113ms 57ms	Script text/javascript	142.251.40.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/407675570/?random=1728557343504&cv=11&fst=1728557343504&bg=ffffff&guid=ON&async=1&gtm=45be4a70v9137103858za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&hn=www.googleadservices.com&frm=0&tiba=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s81-in-f2.1e100.net Software cafe / Resource Hash dfe2af66b50d1f2e6eae2d9bc0c47f76bf1662036ce02c07182c07d1b8eb7b6c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, must-revalidate timing-allow-origin * content-encoding br pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-length 2400 date Thu, 10 Oct 2024 10:49:03 GMT x-xss-protection 0 content-type text/javascript; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	407675570 td.doubleclick.net/td/rul/ Frame 6F2F	0 0	70ms 62ms	Document text/html	142.250.176.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://td.doubleclick.net/td/rul/407675570?random=1728557343504&cv=11&fst=1728557343504&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a70v9137103858za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&hn=www.googleadservices.com&frm=0&tiba=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.176.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s37-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, must-revalidate content-encoding br content-length 16 content-type text/html; charset=UTF-8 cross-origin-resource-policy cross-origin date Thu, 10 Oct 2024 10:49:03 GMT expires Fri, 01 Jan 1990 00:00:00 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma no-cache server cafe timing-allow-origin * x-content-type-options nosniff x-xss-protection 0
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/163/	11 KB 5 KB	92ms 88ms	Script application/x-javascript	23.204.6.193 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/163/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.204.6.193 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-204-6-193.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Cache-Control max-age=8640000 Content-Encoding gzip ETag "ea7826f34518d7c2295738f39c7640fa:1672972000.238769" Connection keep-alive Expires Sat, 18 Jan 2025 10:49:03 GMT Accept-Ranges bytes P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Length 4741 Date Thu, 10 Oct 2024 10:49:03 GMT Content-Type application/x-javascript Last-Modified Fri, 06 Jan 2023 02:26:40 GMT Server AkamaiNetStorage Vary Accept-Encoding
POST H3	200	collect Show response www.google-analytics.com/j/	3 B 26 B	46ms 45ms	XHR text/plain	142.251.35.174 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=2000393717&t=pageview&_s=1&dl=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&ul=en-ca&de=UTF-8&dt=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAiEAjBAAAACAAIg~&jid=360592173&gjid=1288999302&cid=2040072898.1728557343&uid=3806E697-9FF0-427C-9BED-8AD5CF73775B&tid=UA-3347303-10&_gid=1806420624.1728557343&_slc=1&gtm=45He4a70n71MKSKW3v6688972za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&z=1213135725 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.35.174 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s78-in-f14.1e100.net Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.malwarebytes.com/ Response headers report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],} x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:49:03 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type text/plain cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0 access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 3 server Golfe2
POST H2	200	collect Show response stats.g.doubleclick.net/j/	1 B 361 B	48ms 48ms	XHR text/plain	172.253.63.155 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-3347303-10&cid=2040072898.1728557343&jid=360592173&uid=3806E697-9FF0-427C-9BED-8AD5CF73775B&gjid=1288999302&_gid=1806420624.1728557343&_u=aCDAiEAjBAAAAGAAIg~&z=996162501 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.253.63.155 , United States, ASN15169 (GOOGLE, US), Reverse DNS bi-in-f155.1e100.net Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.malwarebytes.com/ Response headers report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],} x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 10:49:03 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type text/plain strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0 access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 1 server Golfe2
GET H2	200	4072696.js Show response bat.bing.com/p/action/	370 B 433 B	52ms 50ms	Script application/javascript	150.171.27.10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/4072696.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash fce461e0fefe1d6d687b3eab8304d3affaf23fb674b18bfb5242ccfc544e1bb7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding br accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: E59767F026F14A129D11A5824B4E1ED7 Ref B: YTO01EDGE0713 Ref C: 2024-10-10T10:49:03Z x-cache CONFIG_NOCACHE date Thu, 10 Oct 2024 10:49:02 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding
GET H2	204	0 bat.bing.com/action/	0 360 B	50ms 49ms	Image text/plain	150.171.27.10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4072696&tm=gtm002&Ver=2&mid=8d48101d-fc86-43bc-8f20-7c3456a6826d&sid=43e58d8086f511ef97b81b6c1af323e1&vid=43e5bde086f511efb870cb6e58558d0a&vids=1&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&tl=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&p=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&r=&lt=439&evt=pageLoad&sv=1&cdb=AQET&rn=789923 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_256_GCM Server 150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, must-revalidate pragma no-cache accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 4C40B142665E420094B2A0418ABEB145 Ref B: YTO01EDGE0713 Ref C: 2024-10-10T10:49:03Z expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * x-cache CONFIG_NOCACHE date Thu, 10 Oct 2024 10:49:02 GMT
GET H3	200	/ www.google.com/pagead/1p-user-list/930356311/	42 B 64 B	118ms 50ms	Image image/gif	142.251.35.164 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/930356311/?random=1728557343486&cv=11&fst=1728554400000&bg=ffffff&guid=ON&async=1&gtm=45be4a70v9137103858za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&hn=www.googleadservices.com&frm=0&tiba=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfFFvZyF3aFIFuWXG4seiLgY6x3l_qAw&random=3912608776&rmt_tld=0&ipr=y Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.35.164 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s78-in-f4.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Thu, 10 Oct 2024 10:49:03 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	/ www.google.ca/pagead/1p-user-list/930356311/	42 B 64 B	51ms 50ms	Image image/gif	142.250.65.227 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.ca/pagead/1p-user-list/930356311/?random=1728557343486&cv=11&fst=1728554400000&bg=ffffff&guid=ON&async=1&gtm=45be4a70v9137103858za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&hn=www.googleadservices.com&frm=0&tiba=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfFFvZyF3aFIFuWXG4seiLgY6x3l_qAw&random=3912608776&rmt_tld=1&ipr=y Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s73-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Thu, 10 Oct 2024 10:49:03 GMT x-xss-protection 0 content-type image/gif server cafe
POST H/1.1	200 OK	visitWebPage 805-usg-300.mktoresp.com/webevents/	2 B 318 B	159ms 39ms	Ping text/plain	192.28.144.124 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://805-usg-300.mktoresp.com/webevents/visitWebPage?_mchNc=1728557343628&_mchCn=&_mchId=805-USG-300&_mchTk=_mch-malwarebytes.com-1728557343627-82459&_mchHo=www.malwarebytes.com&_mchPo=&_mchRu=%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/163/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Transfer-Encoding chunked X-Request-Id 7a883d70-c244-459f-ad86-2a01b23788f9 Content-Encoding gzip Connection keep-alive Access-Control-Allow-Origin * Date Thu, 10 Oct 2024 10:49:03 GMT Content-Type text/plain; charset=UTF-8 Server nginx/1.20.1
GET H3	200	/ www.google.com/pagead/1p-user-list/407675570/	42 B 64 B	111ms 49ms	Image image/gif	142.251.35.164 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/407675570/?random=1728557343504&cv=11&fst=1728554400000&bg=ffffff&guid=ON&async=1&gtm=45be4a70v9137103858za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&hn=www.googleadservices.com&frm=0&tiba=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfNnyyMD8q9NbouWGKM09QHFy7af9U5g&random=2436251586&rmt_tld=0&ipr=y Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.35.164 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s78-in-f4.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Thu, 10 Oct 2024 10:49:03 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	/ www.google.ca/pagead/1p-user-list/407675570/	42 B 64 B	49ms 49ms	Image image/gif	142.250.65.227 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.ca/pagead/1p-user-list/407675570/?random=1728557343504&cv=11&fst=1728554400000&bg=ffffff&guid=ON&async=1&gtm=45be4a70v9137103858za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F10%2Flarge-scale-google-ads-campaign-targets-utility-software&hn=www.googleadservices.com&frm=0&tiba=Large%20scale%20Google%20Ads%20campaign%20targets%20utility%20software%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1630638223.1728557343&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfNnyyMD8q9NbouWGKM09QHFy7af9U5g&random=2436251586&rmt_tld=1&ipr=y Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga25s73-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Thu, 10 Oct 2024 10:49:03 GMT x-xss-protection 0 content-type image/gif server cafe
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 203 B	119ms 117ms	XHR text/plain	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept * Content-Type text/plain;charset=UTF-8 Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-msedge-ref Ref A: 09E605921CF54540AEEBC8CFCDB91AA4 Ref B: YTO01EDGE0515 Ref C: 2024-10-10T10:49:03Z x-li-fabric prod-lor1 access-control-allow-credentials true report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-uuid AAYkHR52HS91e0dwpYwY+w== x-li-proto http/2 access-control-allow-origin https://www.malwarebytes.com x-cache CONFIG_NOCACHE date Thu, 10 Oct 2024 10:49:03 GMT vary Origin
GET H2	200	nr-rum-1.268.0.min.js Show response js-agent.newrelic.com/	50 KB 16 KB	79ms 19ms	Script application/javascript	162.247.243.39 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-rum-1.268.0.min.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.247.243.39 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ef1c3e2791ab30171e7d93eab1c2993e3680e5fe4e377c6dd8fff2462c67c680 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=300 cache-control public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 content-encoding br etag "e4b0a56cf869ca2f5cc22bfddce7410e" cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 16158 date Thu, 10 Oct 2024 10:49:04 GMT last-modified Tue, 08 Oct 2024 16:37:43 GMT content-type application/javascript x-served-by cache-yyz4565-YYZ x-cache-hits 3137 vary Accept-Encoding
GET H2	200	cropped-favicon-512x512-1-1.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/08/	562 B 808 B	21ms 20ms	Other image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/08/cropped-favicon-512x512-1-1.png?w=32 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6d1f878259463317e1c90fea81b4f5d842248e14d3b23fb19dc54cf62f5e7eac Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 80 86 443 etag "142e06f8047ecb89" accept-ranges bytes, bytes x-cache HIT content-length 562 date Thu, 10 Oct 2024 10:49:03 GMT content-type image/webp last-modified Mon, 06 May 2024 23:44:41 GMT server nginx vary Accept
POST H/1.1	200	NRJS-51878192dd15f231213 Show response bam.nr-data.net/1/	179 B 628 B	244ms 195ms	XHR text/plain	162.247.243.29 FASTLY
General Check archive.org Show headers Download Go to Full URL https://bam.nr-data.net/1/NRJS-51878192dd15f231213?a=732197726&v=1.268.0&to=ZgNQMkpUVkYDBRVQXF9JcwVMXFdbTRUIV1RdAx8WV0ZM&rst=1901&ck=0&s=1046f2b31031ad01&ref=https://www.malwarebytes.com/blog/news/2024/10/large-scale-google-ads-campaign-targets-utility-software&ptid=9131a78dd56e9c7e&ap=824&be=67&fe=1738&dc=372&at=SkRHRAJORRlAB0MDSEwb&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1728557342174,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:5,%22c%22:5,%22s%22:24,%22ce%22:48,%22rq%22:48,%22rp%22:67,%22rpe%22:104,%22di%22:281,%22ds%22:432,%22de%22:439,%22dc%22:1803,%22l%22:1803,%22le%22:1805%7D,%22navigation%22:%7B%7D%7D&fp=235&fcp=235 Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-rum-1.268.0.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.29 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1f9a35cf53668ca134b983241c513ebb6d165dd892c3792145d97511a09e5286 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 content-type text/plain Referer https://www.malwarebytes.com/ Response headers access-control-expose-headers Date timing-allow-origin https://www.malwarebytes.com Connection keep-alive access-control-allow-credentials true access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS cross-origin-resource-policy cross-origin access-control-allow-origin https://www.malwarebytes.com Content-Length 179 date Thu, 10 Oct 2024 10:49:04 GMT content-type text/plain x-served-by cache-yyz4573-YYZ