securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-...
Submission: On June 18 via api (June 18th 2022, 5:13:18 am UTC) from GB — Scanned from GB

Summary HTTP 172 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 34 IPs in 4 countries across 22 domains to perform 172 HTTP transactions. The main IP is 2001:8d8:100f:f000::289, located in Germany and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is securityaffairs.co. The Cisco Umbrella rank of the primary domain is 336399.
TLS certificate: Issued by GeoTrust TLS DV RSA Mixed SHA256 2020... on March 24th 2022. Valid for: a year.

This is the only time securityaffairs.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
44	2001:8d8:100f... 2001:8d8:100f:f000::289	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:215... 2600:9000:2156:8c00:3:c04e:c780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	143.204.89.14 143.204.89.14	16509 (AMAZON-02) (AMAZON-02)
11	2.18.235.93 2.18.235.93	16625 (AKAMAI-AS) (AKAMAI-AS)
17	2606:4700:20:... 2606:4700:20::681a:744	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	52.57.5.215 52.57.5.215	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:215... 2600:9000:2156:1600:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
14	23.35.228.23 23.35.228.23	16625 (AKAMAI-AS) (AKAMAI-AS)
1	54.76.93.140 54.76.93.140	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1 2	2a02:2638:1::13 2a02:2638:1::13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.2.146 178.250.2.146	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	141.95.98.71 141.95.98.71	16276 (OVH) (OVH)
1	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
11	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
1 4	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:36::36	15169 (GOOGLE) (GOOGLE)
172	34

44 2001:8d8:100f:f000::289 (Germany)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)

securityaffairs.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:8c00:3:c04e:c780:93a1 (United States)

ASN16509 (AMAZON-02, US)

ws.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.89.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-14.fra50.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2606:4700:20::681a:744 (United States)

ASN13335 (CLOUDFLARENET, US)

served-by.pixfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.pixfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i2.wp.com

i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.57.5.215 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-5-215.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:1600:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 23.35.228.23 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-228-23.deploy.static.akamaitechnologies.com

lg3.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.93.140 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-93-140.eu-west-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::13 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.71 (France)

ASN16276 (OVH, FR)
PTR: ns3216577.ip-141-95-98.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 172.217.18.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

5d745c8e30503f7f13227bc3050b7c11.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
54d2eab01fa05d420be8997a4dd07591.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
76c9aae25913089a5cfd76b2151e2f77.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:36::36 (United States)

ASN15169 (GOOGLE, US)

us-central1-amp-error-reporting.cloudfunctions.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
44	securityaffairs.co securityaffairs.co — Cisco Umbrella Rank: 336399	1 MB
25	media.net contextual.media.net — Cisco Umbrella Rank: 553 lg3.media.net — Cisco Umbrella Rank: 3895	253 KB
17	pixfuture.com served-by.pixfuture.com — Cisco Umbrella Rank: 32066 cdn.pixfuture.com — Cisco Umbrella Rank: 38749	528 KB
15	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 115 5d745c8e30503f7f13227bc3050b7c11.safeframe.googlesyndication.com 54d2eab01fa05d420be8997a4dd07591.safeframe.googlesyndication.com 76c9aae25913089a5cfd76b2151e2f77.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 150	76 KB
12	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 213 Failed googleads.g.doubleclick.net — Cisco Umbrella Rank: 55	472 KB
12	wp.com i0.wp.com — Cisco Umbrella Rank: 3432 stats.wp.com — Cisco Umbrella Rank: 2946 pixel.wp.com — Cisco Umbrella Rank: 2681	173 KB
7	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 92 www.google.com — Cisco Umbrella Rank: 9 Failed	3 KB
5	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 318	109 KB
5	sharethis.com ws.sharethis.com — Cisco Umbrella Rank: 8975 platform-api.sharethis.com — Cisco Umbrella Rank: 5165 l.sharethis.com — Cisco Umbrella Rank: 4971 buttons-config.sharethis.com — Cisco Umbrella Rank: 5966	51 KB
4	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 394 mug.criteo.com — Cisco Umbrella Rank: 2507	1 KB
3	google.co.uk adservice.google.co.uk — Cisco Umbrella Rank: 4465	1 KB
3	google-analytics.com google-analytics.com — Cisco Umbrella Rank: 52 www.google-analytics.com — Cisco Umbrella Rank: 60 region1.google-analytics.com — Cisco Umbrella Rank: 9409	21 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 96	103 KB
1	cloudfunctions.net us-central1-amp-error-reporting.cloudfunctions.net — Cisco Umbrella Rank: 13267	363 B
1	gstatic.com fonts.gstatic.com	28 KB
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 384	391 B
1	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 581	625 B
1	agkn.com aa.agkn.com — Cisco Umbrella Rank: 459	464 B
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1648	1 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 67 Failed	1 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 793	6 KB
0	rlcdn.com Failed api.rlcdn.com Failed
172	22

	Domain	Requested by
44	securityaffairs.co	securityaffairs.co
14	lg3.media.net	securityaffairs.co
13	served-by.pixfuture.com	securityaffairs.co cdn.pixfuture.com
11	securepubads.g.doubleclick.net	cdn.pixfuture.com securepubads.g.doubleclick.net blank
11	contextual.media.net	securityaffairs.co contextual.media.net
10	i0.wp.com	securityaffairs.co
8	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com blank
5	cdn.ampproject.org	securepubads.g.doubleclick.net
4	www.google.com	tpc.googlesyndication.com blank
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	cdn.pixfuture.com	served-by.pixfuture.com cdn.pixfuture.com securityaffairs.co
3	adservice.google.com	securepubads.g.doubleclick.net
3	adservice.google.co.uk	securepubads.g.doubleclick.net
2	mug.criteo.com
2	gum.criteo.com	1 redirects
2	www.googletagmanager.com	securityaffairs.co www.googletagmanager.com
2	l.sharethis.com	ws.sharethis.com securityaffairs.co
1	us-central1-amp-error-reporting.cloudfunctions.net	cdn.ampproject.org
1	googleads.g.doubleclick.net	blank
1	fonts.gstatic.com	fonts.googleapis.com
1	76c9aae25913089a5cfd76b2151e2f77.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	54d2eab01fa05d420be8997a4dd07591.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	5d745c8e30503f7f13227bc3050b7c11.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	match.adsrvr.org	cdn.pixfuture.com
1	id5-sync.com	cdn.pixfuture.com
1	region1.google-analytics.com	www.googletagmanager.com
1	aa.agkn.com	cdn.pixfuture.com
1	www.google-analytics.com	google-analytics.com
1	pixel.wp.com	securityaffairs.co
1	secure.gravatar.com	securityaffairs.co
1	google-analytics.com	securityaffairs.co
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	stats.wp.com	securityaffairs.co
1	fonts.googleapis.com	securityaffairs.co securepubads.g.doubleclick.net
1	platform-api.sharethis.com	securityaffairs.co
1	ws.sharethis.com	securityaffairs.co
1	maxcdn.bootstrapcdn.com	securityaffairs.co
0	api.rlcdn.com Failed	cdn.pixfuture.com
172	38

This site contains links to these domains. Also see Links.

Domain
www.pixfuture.com
www.sophos.com
i0.wp.com
community.sophos.com
www.volexity.com
github.com
docs.google.com
twitter.com
www.facebook.com
www.linkedin.com
www.pinterest.com
plus.google.com
www.tumblr.com
www.cssii.unifi.it

Subject Issuer	Validity	Valid
www.securityaffairs.co GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-24` - `2023-04-07`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
sharethis.com Amazon	`2021-07-19` - `2022-08-17`	a year	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2022-02-20` - `2023-02-22`	a year	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2022-06-11` - `2023-07-12`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.agkn.com RapidSSL RSA CA 2018	`2020-07-25` - `2022-09-18`	2 years	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-06-15` - `2022-09-18`	3 months	crt.sh
*.id5-sync.com R3	`2022-05-31` - `2022-08-29`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh
*.google.co.uk GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh
misc.google.com GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh

This page contains 26 frames:

Primary Page: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Frame ID: 58DF719A5BB091028DB7E996CDA230DB
Requests: 107 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 597EB99560854F54F71464A8392E8E2C
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: C285F400D50CE37EE2DA5C69911DCF67
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 693169CE9BF7A415E36E5B356BDBC1F2
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 891AAB77246D33DC52CF3512A424409B
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 38D1E9F52CF9465876363AECC3817A42
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: B79C88EE6C6698B95BE33A188D405DCC
Requests: 4 HTTP requests in this frame

Frame: data://truncated
Frame ID: E208DA753C2DC1D0DA7D737770716047
Requests: 4 HTTP requests in this frame

Frame: data://truncated
Frame ID: 2D02B1F5C15E3EB8678328F1D2DB9D4F
Requests: 4 HTTP requests in this frame

Frame: data://truncated
Frame ID: 41F77BEA0619A74FA76417D1C5EEC054
Requests: 4 HTTP requests in this frame

Frame: data://truncated
Frame ID: 29FCCB43D84770F06F23CC48E32683C5
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: FA8EA6EF8C6552A72184406E3F7FF2B3
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: D8BC2DCBA684AA2754D06311C6D50B04
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 29FE5DE55D82A7D97380CC2325CFCDA0
Requests: 24 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 2CD15353D79E4B1788E644CF8B1901CF
Requests: 7 HTTP requests in this frame

Frame: https://5d745c8e30503f7f13227bc3050b7c11.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Frame ID: 33A4C0FFB521922192B1D5A97BA3E528
Requests: 1 HTTP requests in this frame

Frame: https://54d2eab01fa05d420be8997a4dd07591.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Frame ID: 9EE773A87A50123AFA4BA5066D56CA2F
Requests: 1 HTTP requests in this frame

Frame: https://76c9aae25913089a5cfd76b2151e2f77.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Frame ID: 1E783897E1D22F545011EE45FEFD93F9
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 4462BA93651B883B052E61F58347AF3A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 5B004EF4E69D8876BA39333F728C20DA
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 9786DCFE8EA6CB6D787DA4153F58820B
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 04DE7652560AA9A6DFBD5389EF241597
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: C9ACC9A7362DEAD3301F8FCDA2C09DFB
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0CA64EB7BFD1DACF45D931F3BE3BF101
Requests: 2 HTTP requests in this frame

Frame: https://cdn.pixfuture.com/banners/320x50.png
Frame ID: 0B7D3764E97B3C5FE93FF777D2750AC2
Requests: 1 HTTP requests in this frame

Frame: https://cdn.pixfuture.com/banners/300x250.png
Frame ID: A22D56CFA30D29E90C9EA980AD00726E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Chinese APT exploited Sophos Firewall Zero-Day before it was fixedSecurity Affairs

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

Twitter Emoji (Twemoji) (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

twemoji(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

172
Requests

92 %
HTTPS

67 %
IPv6

22
Domains

38
Subdomains

34
IPs

4
Countries

3264 kB
Transfer

5479 kB
Size

18
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: https://www.pixfuture.com/advertisers/?id0348293521d
Title: Powered by pixfuture

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce
Title: advisory

Search URL Search Domain Scan URL

URL: https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/03/Sophos-Firewall-User-Portal-interface.jpg?ssl=1

Search URL Search Domain Scan URL

URL: https://community.sophos.com/sophos-xg-firewall/f/discussions/100119/web-interface-login-failed-17-03
Title: Sophos community

Search URL Search Domain Scan URL

URL: https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/
Title: report

Search URL Search Domain Scan URL

URL: https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/06/Sophos-Firewall-attack.jpg?ssl=1

Search URL Search Domain Scan URL

URL: https://github.com/MountCloud/BehinderClientSource/blob/master/src/main/java/net/rebeyond/behinder/payload/java/SocksProxy.java
Title: Behinder

Search URL Search Domain Scan URL

URL: https://github.com/n1nj4sec/pupy
Title: PupyRAT

Search URL Search Domain Scan URL

URL: https://github.com/cassanof/pantegana
Title: Pantegana

Search URL Search Domain Scan URL

URL: https://github.com/BishopFox/sliver
Title: Sliver

Search URL Search Domain Scan URL

URL: https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform
Title: https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform

Search URL Search Domain Scan URL

URL: https://twitter.com/securityaffairs
Title: @securityaffairs

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sec.affairs
Title: Facebook

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/pub/pierluigi-paganini/b/742/559
Title: Pierluigi Paganini

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer.php?u=https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Title: Facebook

Search URL Search Domain Scan URL

URL: http://twitter.com/share?url=https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&text=Chinese%20DriftingCloud%20APT%20exploited%20Sophos%20Firewall%20Zero-Day%20before%20it%20was%20fixed%20
Title: Twitter

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Search URL Search Domain Scan URL

URL: http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&media=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2Fwp-includes%2Fimages%2Fmedia%2Fdefault.png

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Search URL Search Domain Scan URL

URL: http://www.tumblr.com/share/link?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Search URL Search Domain Scan URL

URL: https://www.cssii.unifi.it/vp-89-il-center.html

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 117

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=Pr5EinxVWEtpYUg3QkNQVjhXZ1ZKdVZEcXcxL3dQVHZhUVE3eHJlWmhYM1VndCtTeUNZemsvOE93TWdmdUtJMVlHMVVaQ2Vxb0JtYmR5ZnN3M295eVZkakRJVlRLVWNlOXQwVjA4Ylp4QWNlQUFSYXJQakgyY3NtekpxOEhYRjluNVpra2ZrYWk0cGQvbVU3cXdybTJWaWI4VW1yUzdUd0xhQ0VPa3llNE5FdldUR1plek9XUm5nMTdVMmVQcEJIaTMzV1NXVG1qclFLQjFnSy9wUjJGSzdNaTlsTDVXMUlYWmN6Z3IzUW5yL1BqTTgwPXw&cppv=2

Request Chain 183

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

172 HTTP transactions
16 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html Show response
securityaffairs.co/wordpress/132377/apt/ 102 KB
26 KB 1404ms
1262ms Document
text/html 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: b1ffaaeee716d6d06ba5ac5b46e85fbb6a3fbaedcd521c16c479b18121cd41ed

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 18 Jun 2022 05:13:09 GMT
link: <https://securityaffairs.co/wordpress/wp-json/>; rel="https://api.w.org/", <https://securityaffairs.co/wordpress/wp-json/wp/v2/posts/132377>; rel="alternate"; type="application/json", <https://securityaffairs.co/wordpress/?p=132377>; rel=shortlink
server: Apache
x-pingback: https://securityaffairs.co/wordpress/xmlrpc.php

GET
H2 200 style.css
securityaffairs.co/wordpress/wp-includes/css/dist/block-library/ 101 KB
101 KB 116ms
115ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-includes/css/dist/block-library/style.css?ver=4e97093b82e416cc51edf59fa8938753
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: feccb7346e200336e12b67bd6df849ec5da2cff1e708760fac69b5cbc7a8369d

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Wed, 25 May 2022 22:59:01 GMT
server: Apache
accept-ranges: bytes
etag: "19377-5dfde04e488a3"
content-length: 103287
content-type: text/css

GET
H2 200 mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/ 11 KB
11 KB 94ms
93ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Wed, 09 Dec 2020 23:31:00 GMT
server: Apache
accept-ranges: bytes
etag: "2bf8-5b61073acf500"
content-length: 11256
content-type: text/css

GET
H2 200 wp-mediaelement.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/ 5 KB
5 KB 207ms
205ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-includes/js/mediaelement/wp-mediaelement.css?ver=4e97093b82e416cc51edf59fa8938753
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 6d9f061cba81145d9bab0964192d66cb2e13a71591482cdfaf5b718341171da1

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Wed, 13 Nov 2019 23:52:08 GMT
server: Apache
accept-ranges: bytes
etag: "1360-597430d761a00"
content-length: 4960
content-type: text/css

GET
H2 200 cookie-law-info-public.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ 3 KB
3 KB 267ms
265ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.1.2
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Mon, 09 May 2022 23:09:21 GMT
server: Apache
accept-ranges: bytes
etag: "c22-5de9c4c5f3471"
content-length: 3106
content-type: text/css

GET
H2 200 cookie-law-info-gdpr.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ 27 KB
27 KB 273ms
271ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.1.2
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Mon, 09 May 2022 23:09:21 GMT
server: Apache
accept-ranges: bytes
etag: "6a71-5de9c4c5f3471"
content-length: 27249
content-type: text/css

GET
H2 200 ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ 142 KB
142 KB 214ms
211ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=1654300135
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: fdb60418f2e23b359b2ade2aca337dccf02e24215d1a77bb816ba1820e5bbff0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Fri, 03 Jun 2022 23:48:55 GMT
server: Apache
accept-ranges: bytes
etag: "23809-5e093c3f1132e"
content-length: 145417
content-type: text/css

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/ 23 KB
6 KB 158ms
57ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=8.2.6

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617, 617
age: 1251195
cdn-cachedat: 2021-06-08 21:08:57
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 6c27480193430d6ea3ddfc5c9cf7f881
cf-ray: 71d188c2fefc0204-ZRH
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/ 19 KB
20 KB 279ms
277ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Wed, 16 Dec 2015 13:54:59 GMT
server: Apache
accept-ranges: bytes
etag: "4d92-52704407f72c0"
content-length: 19858
content-type: text/css

GET
H2 200 tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 539 B
683 B 281ms
236ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Wed, 16 Dec 2015 06:58:04 GMT
server: Apache
accept-ranges: bytes
etag: "21b-526fe6d7cd700"
content-length: 539
content-type: text/css

GET
H2 200 flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 6 KB
6 KB 282ms
188ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Wed, 16 Dec 2015 13:55:09 GMT
server: Apache
accept-ranges: bytes
etag: "1851-5270441180940"
content-length: 6225
content-type: text/css

GET
H2 200 animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 2 KB
2 KB 282ms
81ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Wed, 16 Dec 2015 06:58:02 GMT
server: Apache
accept-ranges: bytes
etag: "6b4-526fe6d5e5280"
content-length: 1716
content-type: text/css

GET
H2 200 font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 17 KB
18 KB 286ms
81ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:10 GMT
last-modified: Wed, 16 Dec 2015 06:58:02 GMT
server: Apache
accept-ranges: bytes
etag: "4574-526fe6d5e5280"
content-length: 17780
content-type: text/css

GET
H2 200 swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 4 KB
5 KB 336ms
71ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:18 GMT
server: Apache
accept-ranges: bytes
etag: "118d-526fe6e527680"
content-length: 4493
content-type: text/css

GET
H2 200 jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 334 B
478 B 336ms
71ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:02 GMT
server: Apache
accept-ranges: bytes
etag: "14e-526fe6d5e5280"
content-length: 334
content-type: text/css

GET
H2 200 screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 110 KB
110 KB 344ms
70ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:04 GMT
server: Apache
accept-ranges: bytes
etag: "1b844-526fe6d7cd700"
content-length: 112708
content-type: text/css

GET
H2 200 custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/ 12 KB
12 KB 414ms
134ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
content-type: text/css; charset: UTF-8;charset=UTF-8
server: Apache

GET
H2 200 grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 49 KB
50 KB 357ms
77ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=4e97093b82e416cc51edf59fa8938753
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:03 GMT
server: Apache
accept-ranges: bytes
etag: "c5f2-526fe6d6d94c0"
content-length: 50674
content-type: text/css

GET
H2 200 sharing.css
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/ 18 KB
19 KB 364ms
83ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/sharing.css?ver=11.0
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: dda6ad33ac53197002b0e3c6c09f3714a6c79b73969d15666500689d8fc50d3c

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Tue, 07 Jun 2022 22:34:54 GMT
server: Apache
accept-ranges: bytes
etag: "4991-5e0e33298e5f6"
content-length: 18833
content-type: text/css

GET
H2 200 social-logos.css
securityaffairs.co/wordpress/wp-content/plugins/jetpack/_inc/social-logos/ 12 KB
12 KB 362ms
81ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/_inc/social-logos/social-logos.css?ver=11.0
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 4cdecc62f5b2c8e9f7cf7b14b9fd42e0c4787d912c1b71426cdfbe0144cede46

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Tue, 07 Jun 2022 22:34:52 GMT
server: Apache
accept-ranges: bytes
etag: "312f-5e0e33276994a"
content-length: 12591
content-type: text/css

GET
H2 200 jquery.js Show response
securityaffairs.co/wordpress/wp-includes/js/jquery/ 282 KB
282 KB 367ms
82ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery.js?ver=3.6.0
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 8c3010509fc7480b59413a90d69e9fafcb3d5aa202faf7862466f6bb8be1a335

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Fri, 23 Jul 2021 22:11:53 GMT
server: Apache
accept-ranges: bytes
etag: "46758-5c7d1b0de3c40"
content-length: 288600
content-type: application/javascript

GET
H2 200 jquery-migrate.js Show response
securityaffairs.co/wordpress/wp-includes/js/jquery/ 25 KB
25 KB 415ms
79ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 9c062d10663416484b5a59bb47a0308526bec56cc69e9f3499fa087d8eae5c7a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 09 Dec 2020 23:31:00 GMT
server: Apache
accept-ranges: bytes
etag: "62d4-5b61073acf500"
content-length: 25300
content-type: application/javascript

GET
H2 200 cookie-law-info-public.js Show response
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/ 33 KB
34 KB 418ms
82ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.1.2
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Mon, 09 May 2022 23:09:21 GMT
server: Apache
accept-ranges: bytes
etag: "8583-5de9c4c5f53b0"
content-length: 34179
content-type: application/javascript

GET
H2 200 medianetAdInjector.js Show response
securityaffairs.co/wordpress/wp-content/plugins/media-net-ads-manager/js/ 562 B
716 B 429ms
75ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/media-net-ads-manager/js/medianetAdInjector.js?ver=2.10.13
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 37d925559381e9d5388c4a096fe1383570546b7b11548d7d6a7e560adcc24e5d

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Sat, 08 May 2021 23:27:41 GMT
server: Apache
accept-ranges: bytes
etag: "232-5c1d9e402b540"
content-length: 562
content-type: application/javascript

GET
H2 200 st_insights.js Show response
ws.sharethis.com/button/ 26 KB
8 KB 147ms
42ms Script
application/javascript 2600:9000:2156:8c00:3:c04e:c780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare&ver=8.2.6

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:8c00:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

149bccf7e467541fc83e870e967ac322b26065e5d6797169c8a677a67db07e60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Thu, 16 Jun 2022 02:47:15 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 181556
x-cache: Hit from cloudfront
content-length: 7654
server: nginx/1.20.1
etag: W/"61e1c3a9-6746"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 b83a899c16a2f53127e152fe5fc783a4.cloudfront.net (CloudFront)
cache-control: max-age=259200
x-amz-cf-pop: FRA50-C1
x-robots-tag: noindex, nofollow
x-amz-cf-id: vPRMrwVRwW3OaYsyDyk-3BrjXGVRPQvH8sKzoEcroxzovGETh8791g==
expires: Sun, 19 Jun 2022 02:47:14 GMT

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 187 KB
42 KB 145ms
45ms Script
text/javascript 143.204.89.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.89.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-89-14.fra50.r.cloudfront.net

Software

Resource Hash

aeef17cb37c9f11b40b147b04e3f16ee3a2fdaa90bae2d503a7e3e99399ea682

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:06:02 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 428
etag: W/"2ed4f-4+kfuOk8lynXIin2Z82IybFv7jo"
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
via: 1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront)
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-amz-cf-pop: FRA50-C1
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-id: QG7E200ck1M4Def6-arCjIe9QYuWg_WLuNPwawZ30Ls1JwCUyOunDQ==

GET
H2 200 dmedianet.js Show response
contextual.media.net/ 168 KB
57 KB 183ms
70ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Resource Hash

e6a6be14f0222ca8d8055544104e8db8a8c44e8273097ddd2ae795314aea9532

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-mnt-h: 22-lb1t
content-encoding: gzip
etag: "56718d0ad881f2fdfd9d9848cbdd290d"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Sat, 18 Jun 2022 05:13:12 GMT
x-cache-hits: 0
strict-transport-security: max-age=31536000
x-mnt-w: 8-19
expires: Sat, 18 Jun 2022 05:18:12 GMT

GET
H2 200 logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/ 44 KB
44 KB 89ms
85ms Image
image/png 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.co/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Wed, 16 Dec 2015 17:30:42 GMT
server: Apache
accept-ranges: bytes
etag: "b0e9-5270743f5f480"
content-length: 45289
content-type: image/png

GET
H2 200 headerbid.js Show response
served-by.pixfuture.com/www/delivery/ 973 B
2 KB 207ms
69ms Script
application/javascript 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/delivery/headerbid.js
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d490f2efc64637640a21c5282a89dd22344e58974641bc7bbbfa4c7e4dc8648e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
access-control-allow-methods: GET, POST, OPTIONS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 52524
content-length: 973
last-modified: Tue, 02 Mar 2021 20:36:48 GMT
server: cloudflare
etag: "603ea1e0-3cd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RKQZcrAgUhEiy8BlArsKXE6EqdRtC%2FMv11Ta09KMzAKG7uj0PkqLAbhwYOZlORYH2R%2FAMuAq56kXgUNYMMIMXyhfmLZgB32yYLTW1CwDwYN9XtFLbvEqF6n2r7uRLkmEuYV6ncmOReXh4I1wRqpVUuB7AgPE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
expires: Sun, 19 Jun 2022 14:27:57 GMT
cache-control: public, max-age=172800, no-transform
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 71d188cb2c0c5a19-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
cf-bgj: minify

GET
H2 200 Sophos-Firewall-User-Portal-interface.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/03/ 10 KB
10 KB 182ms
88ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/03/Sophos-Firewall-User-Portal-interface.jpg?resize=1024%2C549&ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

97c7c069ea9993a56ef75f90e8a2e8c414d41a02ae72241d2dfe1ccbc9c3e31d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 2
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 Jun 2022 05:22:32 GMT
server: nginx
etag: "538770a6195768fc"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2022/03/Sophos-Firewall-User-Portal-interface.jpg>; rel="canonical"
content-length: 10370
expires: Thu, 13 Jun 2024 17:22:32 GMT

GET
H2 200 twemoji.js Show response
securityaffairs.co/wordpress/wp-includes/js/ 32 KB
32 KB 84ms
81ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-includes/js/twemoji.js?ver=4e97093b82e416cc51edf59fa8938753
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: f1f9eda417444f06ef060dd832d8821c84f081a98cdf62acfe981f5554c894dc

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Wed, 25 May 2022 22:59:02 GMT
server: Apache
accept-ranges: bytes
etag: "7e90-5dfde04f437ff"
content-length: 32400
content-type: application/javascript

GET
H2 200 wp-emoji.js Show response
securityaffairs.co/wordpress/wp-includes/js/ 9 KB
9 KB 85ms
83ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-includes/js/wp-emoji.js?ver=4e97093b82e416cc51edf59fa8938753
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Tue, 31 Mar 2020 22:49:14 GMT
server: Apache
accept-ranges: bytes
etag: "231d-5a22e60748e80"
content-length: 8989
content-type: application/javascript

GET css
fonts.googleapis.com/ 0
0

GET
H2 200 facebook.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 514 B
719 B 186ms
92ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png?ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

2bae9fc3e57c860103d1e03360ba3246e3b6c5bcaa6f3183ce8066cc69843a5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 5
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 09 Jul 2021 03:27:44 GMT
server: nginx
etag: "cc42f70ee2b29ba8"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png>; rel="canonical"
content-length: 514
expires: Sun, 09 Jul 2023 15:27:44 GMT

GET
H2 200 twitter.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 672 B
830 B 188ms
94ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png?ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

c0515f174257e5e8c2b69445e28f1cca8792be06d315b7772fc16234937d5cde

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 7
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 09 Jul 2021 03:27:44 GMT
server: nginx
etag: "3f52b9a0eb8f55ed"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png>; rel="canonical"
content-length: 672
expires: Sun, 09 Jul 2023 15:27:44 GMT

GET
H2 200 linkedin.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 600 B
749 B 188ms
95ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png?ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

1b582acaf161db1ef436343a487e95a35a5ee579d35893ad726dce7fa4b85b4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 1
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 09 Jul 2021 03:27:44 GMT
server: nginx
etag: "be413480ff9fb565"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png>; rel="canonical"
content-length: 600
expires: Sun, 09 Jul 2023 15:27:44 GMT

GET
H2 200 Hermit-spyware.jpg
securityaffairs.co/wordpress/wp-content/uploads/2022/06/ 39 KB
39 KB 81ms
79ms Image
image/jpeg 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.co/wordpress/wp-content/uploads/2022/06/Hermit-spyware.jpg
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 58b38236ca737a7fcfc6ac3729e1d9304585c0243f0988050a4b1b6a575bcf58

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Fri, 17 Jun 2022 19:59:36 GMT
server: Apache
accept-ranges: bytes
etag: "9c87-5e1aa3197225e"
content-length: 40071
content-type: image/jpeg

GET
H2 200 Microsoft-Office-365-ransomware.png
securityaffairs.co/wordpress/wp-content/uploads/2022/06/ 179 KB
180 KB 119ms
70ms Image
image/png 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.co/wordpress/wp-content/uploads/2022/06/Microsoft-Office-365-ransomware.png
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 65445cc215e09e39cc11e1980cdc87c5affeb63beb1a5f450f5828a06a6d84a9

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Thu, 16 Jun 2022 21:20:13 GMT
server: Apache
accept-ranges: bytes
etag: "2cdf8-5e197340d1c8f"
content-length: 183800
content-type: image/png

GET
H2 200 Hermit-spyware.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/06/ 6 KB
6 KB 188ms
95ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/06/Hermit-spyware.jpg?resize=300%2C300&ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

a544a354863e132ed1c3eaa530ac00501e2646c3caf8cfa6b274b59348ee3362

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 6
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 17 Jun 2022 20:24:41 GMT
server: nginx
etag: "462be58b551af97b"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2022/06/Hermit-spyware.jpg>; rel="canonical"
content-length: 6422
expires: Mon, 17 Jun 2024 08:24:41 GMT

GET
H2 200 photon.js Show response
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/ 2 KB
2 KB 70ms
70ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20191001
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Tue, 07 Jun 2022 22:34:54 GMT
server: Apache
accept-ranges: bytes
etag: "6e0-5e0e332967501"
content-length: 1760
content-type: application/javascript

GET
H2 200 jquery.adrotate.clicktracker.js Show response
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/ 365 B
519 B 73ms
73ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Fri, 20 May 2022 20:53:40 GMT
server: Apache
accept-ranges: bytes
etag: "16d-5df77af6f7a57"
content-length: 365
content-type: application/javascript

GET
H2 200 ssba.js Show response
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ 2 KB
2 KB 72ms
71ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=1654300135
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 9b978821f78e7bd3a48e5ae8fd7121a291eec506579406745800ca0590f0907c

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Fri, 03 Jun 2022 23:48:55 GMT
server: Apache
accept-ranges: bytes
etag: "7c3-5e093c3f23c09"
content-length: 1987
content-type: application/javascript

GET
H2 200 hint.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 987 B
1 KB 75ms
75ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:17 GMT
server: Apache
accept-ranges: bytes
etag: "3db-526fe6e433440"
content-length: 987
content-type: application/javascript

GET
H2 200 jquery.tipsy.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 4 KB
4 KB 75ms
74ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:17 GMT
server: Apache
accept-ranges: bytes
etag: "1113-526fe6e433440"
content-length: 4371
content-type: application/javascript

GET
H2 200 jquery.easing.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 8 KB
8 KB 72ms
71ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:17 GMT
server: Apache
accept-ranges: bytes
etag: "1fa1-526fe6e433440"
content-length: 8097
content-type: application/javascript

GET
H2 200 browser.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 3 KB
3 KB 69ms
69ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:16 GMT
server: Apache
accept-ranges: bytes
etag: "a36-526fe6e33f200"
content-length: 2614
content-type: application/javascript

GET
H2 200 jquery.flexslider-min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 21 KB
21 KB 70ms
70ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 13:55:10 GMT
server: Apache
accept-ranges: bytes
etag: "53ae-5270441274b80"
content-length: 21422
content-type: application/javascript

GET
H2 200 waypoints.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 8 KB
8 KB 73ms
72ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:18 GMT
server: Apache
accept-ranges: bytes
etag: "1f6c-526fe6e527680"
content-length: 8044
content-type: application/javascript

GET
H2 200 mediaelement-and-player.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/ 69 KB
70 KB 71ms
71ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 13:55:14 GMT
server: Apache
accept-ranges: bytes
etag: "11571-5270441645480"
content-length: 71025
content-type: application/javascript

GET
H2 200 jquery.swipebox.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 11 KB
11 KB 74ms
73ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:11 GMT
last-modified: Wed, 16 Dec 2015 06:58:17 GMT
server: Apache
accept-ranges: bytes
etag: "2a67-526fe6e433440"
content-length: 10855
content-type: application/javascript

GET
H2 200 jquery.circliful.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 3 KB
3 KB 70ms
70ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Wed, 16 Dec 2015 06:58:17 GMT
server: Apache
accept-ranges: bytes
etag: "c18-526fe6e433440"
content-length: 3096
content-type: application/javascript

GET
H2 200 jquery.smarticker.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 13 KB
13 KB 75ms
74ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Wed, 16 Dec 2015 06:58:17 GMT
server: Apache
accept-ranges: bytes
etag: "3225-526fe6e433440"
content-length: 12837
content-type: application/javascript

GET
H2 200 custom.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 12 KB
13 KB 82ms
78ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Wed, 16 Dec 2015 06:58:16 GMT
server: Apache
accept-ranges: bytes
etag: "31d4-526fe6e33f200"
content-length: 12756
content-type: application/javascript

GET
H2 200 sharing.js Show response
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/ 17 KB
18 KB 87ms
84ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/sharing.js?ver=11.0
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: c09fa9679fb13cb821998f533f0f3b51a4a1756bbc05004aef91f8f217c54712

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Tue, 07 Jun 2022 22:34:54 GMT
server: Apache
accept-ranges: bytes
etag: "45a7-5e0e33298e5f6"
content-length: 17831
content-type: application/javascript

GET
H2 200 e-202224.js Show response
stats.wp.com/ 9 KB
3 KB 132ms
39ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202224.js
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr
date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: br
server: nginx
etag: W/"6197c5cf-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 04 Jun 2023 22:30:09 GMT

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
405 B 176ms
40ms XHR
text/plain 52.57.5.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare&ver=8.2.6

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.57.5.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-57-5-215.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Sat, 18 Jun 2022 05:13:12 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin: https://securityaffairs.co
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1728000
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H2 200 5b71b64b04b9a500117b1015.js Show response
buttons-config.sharethis.com/js/ 30 B
427 B 137ms
44ms Script
text/javascript 2600:9000:2156:1600:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/5b71b64b04b9a500117b1015.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1600:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:12:35 GMT
via: 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
last-modified: Mon, 13 Aug 2018 16:48:12 GMT
server: AmazonS3
age: 38
etag: "e6e1643313740711175f51662a65b42f"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=60,public
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 30
x-amz-cf-id: CJ5R-nNDuAbrPvsaDykmVXjuJm18Q4i5Y4tqDnJ2Ccuf6YxJL3nEng==

GET
H2 200 analytics.js Show response
google-analytics.com/ 49 KB
20 KB 147ms
39ms Script
text/javascript 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://google-analytics.com/analytics.js

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 471
date: Sat, 18 Jun 2022 05:05:21 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sat, 18 Jun 2022 07:05:21 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 86 KB
34 KB 146ms
55ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PLPJ653

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bed45cad3d55b2a8b76eb4907d83fdaef952e971f4379a4a453d854d3dd083eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34356
x-xss-protection: 0
last-modified: Sat, 18 Jun 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
H2 200 fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/ 43 KB
44 KB 106ms
74ms Font
application/font-woff 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

Referer: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Origin: https://securityaffairs.co
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Wed, 16 Dec 2015 06:58:09 GMT
server: Apache
accept-ranges: bytes
etag: "ad90-526fe6dc92240"
content-length: 44432
content-type: application/font-woff

GET
H2 200 Sophos-Firewall-attack.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/06/ 31 KB
31 KB 133ms
95ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/06/Sophos-Firewall-attack.jpg?w=967&ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

6a1f7a05c4039dcc9dd76d73d334629f9945bbd573c1e508d666e3a72bbe8f5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 8
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 17 Jun 2022 23:02:04 GMT
server: nginx
etag: "086b6607630bee6d"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2022/06/Sophos-Firewall-attack.jpg>; rel="canonical"
content-length: 31620
expires: Mon, 17 Jun 2024 11:02:04 GMT

GET
H2 200 f00db26378ef7df7c440a8ee60ead62b
secure.gravatar.com/avatar/ 1 KB
1 KB 96ms
29ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 3
date: Sat, 18 Jun 2022 05:13:12 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="f00db26378ef7df7c440a8ee60ead62b.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g>; rel="canonical"
content-length: 1186
expires: Sat, 18 Jun 2022 05:18:12 GMT

GET
H2 200 Digging-The-Deep-Web.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/ 30 KB
30 KB 70ms
40ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png?resize=236%2C300&ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

8f9bff533ca717c10b0a174e354bc152b3d12367b9e1a151d7c641a37a348ad9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 1
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 09 Jul 2021 03:27:45 GMT
server: nginx
etag: "019430226f23bc18"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png>; rel="canonical"
content-length: 30480
expires: Sun, 09 Jul 2023 15:27:45 GMT

GET
H2 200 logo-center-for-cybersecurity.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/10/ 7 KB
8 KB 123ms
94ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/10/logo-center-for-cybersecurity.jpg?resize=290%2C300&ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

73cadf4725483d9a9290b8ea3ad87fe2afc746de5f70e89f088a3df9996bd8dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 6
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Jul 2021 21:19:07 GMT
server: nginx
etag: "ec322889efafd3c4"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2020/10/logo-center-for-cybersecurity.jpg>; rel="canonical"
content-length: 7482
expires: Sun, 09 Jul 2023 09:19:07 GMT

GET
H2 200 newsletter.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2015/03/ 18 KB
18 KB 74ms
74ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2015/03/newsletter.png?resize=300%2C207&ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

8bd198770be5374fbd70821b1ea71c9a40a926f444900632e336625f6c923d1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 4
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 09 Jul 2021 03:27:45 GMT
server: nginx
etag: "c6dd6eaf84242151"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2015/03/newsletter.png>; rel="canonical"
content-length: 18600
expires: Sun, 09 Jul 2023 15:27:45 GMT

GET
H2 200 securityaffairs-best-european-blog2.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/ 63 KB
64 KB 75ms
74ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png?resize=300%2C217&ssl=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

79514487ea68d28f88dc96982e60092a7a701db9e2b6fad1b2eb317482cb7b78

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT lhr 7
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 09 Jul 2021 03:27:44 GMT
server: nginx
etag: "2d852028af1a82a4"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png>; rel="canonical"
content-length: 64828
expires: Sun, 09 Jul 2023 15:27:44 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 46ms
39ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A11.0&blog=29506073&post=132377&tz=0&srv=securityaffairs.co&host=securityaffairs.co&ref=&fcp=2762&rand=0.8817406307910833
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 18 Jun 2022 05:13:12 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H/1.1 204
No Content pview
l.sharethis.com/ 0
380 B 40ms
40ms Image
text/plain 52.57.5.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&sessionID=1655529192009.58675&hostname=securityaffairs.co&location=%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&product=simpleshare&fcmp=false&fcmpv2=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&title=Chinese%20APT%20exploited%20Sophos%20Firewall%20Zero-Day%20before%20it%20was%20fixedSecurity%20Affairs&sop=false&description=China-linked%20threat%20actors%20exploited%20the%20zero-day%20flaw%20CVE-2022-1040%20in%20Sophos%20Firewall%20weeks%20before%20it%20was%20fixed%20by%20the%20security%20vendor.%20Volexity%20researchers%20discovered%20that%20the%20zero-day%20vulnerability%2C%20tracked%20as%20CVE-2022-1040%2C%20in%20Sophos%20Firewall%20was%20exploited%20by%20Chinese%20threat%20actors%20to%20compromise%20a%20company%20and%20cloud-hosted%20web%20servers%20it%20was%20operating.%20The%20vulnerability%20was%20exploited%20by%20%5B%E2%80%A6%5D&description=China-linked%20threat%20actors%20exploited%20the%20zero-day%20flaw%20CVE-2022-1040%20in%20Sophos%20Firewall%20weeks%20before%20it%20was%20fixed%20by%20the%20security%20vendor.%20Volexity%20researchers%20discovered%20that%20the%20zero-day%20vulnerability%2C%20tracked%20as%20CVE-2022-1040%2C%20in%20Sophos%20Firewall%20was%20exploited%20by%20Chinese%20threat%20actors%20to%20compromise%20a%20company%20and%20cloud-hosted%20web%20servers%20it%20was%20operating.%20The%20vulnerability%20was%20exploited%20by%20%5B%E2%80%A6%5D&img_pview=true

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.57.5.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-57-5-215.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Sat, 18 Jun 2022 05:13:12 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1728000
Connection: keep-alive
Access-Control-Allow-Headers: *

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
407 B 139ms
48ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1474891158&t=pageview&_s=1&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&ul=en-us&de=UTF-8&dt=Chinese%20APT%20exploited%20Sophos%20Firewall%20Zero-Day%20before%20it%20was%20fixedSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1313768031&gjid=628097145&cid=901102643.1655529192&tid=UA-59069958-1&_gid=688594561.1655529192&_r=1&_slc=1&z=1784764705

Requested by

Host: google-analytics.com
URL: https://google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://securityaffairs.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hb_v2.js Show response
cdn.pixfuture.com/ 34 KB
9 KB 78ms
69ms Script
application/javascript 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pixfuture.com/hb_v2.js
Requested by: Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/headerbid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6a573dba8f6d9d7183c45eee0b18e7e0857944b32e70384c71ff9f7aa21f971

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 17 Jun 2022 13:45:36 GMT
server: cloudflare
age: 53168
etag: W/"62ac8580-88b7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GrslTgDYVd2IPjkA1yaBLiZygUUTJWNeeqMh6xLhuiGezMPzG8CvjD%2FnpEYkulbU6PUe7205pUMEJ9%2B9JSkAuWdrf8z1AmD9ZvjL580Jy5KtvuU3sYLmxF0kSfXUjJM19B3eOxLdxa2JKjnW6z39"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=172800, no-transform
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 71d188cbacbd5a19-MXP
expires: Sun, 19 Jun 2022 14:27:02 GMT

GET
H2 200 smtr Show response
contextual.media.net/ 91 KB
33 KB 187ms
186ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=816788371&size=300x250&cc=GB&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&nse=5&vi=1655529192651571090&lw=1&ugd=4&kttle=Chinese%20APT%20exploited%20Sophos%20Firewall%20Zero-Day%20before%20it%20was%20fixed&pgid=p01884211750t202206180513&goent=1&nb=1&allsc=EN

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Resource Hash

4f4a6b5c69143779dbb114e280b83ae91249926c95277e1d2952e65719903030

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
expires: Sat, 18 Jun 2022 05:13:12 GMT
cache-control: max-age=0, no-cache, no-store
x-sc-h: 22-s6z8
strict-transport-security: max-age=31536000
content-length: 33207
x-sc-w: 22-1bd6

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 597E 15 KB
6 KB 108ms
108ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

145d5ada31bfaa2e49cc4d1859b391f3ad42b18685a3fe6ed653d6f0654c9636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://securityaffairs.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 5748
content-type: text/html; charset=UTF-8
date: Sat, 18 Jun 2022 05:13:12 GMT
expires: Mon, 20 Jun 2022 05:13:12 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 smtr Show response
contextual.media.net/ 91 KB
33 KB 188ms
188ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=816788371&size=300x250&cc=GB&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&nse=5&vi=1655529192912909630&lw=1&ugd=4&kttle=Chinese%20APT%20exploited%20Sophos%20Firewall%20Zero-Day%20before%20it%20was%20fixed&pgid=p01884211750t202206180513&goent=1&nb=1&allsc=EN

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Resource Hash

87a58d458071d11248281baeeb0f3cb2752529cd395c925b7226e8e57bd0637e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
expires: Sat, 18 Jun 2022 05:13:12 GMT
cache-control: max-age=0, no-cache, no-store
x-sc-h: 22-ccdx
strict-transport-security: max-age=31536000
content-length: 33187
x-sc-w: 22-1bd6

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame C285 15 KB
6 KB 103ms
103ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

145d5ada31bfaa2e49cc4d1859b391f3ad42b18685a3fe6ed653d6f0654c9636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://securityaffairs.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 5748
content-type: text/html; charset=UTF-8
date: Sat, 18 Jun 2022 05:13:12 GMT
expires: Mon, 20 Jun 2022 05:13:12 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 smtr Show response
contextual.media.net/ 91 KB
33 KB 207ms
207ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=GB&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&nse=5&vi=1655529192990819439&lw=1&ugd=4&kttle=Chinese%20APT%20exploited%20Sophos%20Firewall%20Zero-Day%20before%20it%20was%20fixed&pgid=p01884211750t202206180513&goent=1&nb=1&allsc=EN

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Resource Hash

ed25671db99aeb47d3c8a89baf7e318e4bfb503e8c5cbd137190eb1151420da7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
expires: Sat, 18 Jun 2022 05:13:12 GMT
cache-control: max-age=0, no-cache, no-store
x-sc-h: 22-94dj
strict-transport-security: max-age=31536000
content-length: 33193
x-sc-w: 22-ww8p

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 6931 15 KB
6 KB 99ms
99ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

145d5ada31bfaa2e49cc4d1859b391f3ad42b18685a3fe6ed653d6f0654c9636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://securityaffairs.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 5748
content-type: text/html; charset=UTF-8
date: Sat, 18 Jun 2022 05:13:12 GMT
expires: Mon, 20 Jun 2022 05:13:12 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 smtr Show response
contextual.media.net/ 91 KB
33 KB 215ms
214ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=647633027&size=300x250&cc=GB&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&nse=5&vi=1655529192974030167&lw=1&ugd=4&kttle=Chinese%20APT%20exploited%20Sophos%20Firewall%20Zero-Day%20before%20it%20was%20fixed&pgid=p01884211750t202206180513&goent=1&nb=1&allsc=EN

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Resource Hash

d51dc0a9a1d48343764e84a32ff7ca0ee59f7c436b6749983baa6ffc0be18677

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
expires: Sat, 18 Jun 2022 05:13:12 GMT
cache-control: max-age=0, no-cache, no-store
x-sc-h: 22-6mth
strict-transport-security: max-age=31536000
content-length: 33164
x-sc-w: 22-wvzh

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 891A 15 KB
6 KB 92ms
91ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

145d5ada31bfaa2e49cc4d1859b391f3ad42b18685a3fe6ed653d6f0654c9636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://securityaffairs.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 5748
content-type: text/html; charset=UTF-8
date: Sat, 18 Jun 2022 05:13:12 GMT
expires: Mon, 20 Jun 2022 05:13:12 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 smtr Show response
contextual.media.net/ 91 KB
33 KB 201ms
201ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=647633027&size=300x250&cc=GB&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&nse=5&vi=1655529192185368942&lw=1&ugd=4&kttle=Chinese%20APT%20exploited%20Sophos%20Firewall%20Zero-Day%20before%20it%20was%20fixed&pgid=p01884211750t202206180513&goent=1&nb=1&allsc=EN

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Resource Hash

82f6df9bcc9a946b6588f8cf85e8c1b3dbd41db2da01ff71ba2cc20cb4987a82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
expires: Sat, 18 Jun 2022 05:13:12 GMT
cache-control: max-age=0, no-cache, no-store
x-sc-h: 22-mr8q
strict-transport-security: max-age=31536000
content-length: 33208
x-sc-w: 22-wvzh

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 38D1 15 KB
6 KB 87ms
86ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

145d5ada31bfaa2e49cc4d1859b391f3ad42b18685a3fe6ed653d6f0654c9636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://securityaffairs.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 5748
content-type: text/html; charset=UTF-8
date: Sat, 18 Jun 2022 05:13:12 GMT
expires: Mon, 20 Jun 2022 05:13:12 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H/1.1 200
OK bping.php
lg3.media.net/ 35 B
322 B 150ms
41ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=578&&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=816788371&vi=1655529192651571090&ugd=4&lf=6&cc=GB&sc=EN&lper=100&wsip=2886781336&r=1655529192288&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1655529192115763356&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p01884211750t202206180513&vgd_pgids=1&vgd_uspa=0&hvsid=00001655529192284036497500169686&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
H/1.1 200
OK bping.php
lg3.media.net/ 35 B
322 B 149ms
40ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=578&&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=816788371&vi=1655529192912909630&ugd=4&lf=6&cc=GB&sc=EN&lper=100&wsip=2886781336&r=1655529192307&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1655529192115763356&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p01884211750t202206180513&vgd_pgids=2&vgd_uspa=0&hvsid=00001655529192284036497500169686&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
H/1.1 200
OK bping.php
lg3.media.net/ 35 B
322 B 150ms
41ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=569&&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&vi=1655529192990819439&ugd=4&lf=6&cc=GB&sc=EN&wsip=2886781336&r=1655529192315&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1655529192115763356&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p01884211750t202206180513&vgd_pgids=2&vgd_uspa=0&hvsid=00001655529192313036497500168943&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
H/1.1 200
OK bping.php
lg3.media.net/ 35 B
322 B 149ms
41ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=578&&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&vi=1655529192974030167&ugd=4&lf=6&cc=GB&sc=EN&lper=100&wsip=2886781336&r=1655529192323&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1655529192115763356&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p01884211750t202206180513&vgd_pgids=2&vgd_uspa=0&hvsid=00001655529192322036497500164638&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
H/1.1 200
OK bping.php
lg3.media.net/ 35 B
322 B 149ms
41ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=578&&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&vi=1655529192185368942&ugd=4&lf=6&cc=GB&sc=EN&lper=100&wsip=2886781336&r=1655529192331&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1655529192115763356&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p01884211750t202206180513&vgd_pgids=2&vgd_uspa=0&hvsid=00001655529192322036497500164638&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
H2 200 pbix.js Show response
cdn.pixfuture.com/ 401 KB
402 KB 67ms
66ms Script
application/javascript 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pixfuture.com/pbix.js
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43ec4073d62958c460872f86b38f583f3187995f0147e29144340e6826e05cb9

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53164
cf-polished: origSize=410578
cf-bgj: minify
last-modified: Wed, 18 May 2022 15:53:44 GMT
server: cloudflare
etag: W/"62851688-643d2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CWiWwgLRYhJzbf2MZJyH9J%2Fgf%2BiYiwE9YzON1FbaH5a9sDtRjPOJGca6Mn92PR1O2rHfKRmSIf63LLTF7TEB%2FTj6E0tNlkVXd0yhuup7PLNQKX05fJ6yZdhFEcyc%2BQ7tHvQTodyWnX1qX72N1I9J"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=172800, no-transform
cf-ray: 71d188cc5d8d5a19-MXP
expires: Sun, 19 Jun 2022 14:27:02 GMT

GET
H2 200 r.js Show response
aa.agkn.com/adscores/ 0
464 B 160ms
39ms Script
application/javascript 54.76.93.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aa.agkn.com/adscores/r.js?sid=9112309848
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.93.140 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-93-140.eu-west-1.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript;charset=iso-8859-1
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 0
expires: 0

GET
H2 200 hb_v2.php Show response
served-by.pixfuture.com/www/delivery/ 12 KB
12 KB 308ms
184ms XHR
text/javascript 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24272x320x50x4142x_ADSLOT1&keywords=chinese,apt,exploited,sophos,firewall,zeroday,before,it,was,fixedsecurity,affairs&refUrl=&refresh=false&innerWidth=1600
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d51fff60da7851c358bbd7e0497ef78043d512097356b99126840dea7b4fad8f

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
access-control-allow-methods: GET, POST, OPTIONS
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t3E9Eef5CKM%2FbFa9w9h00Q5KttFhtLmZKy1jSJOSjP5OpdAg2dRwAmOYjtx5zWv6KUK5r0HtfKrbY1YTboYBpF8H35piv2OINzS2sIct%2BDB%2Bx%2BEeL%2FA3Ge%2Fn9aR62zayw%2FVeK%2B1sguODm%2Bp%2BYRYGnn3Ieu4X"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=172800, public, no-transform
access-control-allow-credentials: true
cf-ray: 71d188cd1f055a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:12 GMT

GET
H2 200 hb_v2.php Show response
served-by.pixfuture.com/www/delivery/ 12 KB
12 KB 305ms
182ms XHR
text/javascript 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24272x320x50x4142x_ADSLOT1&keywords=chinese,apt,exploited,sophos,firewall,zeroday,before,it,was,fixedsecurity,affairs&refUrl=&refresh=false&innerWidth=1600
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d51fff60da7851c358bbd7e0497ef78043d512097356b99126840dea7b4fad8f

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
access-control-allow-methods: GET, POST, OPTIONS
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y%2BCfU0mX8J17e4YP1AuSnz%2FCw0YEVae0KLGqwgl0a%2BnOhr0Gg02MBVJPfsAJNuojZp8DM42ayLm6PAjw1K1tUOWTvw%2B%2FDe0jC4YswNS%2BmyP80LjNht3tbbOKwSsSRLjnmtVPRTzbQy0WLGwXGx0Ugnyf%2B1%2Fr"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=172800, public, no-transform
access-control-allow-credentials: true
cf-ray: 71d188cd1f0c5a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:12 GMT

GET
H2 200 hb_v2.php Show response
served-by.pixfuture.com/www/delivery/ 12 KB
12 KB 307ms
185ms XHR
text/javascript 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24274x728x90x4142x_ADSLOT1&keywords=chinese,apt,exploited,sophos,firewall,zeroday,before,it,was,fixedsecurity,affairs&refUrl=&refresh=false&innerWidth=1600
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7475124913c1e7faab65864ac77e103c43fb184503fdf982e877517219db7e31

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
access-control-allow-methods: GET, POST, OPTIONS
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FVOEpjzJZtf2OUNbrHaZ17YCsbWLkyi54qxyO2mf3J%2FHZOKQDYCllmFGAQYaNZgkYr2RbgtLZdfpsK4nfkveXoPhAADgCWFn4LTv0uuWn%2FlmVEoGUSARxrg2A92UpUUWch%2F77ybKtlxnE5O24n3UFhI%2BJ8ZM"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=172800, public, no-transform
access-control-allow-credentials: true
cf-ray: 71d188cd1f0d5a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:12 GMT

GET
H2 200 hb_v2.php Show response
served-by.pixfuture.com/www/delivery/ 12 KB
12 KB 314ms
192ms XHR
text/javascript 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24270x300x250x4142x_ADSLOT1&keywords=chinese,apt,exploited,sophos,firewall,zeroday,before,it,was,fixedsecurity,affairs&refUrl=&refresh=false&innerWidth=1600
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4998c611029a47cc552ccda7e56f1f2278e96bbd03914ff79295e610b64f402a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
access-control-allow-methods: GET, POST, OPTIONS
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u4jFYQN7CT9TaHJrHVskh3oCwGLhQ9Zbv7hcMJ6A6MopNpPpftuljF8rJjh3FCnq7Fb3IuZ1u629RD9fVcqVMGlwAYYB0vwXu69FTkQxahc5xNdvv86%2F5B42KS2g7uuSTelP7%2FYBtbY8UvyYXq9Lc85AxDwP"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=172800, public, no-transform
access-control-allow-credentials: true
cf-ray: 71d188cd1f0e5a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:12 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 191 KB
69 KB 51ms
50ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-P62M3QN974&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PLPJ653

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b9498289037a897044db21bd31a4e5e878a0a95fcafebd1ce8242184419511c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 70163
x-xss-protection: 0
expires: Sat, 18 Jun 2022 05:13:12 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
348 B 109ms
36ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-P62M3QN974&gtm=2oe6f0&_p=1474891158&_z=ccd.v9B&cid=901102643.1655529192&ul=en-us&sr=1600x1200&_s=1&sid=1655529192&sct=1&seg=0&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&dt=Chinese%20APT%20exploited%20Sophos%20Firewall%20Zero-Day%20before%20it%20was%20fixedSecurity%20Affairs&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P62M3QN974&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://securityaffairs.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame B79C 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B79C 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B79C 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK bql.php Show response
lg3.media.net/ Frame B79C 15 B
397 B 41ms
41ms Script
text/javascript 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=4658&&&vgd_l2type=sca&v=1&gdpr=1&geo=53.48%7C-2.25&dlper=25&lper=100&lpid=&tsid=1&q=&prv=&type=&ps=&hint=&td=SrcTagSwitchMarketplace%257C%2540%257C&cc=GB&wsip=170785188&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nff&vgd_dnquo=00_XX&ksu=207&fdkt=265&vgde_kbbh=ffoyxQJuO&kwd[]=Internet+VPN+Service&kwt[]=265&kbc[]=40923&kwp[]=1&kid[]=102768264&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.96%7Cps%3D0.613%7C3%3D1.77%7C4%3D1.75&ktd[]=45354871488768&kwd[]=Top+5+VPN+Softwares&kwt[]=265&kbc[]=40923&kwp[]=2&kid[]=350619988&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.94%7Cps%3D0.613%7C3%3D0.74%7C4%3D1.00&ktd[]=45904627302656&kwd[]=Best+VPNs+for+2021&kwt[]=265&kbc[]=40923&kwp[]=3&kid[]=329901344&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.93%7Cps%3D0.613%7C3%3D0.36%7C4%3D1.38&ktd[]=46454383116544&kwd[]=Encrypted+VPN&kwt[]=265&kbc[]=40923&kwp[]=4&kid[]=78651142&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.95%7Cps%3D0.613%7C3%3D0.31%7C4%3D1.00&ktd[]=45904627302656&kwd[]=Network+Security+Services&kwt[]=265&kbc[]=5000&kwp[]=5&kid[]=20331234&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D1.48%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D1.48%7Cps%3D0.613%7C3%3D1.38%7C4%3D2.48&ktd[]=64046585938176&cid=8CU5BD6EW&vwid=1655529192651571090&vi=1655529192651571090&tdAdd[]=ib%3D0&tdAdd[]=asnum%3D9009&vgd_l3_sc=EN&vgd_chost=contextual.media.net&vgd_katbid=-2&vgd_kasts=tstype%3D-10401%7C%7Cgbid%3D-2&vgd_kals=base%7C%7Cpc%3D100%7C%7Clmid%3DvBase%7C%7Cfat%3D2%7C%7Ctbft%3D1&vgd_kalog=CI%3D2731%7C%7CTPTD%3D1166169562321412%7C%7CHID%3D0%7C%7CSI%3D2731%7C%7CTLID%3D6%7C%7CSID%3D8%7C%7CUUID%3Dh8qBma1L5bawTXrgV%7C%7CMI%3D2731%7C%7CMPTD%3D128&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170785188&vgd_nrrv=61084&vgd_nrrmf=1c80a&vgd_nrrsf=scrr&vgd_cty=manchester&vgd_go_pid=8PO9OT5EW&&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&vgd_l1rakh=1655529192115763356&sttm=1655529192284&upk=1655529192.22704&hvsid=00001655529192284036497500169686&verid=3121199&vgd_isiolc=1&pid=8PO9OT5EW&&abpl=2&&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&&vgd_vstrid=DefVid&vgd_optout=0&vgd_cfud=220405&vgd_scsver=238&vgd_icat=602&vgd_spcat=-1&vgd_go_ent=1&vgd_l2ch=1&vgd_rensize=600_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&vgd_pgids=1&&tdAdd[]=uiparams%3D%3Brend_w%3A600%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200&&vgd_uspa=0&vgd_sc=EN&vgd_l1rhst=contextual.media.net&hvsid=00001655529192284036497500169686&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bcJvKkD7oNWATQGXYvCMCRMuQZ8dpUdYXRmDwa2gxLTpeeIbPzZEspL3e5oDlYCnHTF3sV_H9Y-xYLKo8Kv3fwoH6eXTWllsP&cme=Oc36tjJYxxvQVotwnq5nK07DAdojt2AQ7SA-f-6wvmshR4XjCJCOZjqd5hBNoeseqdz5uaaJd04p8au-kKA6FkdOCIne6Zy6N9gaUB0WVKRN8BMJId0jWUvj9I9FIOLOhryynmNyapTvPkIJb7b7ZmxdcoK6sJYMD4AlRCjSmSlJ0Xh6NHNeE-t6c2qsbW0hum6i8O5oAnsG8N_gky4--A%3D%3D%7C%7CiQHnd549NTYzvk_KXdAyZLLiGwKSmQanujEZM33v-s9evXh1yD7P17ViH74UCDxhbNQCQKY6gIuKNna2gNY2VZQpUElLfk0EznIPyNcPvLTfRjyyhKcZZvvV8Q548P5M5ZgciIJbxO6jIoCb0cBUInVwdiIiVLU7%7Cm_wJLtdOUG6FAMmybfe3NPkLIfE_6OsFw6RBzQkHf6T1m_V6VdyXXmo90hZjZqr3beUUA3O220_Uh3mdYZO2cMrIAyqBtkq0y-FW1yAmfNXVwj73tsw3aJUiFPtpR5fGi0D1H9oai6qD3wBOUl__cuWcyxNS9PzF-N02Zn0d1ZAb68PsNKr5MLKZzPX-VV5nfeLnHKkA9xSrjvVyOwQruURjulsvUdCj-CCZqoAdgUo%3D%7C&rc=0&rand=1655529192510&matm=1655529192510&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_x_pos=325&vgd_y_pos=3378&vgd_ren_page_h=5446&vgd_ltimesrc=2&vgd_ltime=245&vgd_rtime=243&vgd_etm=7&vgd_l1hcsd=Slb1t%7C3978&vgd_l1ch=1&vgd_lhl=919&vgd_pgid=p01884211750t202206180513&vgd_adprefflag=11&vgd_sbSup=1&vgd_nrrs=61084&vgd_cntrdt=AS%7CDIV-816788371%7CDIV&oRurl=adomain%3D%26allsc%3DEN%26cb%3Dwindow._mNDetails.initAd%26cc%3DGB%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D816788371%26gdpr%3D1%26goent%3D1%26https%3D1%26kalog%3D%26kals%3D%26kttle%3DChinese%2BAPT%2Bexploited%2BSophos%2BFirewall%2BZero-Day%2Bbefore%2Bit%2Bwas%2Bfixed%26lw%3D1%26matchstring%3D%26nb%3D1%26nse%3D5%26pgid%3Dp01884211750t202206180513%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F132377%252Fapt%252Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html%26size%3D300x250%26ugd%3D4%26vi%3D1655529192651571090%26vif%3D1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
ntCoent-Length: 15
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 15
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
DATA 200
OK truncated
/ Frame E208 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E208 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E208 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK bql.php Show response
lg3.media.net/ Frame E208 15 B
397 B 41ms
41ms Script
text/javascript 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=4665&&&vgd_l2type=sca&v=1&gdpr=1&geo=53.48%7C-2.25&dlper=25&lper=100&lpid=&tsid=1&q=&prv=&type=&ps=&hint=&td=SrcTagSwitchMarketplace%257C%2540%257C&cc=GB&wsip=170785188&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nff&vgd_dnquo=00_XX&ksu=207&fdkt=265&vgde_kbbh=ffoyxQJuO&kwd[]=Internet+VPN+Service&kwt[]=265&kbc[]=40923&kwp[]=1&kid[]=102768264&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.96%7Cps%3D0.613%7C3%3D1.77%7C4%3D1.75&ktd[]=45354871488768&kwd[]=Top+5+VPN+Softwares&kwt[]=265&kbc[]=40923&kwp[]=2&kid[]=350619988&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.94%7Cps%3D0.613%7C3%3D0.74%7C4%3D1.00&ktd[]=45904627302656&kwd[]=Best+VPNs+for+2021&kwt[]=265&kbc[]=40923&kwp[]=3&kid[]=329901344&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.93%7Cps%3D0.613%7C3%3D0.36%7C4%3D1.38&ktd[]=46454383116544&kwd[]=Encrypted+VPN&kwt[]=265&kbc[]=40923&kwp[]=4&kid[]=78651142&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.95%7Cps%3D0.613%7C3%3D0.31%7C4%3D1.00&ktd[]=45904627302656&kwd[]=Network+Security+Services&kwt[]=265&kbc[]=5000&kwp[]=5&kid[]=20331234&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D1.48%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D1.48%7Cps%3D0.613%7C3%3D1.38%7C4%3D2.48&ktd[]=64046585938176&cid=8CU5BD6EW&vwid=1655529192912909630&vi=1655529192912909630&tdAdd[]=ib%3D0&tdAdd[]=asnum%3D9009&vgd_l3_sc=EN&vgd_chost=contextual.media.net&vgd_katbid=-2&vgd_kasts=tstype%3D-10401%7C%7Cgbid%3D-2&vgd_kals=base%7C%7Cpc%3D100%7C%7Clmid%3DvBase%7C%7Cfat%3D2%7C%7Ctbft%3D1&vgd_kalog=CI%3D2731%7C%7CTPTD%3D1166169562321412%7C%7CHID%3D0%7C%7CSI%3D2731%7C%7CTLID%3D6%7C%7CSID%3D8%7C%7CUUID%3Dh8qBma1L5bawTXrgV%7C%7CMI%3D2731%7C%7CMPTD%3D128&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170785188&vgd_nrrv=61084&vgd_nrrmf=1c80a&vgd_nrrsf=scrr&vgd_cty=manchester&vgd_go_pid=8PO9OT5EW&&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D2%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&vgd_l1rakh=1655529192115763356&sttm=1655529192306&upk=1655529192.22704&hvsid=00001655529192284036497500169686&verid=3121199&vgd_isiolc=1&npgv=1&pid=8PO9OT5EW&&abpl=2&&kbbq=%26sde%3D1%26adepth%3D2%26ddepth%3D1%26asn%3D9009&&vgd_vstrid=DefVid&vgd_optout=0&vgd_cfud=220405&vgd_scsver=238&vgd_icat=602&vgd_spcat=-1&vgd_go_ent=1&vgd_l2ch=1&vgd_rensize=610_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&vgd_pgids=2&&tdAdd[]=uiparams%3D%3Brend_w%3A610%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200&&vgd_uspa=0&vgd_sc=EN&vgd_l1rhst=contextual.media.net&hvsid=00001655529192284036497500169686&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bcJvKkD7oNWATQGXYvCMCRMuQZ8dpUdYXRmDwa2gxLTpeeIbPzZEspL3e5oDlYCnHTF3sV_H9Y-xYLKo8Kv3fwoH6eXTWllsP&cme=iEeBmWcmiv9TqJvbiJmrFiDFCn_iBW142bSpp869bX4eM5TBGsusXK_Util_rABFlVW3RNPbYFsXcDuMwsEFQIifGv6DadICcG46nhpSto7ldUZN-YM41Bcwqsqgre7fm6eWUmoEIuP3aVH6bRxA4Q7kR2kh4rwRV2GKlH8yB0rKl7XnfR6-THT03M70tpGbdHTysqhEqbh7eDH026lkIg%3D%3D%7C%7Cm_wJLtdOUG6FAMmybfe3NPkLIfE_6OsFw6RBzQkHf6T1m_V6VdyXXmo90hZjZqr3beUUA3O220_Uh3mdYZO2cMrIAyqBtkq0y-FW1yAmfNXVwj73tsw3aJUiFPtpR5fGi0D1H9oai6qD3wBOUl__cuWcyxNS9PzF-N02Zn0d1ZAb68PsNKr5MLKZzPX-VV5nfeLnHKkA9xSrjvVyOwQruURjulsvUdCj-CCZqoAdgUo%3D%7CiQHnd549NTYzvk_KXdAyZLLiGwKSmQanujEZM33v-s9evXh1yD7P17ViH74UCDxhbNQCQKY6gIuKNna2gNY2VZQpUElLfk0EznIPyNcPvLTfRjyyhKcZZvvV8Q548P5M5ZgciIJbxO6jIoCb0cBUInVwdiIiVLU7%7C&rc=0&rand=1655529192536&matm=1655529192536&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_x_pos=325&vgd_y_pos=3636&vgd_ren_page_h=5704&vgd_ltimesrc=2&vgd_ltime=239&vgd_rtime=236&vgd_etm=5&vgd_l1hcsd=Slb1t%7C3978&vgd_l1ch=1&vgd_lhl=926&vgd_pgid=p01884211750t202206180513&vgd_adprefflag=11&vgd_sbSup=1&vgd_nrrs=61084&vgd_cntrdt=AS%7CDIV-816788371%7CDIV&oRurl=adomain%3D%26allsc%3DEN%26cb%3Dwindow._mNDetails.initAd%26cc%3DGB%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D816788371%26gdpr%3D1%26goent%3D1%26https%3D1%26kalog%3D%26kals%3D%26kttle%3DChinese%2BAPT%2Bexploited%2BSophos%2BFirewall%2BZero-Day%2Bbefore%2Bit%2Bwas%2Bfixed%26lw%3D1%26matchstring%3D%26nb%3D1%26nse%3D5%26pgid%3Dp01884211750t202206180513%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F132377%252Fapt%252Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html%26size%3D300x250%26ugd%3D4%26vi%3D1655529192912909630%26vif%3D1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
ntCoent-Length: 15
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 15
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
DATA 200
OK truncated
/ Frame 2D02 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 2D02 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 2D02 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK bql.php Show response
lg3.media.net/ Frame 2D02 15 B
397 B 41ms
41ms Script
text/javascript 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=4649&&&vgd_l2type=sca&v=1&gdpr=1&geo=53.48%7C-2.25&dlper=25&lper=100&lpid=&tsid=1&q=&prv=&type=&ps=&hint=&td=SrcTagSwitchMarketplace%257C%2540%257C&cc=GB&wsip=170785174&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nff&vgd_dnquo=00_XX&ksu=207&fdkt=265&vgde_kbbh=ffoyxQJuO&kwd[]=Internet+VPN+Service&kwt[]=265&kbc[]=40923&kwp[]=1&kid[]=102768264&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C60%3D0.94%7C62%3D0.55%7C63%3D0.43%7C12%3D1.26%7C66%3D2.13%7C10%3D4.79%7C1%3D0.96%7Cps%3D0.613%7C3%3D1.77%7C4%3D1.75&ktd[]=45354871488768&kwd[]=Top+5+VPN+Softwares&kwt[]=265&kbc[]=40923&kwp[]=2&kid[]=350619988&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C60%3D0.94%7C62%3D0.55%7C63%3D0.43%7C12%3D1.26%7C66%3D2.13%7C10%3D4.79%7C1%3D0.94%7Cps%3D0.613%7C3%3D0.74%7C4%3D1.00&ktd[]=45904627302656&kwd[]=Best+VPNs+for+2021&kwt[]=265&kbc[]=40923&kwp[]=3&kid[]=329901344&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C60%3D0.94%7C62%3D0.55%7C63%3D0.43%7C12%3D1.26%7C66%3D2.13%7C10%3D4.79%7C1%3D0.93%7Cps%3D0.613%7C3%3D0.36%7C4%3D1.38&ktd[]=46454383116544&kwd[]=Encrypted+VPN&kwt[]=265&kbc[]=40923&kwp[]=4&kid[]=78651142&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C60%3D0.94%7C62%3D0.55%7C63%3D0.43%7C12%3D1.26%7C66%3D2.13%7C10%3D4.79%7C1%3D0.95%7Cps%3D0.613%7C3%3D0.31%7C4%3D1.00&ktd[]=45904627302656&kwd[]=Network+Security+Services&kwt[]=265&kbc[]=5000&kwp[]=5&kid[]=20331234&kbc2[]=tnid%3D-1%7C5%3D-1%7C6%3D-1%7C60%3D1.48%7C62%3D0.55%7C63%3D0.43%7C12%3D1.26%7C66%3D2.13%7C10%3D4.79%7C1%3D1.48%7Cps%3D0.613%7C3%3D1.38%7C4%3D2.48&ktd[]=64046585938176&cid=8CU5BD6EW&vwid=1655529192990819439&vi=1655529192990819439&tdAdd[]=ib%3D0&tdAdd[]=asnum%3D9009&vgd_l3_sc=EN&vgd_chost=contextual.media.net&vgd_katbid=-2&vgd_kasts=tstype%3D-10401%7C%7Cgbid%3D-2&vgd_kals=base%7C%7Cpc%3D100%7C%7Clmid%3DvBase%7C%7Cfat%3D1&vgd_kalog=SID%3D8%7C%7CHID%3D3%7C%7CTLID%3D6%7C%7CMI%3D2731%7C%7CMPTD%3D128%7C%7CSI%3D2731%7C%7CTPTD%3D565698774569476%7C%7CCI%3D2731%7C%7CUUID%3Dh8qzjSUT6YEZAfM9a&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170785174&vgd_nrrv=61084&vgd_nrrmf=1c80a&vgd_nrrsf=scrr&vgd_cty=manchester&vgd_go_pid=8PO9OT5EW&&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&vgd_l1rakh=1655529192115763356&sttm=1655529192313&upk=1655529192.22704&hvsid=00001655529192313036497500168943&verid=3121199&vgd_isiolc=1&npgv=1&pid=8PO9OT5EW&&abpl=2&&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&&vgd_vstrid=DefVid&vgd_optout=0&vgd_cfud=220405&vgd_scsver=238&vgd_icat=602&vgd_spcat=-1&vgd_go_ent=1&vgd_l2ch=1&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&vgd_pgids=2&&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200&&vgd_uspa=0&vgd_sc=EN&vgd_l1rhst=contextual.media.net&hvsid=00001655529192313036497500168943&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bcJvKkD7oNWATQGXYvCMCRMuQZ8dpUdYXRmDwa2gxLTpeeIbPzZEspL3e5oDlYCnHTF3sV_H9Y-yJZ8zmoUF1irAwa-nx76Gf&cme=xBVvACyrXFkRhfCgzW1IbB5U2VIy8c2AacgOGS3vBxgPQPmj2R-D1Oq6MjOrC9pAzXMbBuZ7ypRpmXn8fCccnQWlFgsROxB_nznEH1_nDxUBbP2h43QhlgdQ9paEFTWzlnmA4WHI64t1drrspKe2sRa1bZYNuu8vN13rSeWURtsa6WjgTIjQtC5yTlbsjmhYrnaDf-i9S-6vC-KVPYb0_Q%3D%3D%7C%7CiQHnd549NTYzvk_KXdAyZLLiGwKSmQanujEZM33v-s9evXh1yD7P17ViH74UCDxhbNQCQKY6gIuKNna2gNY2VZQpUElLfk0EznIPyNcPvLTfRjyyhKcZZvvV8Q548P5M5ZgciIJbxO6jIoCb0cBUInVwdiIiVLU7%7CJctGz9OZZ6vcYTsS66ZLcecJ7VRmzgFzQ7pdHhXjjoDGWT4i7e6X8pA-QoIMbbk6ixq1IG3RnKzqsfRPpyi-2bvpfMUmaB5Prc0TR1KypP07MgDTphkgqzk2FtA3G2USX8Pb-VgRGZSYFQ7GJrjO-qVPpJmlOQSPsiXLeG1UBe_agRO9J-awuInVu4sHN-l6-pusdkmJLnTZc6gZcuTTnViFf-35cO3TLyzvpqQgJCc%3D%7C&rc=0&rand=1655529192559&matm=1655529192559&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_x_pos=980&vgd_y_pos=414&vgd_ren_page_h=5704&vgd_ltimesrc=2&vgd_ltime=250&vgd_rtime=249&vgd_etm=3&vgd_l1hcsd=Slb1t%7C3978&vgd_l1ch=1&vgd_lhl=926&vgd_pgid=p01884211750t202206180513&vgd_adprefflag=11&vgd_sbSup=1&vgd_nrrs=61084&vgd_cntrdt=AS%7CDIV-184323154%7CDIV&oRurl=adomain%3D%26allsc%3DEN%26cb%3Dwindow._mNDetails.initAd%26cc%3DGB%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D184323154%26gdpr%3D1%26goent%3D1%26https%3D1%26kalog%3D%26kals%3D%26kttle%3DChinese%2BAPT%2Bexploited%2BSophos%2BFirewall%2BZero-Day%2Bbefore%2Bit%2Bwas%2Bfixed%26lw%3D1%26matchstring%3D%26nb%3D1%26nse%3D5%26pgid%3Dp01884211750t202206180513%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F132377%252Fapt%252Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html%26size%3D300x250%26ugd%3D4%26vi%3D1655529192990819439%26vif%3D1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
ntCoent-Length: 15
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 15
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
DATA 200
OK truncated
/ Frame 41F7 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 41F7 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 41F7 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK bql.php Show response
lg3.media.net/ Frame 41F7 15 B
397 B 46ms
46ms Script
text/javascript 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=4585&&&vgd_l2type=sca&v=1&gdpr=1&geo=53.48%7C-2.25&dlper=25&lper=100&lpid=&tsid=1&q=&prv=&type=&ps=&hint=&td=SrcTagSwitchMarketplace%257C%2540%257C&cc=GB&wsip=170785072&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nff&vgd_dnquo=00_XX&ksu=207&fdkt=265&vgde_kbbh=ffoyxQJuO&kwd[]=Internet+VPN+Service&kwt[]=265&kbc[]=40923&kwp[]=1&kid[]=102768264&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.96%7Cps%3D0.613%7C3%3D1.77%7C4%3D1.75&ktd[]=274894815488&kwd[]=Free+VPN+Provider&kwt[]=265&kbc[]=884&kwp[]=2&kid[]=273704258&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.98%7Cps%3D0.613%7C3%3D0.49%7C4%3D1.17&ktd[]=274911592704&kwd[]=Norton+Free+Download&kwt[]=265&kbc[]=5783&kwp[]=3&kid[]=20766360&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D1.29%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D1.18%7Cps%3D0.613%7C3%3D0.93%7C4%3D1.17&ktd[]=274894815488&kwd[]=Network+Security+System&kwt[]=265&kbc[]=5000&kwp[]=4&kid[]=20331260&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.86%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.91%7Cps%3D0.613%7C3%3D1.49%7C4%3D1.00&ktd[]=274894815488&kwd[]=Network+Security+Services&kwt[]=265&kbc[]=5000&kwp[]=5&kid[]=20331234&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D1.48%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D1.48%7Cps%3D0.613%7C3%3D1.38%7C4%3D2.48&ktd[]=274911592704&cid=8CU5BD6EW&vwid=1655529192974030167&vi=1655529192974030167&tdAdd[]=ib%3D0&tdAdd[]=asnum%3D9009&vgd_l3_sc=EN&vgd_chost=contextual.media.net&vgd_katbid=-2&vgd_kasts=tstype%3D-10401%7C%7Cgbid%3D-2&vgd_kals=base%7C%7Cpc%3D100%7C%7Clmid%3DvBase%7C%7Cfat%3D1&vgd_kalog=MI%3D2731%7C%7CTPTD%3D1128854894875140%7C%7CTLID%3D6%7C%7CSID%3D8%7C%7CUUID%3Dh8qDi1lctLMSoic1r%7C%7CHID%3D2%7C%7CCI%3D2731%7C%7CSI%3D2731%7C%7CMPTD%3D128&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170785072&vgd_nrrv=61084&vgd_nrrmf=1c80a&vgd_nrrsf=scrr&vgd_cty=manchester&vgd_go_pid=8PO9OT5EW&&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&vgd_l1rakh=1655529192115763356&sttm=1655529192322&upk=1655529192.22704&hvsid=00001655529192322036497500164638&verid=3121199&vgd_isiolc=1&npgv=1&pid=8PO9OT5EW&&abpl=2&&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&&vgd_vstrid=DefVid&vgd_optout=0&vgd_cfud=220405&vgd_scsver=238&vgd_icat=602&vgd_spcat=-1&vgd_go_ent=1&vgd_l2ch=1&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&vgd_pgids=2&&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200&&vgd_uspa=0&vgd_sc=EN&vgd_l1rhst=contextual.media.net&hvsid=00001655529192322036497500164638&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bcJvKkD7oNWATQGXYvCMCRMuQZ8dpUdYXRmDwa2gxLTpeeIbPzZEspL3e5oDlYCnHTF3sV_H9Y-z9xSBWu7Xqqqk8aowtw0Bk&cme=ZFDJH1mOatYp7KcARCwrzF55p28dKem6vTi4ZI9VLbucJ1OJ0ETN3IKx3H2FyrOxm-nx-wjT4zg4ElRLbRJFWPl-wdYnMeJ_5SWIdCZwY07Q7_ZNF9QqRp-8Uws5ExVu5MHOEt557lpoUOe52dp5YOEOQ7uhTs7Xgco_nR9BsQXDxSUA6sJ80OydAoJxE475VpjDCqOrZ032EE3c-EZGEA%3D%3D%7C%7CiQHnd549NTYzvk_KXdAyZLLiGwKSmQanujEZM33v-s9evXh1yD7P17ViH74UCDxhbNQCQKY6gIuKNna2gNY2VZQpUElLfk0EznIPyNcPvLTfRjyyhKcZZvvV8Q548P5M5ZgciIJbxO6jIoCb0cBUInVwdiIiVLU7%7CoRH49KxTBmgOHKISDkDlBaRb76LIeTKzXk_aHZOdhijBh2h65PLtGrkXoMF7K-eWt_z0VrNgB1FJr8-UuTii30wlkjCmpsBw2Q3xX4l9WTOwhKGE6ll4S587bJCQJHot4deRd42VQXxlYAF4Qo87yZm-HSVurz1VQMHGqiSD5CZly3ETdXTjwm9DQ55kHwlIqFwcRwPDHCvUi0Jp2-yaRoaj3MaYGL5-1eAixqUPHw4%3D%7C&rc=0&rand=1655529192574&matm=1655529192574&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_x_pos=980&vgd_y_pos=725&vgd_ren_page_h=5704&vgd_ltimesrc=2&vgd_ltime=259&vgd_rtime=255&vgd_etm=2&vgd_l1hcsd=Slb1t%7C3978&vgd_l1ch=1&vgd_lhl=926&vgd_pgid=p01884211750t202206180513&vgd_adprefflag=11&vgd_sbSup=1&vgd_nrrs=61084&vgd_cntrdt=AS%7CDIV-647633027%7CDIV&oRurl=adomain%3D%26allsc%3DEN%26cb%3Dwindow._mNDetails.initAd%26cc%3DGB%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D647633027%26gdpr%3D1%26goent%3D1%26https%3D1%26kalog%3D%26kals%3D%26kttle%3DChinese%2BAPT%2Bexploited%2BSophos%2BFirewall%2BZero-Day%2Bbefore%2Bit%2Bwas%2Bfixed%26lw%3D1%26matchstring%3D%26nb%3D1%26nse%3D5%26pgid%3Dp01884211750t202206180513%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F132377%252Fapt%252Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html%26size%3D300x250%26ugd%3D4%26vi%3D1655529192974030167%26vif%3D1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
ntCoent-Length: 15
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 15
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
DATA 200
OK truncated
/ Frame 29FC 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 29FC 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 29FC 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK bql.php Show response
lg3.media.net/ Frame 29FC 15 B
397 B 41ms
41ms Script
text/javascript 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=4589&&&vgd_l2type=sca&v=1&gdpr=1&geo=53.48%7C-2.25&dlper=25&lper=100&lpid=&tsid=1&q=&prv=&type=&ps=&hint=&td=SrcTagSwitchMarketplace%257C%2540%257C&cc=GB&wsip=170785072&bca=0&ugd=4&vgd_fcic=0&vgde_setid=Nff&vgd_dnquo=00_XX&ksu=207&fdkt=265&vgde_kbbh=ffoyxQJuO&kwd[]=Internet+VPN+Service&kwt[]=265&kbc[]=40923&kwp[]=1&kid[]=102768264&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.96%7Cps%3D0.613%7C3%3D1.77%7C4%3D1.75&ktd[]=274894815488&kwd[]=Free+VPN+Provider&kwt[]=265&kbc[]=884&kwp[]=2&kid[]=273704258&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.94%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.98%7Cps%3D0.613%7C3%3D0.49%7C4%3D1.17&ktd[]=274911592704&kwd[]=Norton+Free+Download&kwt[]=265&kbc[]=5783&kwp[]=3&kid[]=20766360&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D1.29%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D1.18%7Cps%3D0.613%7C3%3D0.93%7C4%3D1.17&ktd[]=274894815488&kwd[]=Network+Security+System&kwt[]=265&kbc[]=5000&kwp[]=4&kid[]=20331260&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D0.86%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D0.91%7Cps%3D0.613%7C3%3D1.49%7C4%3D1.00&ktd[]=274894815488&kwd[]=Network+Security+Services&kwt[]=265&kbc[]=5000&kwp[]=5&kid[]=20331234&kbc2[]=5%3D-1%7C6%3D-1%7C66%3D2.13%7C60%3D1.48%7C63%3D0.43%7C62%3D0.55%7C12%3D1.26%7C10%3D4.79%7C1%3D1.48%7Cps%3D0.613%7C3%3D1.38%7C4%3D2.48&ktd[]=274911592704&cid=8CU5BD6EW&vwid=1655529192185368942&vi=1655529192185368942&tdAdd[]=ib%3D0&tdAdd[]=asnum%3D9009&vgd_l3_sc=EN&vgd_chost=contextual.media.net&vgd_katbid=-2&vgd_kasts=tstype%3D-10401%7C%7Cgbid%3D-2&vgd_kals=base%7C%7Cpc%3D100%7C%7Clmid%3DvBase%7C%7Cfat%3D1&vgd_kalog=MI%3D2731%7C%7CTPTD%3D1128854894875140%7C%7CTLID%3D6%7C%7CSID%3D8%7C%7CUUID%3Dh8qDi1lctLMSoic1r%7C%7CHID%3D2%7C%7CCI%3D2731%7C%7CSI%3D2731%7C%7CMPTD%3D128&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170785072&vgd_nrrv=61084&vgd_nrrmf=1c80a&vgd_nrrsf=scrr&vgd_cty=manchester&vgd_go_pid=8PO9OT5EW&&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D2%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&vgd_l1rakh=1655529192115763356&sttm=1655529192330&upk=1655529192.22704&hvsid=00001655529192322036497500164638&verid=3121199&vgd_isiolc=1&npgv=1&pid=8PO9OT5EW&&abpl=2&&kbbq=%26sde%3D1%26adepth%3D2%26ddepth%3D1%26asn%3D9009&&vgd_vstrid=DefVid&vgd_optout=0&vgd_cfud=220405&vgd_scsver=238&vgd_icat=602&vgd_spcat=-1&vgd_go_ent=1&vgd_l2ch=1&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&vgd_pgids=2&&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200&&vgd_uspa=0&vgd_sc=EN&vgd_l1rhst=contextual.media.net&hvsid=00001655529192322036497500164638&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bcJvKkD7oNWATQGXYvCMCRMuQZ8dpUdYXRmDwa2gxLTpeeIbPzZEspL3e5oDlYCnHTF3sV_H9Y-z9xSBWu7Xqqqk8aowtw0Bk&cme=8K3HFGxnaDmIzeZ9yF37YzhrjUd4o8N3HniuViN7kL-0HjHL2muKNxP-69R4u94XtHaaGMVKfTcXewTsD2Z-jqNACmgopbqYe3iE3bTNTtQHWqRYT_8Kov9hqFrM9UgVUVqoceoxGmtBZ8vy4eY8jkJC38S5nRG938fTM2ArSJMpCzVDzfbZYluIo8Lmcag4CkarzXiqOZ3Y9aITEAyLoDnn-HOjkM1k%7C%7CiQHnd549NTYzvk_KXdAyZLLiGwKSmQanujEZM33v-s9evXh1yD7P17ViH74UCDxhbNQCQKY6gIuKNna2gNY2VZQpUElLfk0EznIPyNcPvLTfRjyyhKcZZvvV8Q548P5M5ZgciIJbxO6jIoCb0cBUInVwdiIiVLU7%7CoRH49KxTBmgOHKISDkDlBaRb76LIeTKzXk_aHZOdhijBh2h65PLtGrkXoMF7K-eWt_z0VrNgB1FJr8-UuTii30wlkjCmpsBw2Q3xX4l9WTOwhKGE6ll4S587bJCQJHot4deRd42VQXxlYAF4Qo87yZm-HSVurz1VQMHGqiSD5CZly3ETdXTjwm9DQ55kHwlIqFwcRwPDHCvUi0Jp2-yaRoaj3MaYGL5-1eAixqUPHw4%3D%7C&rc=0&rand=1655529192591&matm=1655529192591&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vgd_x_pos=980&vgd_y_pos=982&vgd_ren_page_h=5704&vgd_ltimesrc=2&vgd_ltime=267&vgd_rtime=265&vgd_etm=3&vgd_l1hcsd=Slb1t%7C3978&vgd_l1ch=1&vgd_lhl=926&vgd_pgid=p01884211750t202206180513&vgd_adprefflag=11&vgd_sbSup=1&vgd_nrrs=61084&vgd_cntrdt=AS%7CDIV-647633027%7CDIV&oRurl=adomain%3D%26allsc%3DEN%26cb%3Dwindow._mNDetails.initAd%26cc%3DGB%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D647633027%26gdpr%3D1%26goent%3D1%26https%3D1%26kalog%3D%26kals%3D%26kttle%3DChinese%2BAPT%2Bexploited%2BSophos%2BFirewall%2BZero-Day%2Bbefore%2Bit%2Bwas%2Bfixed%26lw%3D1%26matchstring%3D%26nb%3D1%26nse%3D5%26pgid%3Dp01884211750t202206180513%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F132377%252Fapt%252Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html%26size%3D300x250%26ugd%3D4%26vi%3D1655529192185368942%26vif%3D1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:12 GMT
ntCoent-Length: 15
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 15
Expires: Sat, 18 Jun 2022 05:13:12 GMT

GET
H/1.1 200
OK log
lg3.media.net/ 35 B
371 B 40ms
40ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/log?&logid=kfk&evtid=adPrvLog&otherprov=0&cid=8CU5BD6EW&crid=647633027&cc=GB&ugd=4&timeTaken=1&vi=1655529192185368942&r=1655529192619

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Jetty(9.4.35.v20201120) /

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 18 Jun 2022 05:13:12 GMT
Server: Jetty(9.4.35.v20201120)
Strict-Transport-Security: max-age=21600
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sat, 18 Jun 2022 05:13:12 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 180ms
59ms Preflight
application/json 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://securityaffairs.co
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://securityaffairs.co
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 18 Jun 2022 05:13:12 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1153
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=Pr5EinxVWEtpYUg3QkNQVjhXZ1ZKdVZEcXcxL3dQVHZhUVE3eHJlWmhYM1VndCtTeUNZemsvOE93TWdmdUtJMVlHMVVaQ2Vxb0JtYmR5ZnN3M295eVZkakRJVlRLVWNlOXQwVjA4Ylp4QWNlQUFSYXJQakgyY3NtekpxOE...

347 B
616 B

104ms
36ms

XHR
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=Pr5EinxVWEtpYUg3QkNQVjhXZ1ZKdVZEcXcxL3dQVHZhUVE3eHJlWmhYM1VndCtTeUNZemsvOE93TWdmdUtJMVlHMVVaQ2Vxb0JtYmR5ZnN3M295eVZkakRJVlRLVWNlOXQwVjA4Ylp4QWNlQUFSYXJQakgyY3NtekpxOEhYRjluNVpra2ZrYWk0cGQvbVU3cXdybTJWaWI4VW1yUzdUd0xhQ0VPa3llNE5FdldUR1plek9XUm5nMTdVMmVQcEJIaTMzV1NXVG1qclFLQjFnSy9wUjJGSzdNaTlsTDVXMUlYWmN6Z3IzUW5yL1BqTTgwPXw&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

c12233e8d1bf606a324a8e286e847a219124fd5f7ebba263e57a215a88cac152

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3753
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
location: https://mug.criteo.com/sid?cpp=Pr5EinxVWEtpYUg3QkNQVjhXZ1ZKdVZEcXcxL3dQVHZhUVE3eHJlWmhYM1VndCtTeUNZemsvOE93TWdmdUtJMVlHMVVaQ2Vxb0JtYmR5ZnN3M295eVZkakRJVlRLVWNlOXQwVjA4Ylp4QWNlQUFSYXJQakgyY3NtekpxOEhYRjluNVpra2ZrYWk0cGQvbVU3cXdybTJWaWI4VW1yUzdUd0xhQ0VPa3llNE5FdldUR1plek9XUm5nMTdVMmVQcEJIaTMzV1NXVG1qclFLQjFnSy9wUjJGSzdNaTlsTDVXMUlYWmN6Z3IzUW5yL1BqTTgwPXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://securityaffairs.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1452
content-length: 482
expires: 0

POST
H/1.1 200 529.json Show response
id5-sync.com/g/v2/ 213 B
625 B 137ms
43ms XHR
application/json 141.95.98.71
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/529.json

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.71 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216577.ip-141-95-98.eu

Software

Resource Hash

02a59c96963f899010446e895abda59142439b5d01a3da630dddd3f2a59753f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://securityaffairs.co
date: Sat, 18 Jun 2022 05:13:11 GMT
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
391 B 125ms
40ms XHR
application/json 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=yoni5uv&fmt=json
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: e35bec407ed0d29bfcbb100e16db491396d1baef5bb5c314ca8b87604af062fd

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://securityaffairs.co
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Mon, 18 Jul 2022 05:13:12 GMT

GET gpt.js
securepubads.g.doubleclick.net/tag/js/ Frame FA8E 0
0

POST
H2 204 tracking.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ 0
268 B 168ms
167ms XHR
text/plain 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KcmQiEUBbitaaK6u1ZS5QYCt1GB51ilcWuB%2FiRw5sh608cEvx8wl9x5%2BzpQW6I7seJWrgeqtIrULb8noYTH%2FBrQtRwH857BIanDp9SxI7cUjARJARgw35emrOE5KjRmYtGB8T1zvgImblaq8e9qjRn%2B9dni1"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=172800
access-control-allow-credentials: true
cf-ray: 71d188cf095e5a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:12 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame D8BC 81 KB
28 KB 142ms
57ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

9102b12e034f45a994efb33ec0ade589e74128ccb67ab6c244a461d1f6544a13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28074
x-xss-protection: 0
server: sffe
etag: "1248 / 335 of 1000 / last-modified: 1655503512"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 18 Jun 2022 05:13:12 GMT

POST
H2 204 tracking.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ 0
272 B 166ms
166ms XHR
text/plain 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ac7Dz5UF2X43iYcLIa6XyHXU6Z1U562H0Seaiwp6QJw4mAPD6XMgnEXjV5YP3d2oq9w5jdXc2wuTanxSza2w6jrUgPn9OUr%2FmjAKmFMymjp%2FwWAMN4KIqgmcRrAgM6EINMHIBE4%2F%2B7DZdvqx8431HWxFrKXI"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=172800
access-control-allow-credentials: true
cf-ray: 71d188cf196e5a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:12 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 29FE 81 KB
27 KB 172ms
98ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

5248c8e706ec8be86fdad29e8929ca59b3789e9151377141695b905539cae130

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27885
x-xss-protection: 0
server: sffe
etag: "1248 / 74 of 1000 / last-modified: 1655503484"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 18 Jun 2022 05:13:12 GMT

POST
H2 204 tracking.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ 0
277 B 166ms
166ms XHR
text/plain 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=seTXN3ZpsQBsPgxEKU6OuIxZie32RXXzJbrUums%2F%2FHTRvM5dWG%2BgkK0GOTtnMwSJdQJjKXW2MVZDY9XW6cwCOoa40ry7dXbK%2B%2FPnn1p17D6KPLsgR1OFYVX6bLjNlrJxo4ynu%2BxO%2FV6nc1Omgc%2FnqPCxSttc"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=172800
access-control-allow-credentials: true
cf-ray: 71d188cf29815a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:12 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 2CD1 81 KB
27 KB 175ms
109ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

5248c8e706ec8be86fdad29e8929ca59b3789e9151377141695b905539cae130

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27885
x-xss-protection: 0
server: sffe
etag: "1248 / 65 of 1000 / last-modified: 1655503484"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 18 Jun 2022 05:13:12 GMT

POST
H2 204 tracking.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ 0
266 B 173ms
173ms XHR
text/plain 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WQ2aAWOElCGcDGPus8%2FAz6NejuP68rMCxp552ISVetDddWwFQ8xcJSaSFpSryrrQKM5oaxioemvTd6L2jl0vusyT1Un6hkOgLXpEtdZwfY9nyCixU%2BPbl0l38Ezj1dxdEGTM90kgNYymas8kSZyqfB741PiJ"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=172800
access-control-allow-credentials: true
cf-ray: 71d188cf39965a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:12 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 137ms
34ms Preflight
application/json 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 18 Jun 2022 05:13:13 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1052
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 pubads_impl_2022061401.js Show response
securepubads.g.doubleclick.net/gpt/ Frame D8BC 370 KB
125 KB 126ms
42ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061401.js?cb=31068112

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

e2f1d6c82d89c9a6c1faf7a2e83e00645a2fa1291756de19c937f275bb285090

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 21:09:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29030
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 128388
x-xss-protection: 0
last-modified: Tue, 14 Jun 2022 08:34:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 17 Jun 2023 21:09:23 GMT

GET
H3 200 pubads_impl_2022061301.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 2CD1 370 KB
125 KB 111ms
58ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

aedd1b112e247314f7e990485858511f15d21e57885ee131e9e1a3fec0173d61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 21:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27692
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 128384
x-xss-protection: 0
last-modified: Mon, 13 Jun 2022 08:35:33 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 17 Jun 2023 21:31:41 GMT

GET
H3 200 pubads_impl_2022061301.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 29FE 370 KB
125 KB 89ms
41ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

aedd1b112e247314f7e990485858511f15d21e57885ee131e9e1a3fec0173d61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 21:31:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27692
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 128384
x-xss-protection: 0
last-modified: Mon, 13 Jun 2022 08:35:33 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 17 Jun 2023 21:31:41 GMT

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ Frame 2CD1 107 B
792 B 137ms
48ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2CD1 107 B
549 B 140ms
51ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 2CD1 755 B
441 B 247ms
247ms XHR
text/plain 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1577477958326502&correlator=1880013290833056&eid=31067815%2C31068075%2C42531607&output=ldjh&gdfp_req=1&vrg=2022061301&ptt=17&impl=fif&iu_parts=330713950%2Cgam2--10769783&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&adks=2010498315&sfv=1-0-38&ecs=20220618&fsapi=false&sc=1&cookie_enabled=1&cdm=securityaffairs.co&abxe=1&dt=1655529193300&lmt=1655529193&dlt=1655529192803&idt=477&biw=1600&bih=1200&isw=300&ish=250&adxs=320&adys=4011&ucis=9cq27wgkpeah&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&nhd=1&url=about%3Ablank&top=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&frm=23&vis=1&scr_x=0&scr_y=0&psz=300x250&msz=300x0&fws=256&ohw=0&ea=0&ga_vid=901102643.1655529192&ga_sid=1655529193&ga_hid=1451996764&ga_fc=true&btvi=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

5090dab2726dc528566240086e26a34fab2917be706acbdc30d3bb4cbfba8fe1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 411
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://securityaffairs.co
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2CD1 14 KB
11 KB 152ms
62ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022061301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

89a3bd4327262614139ff4b3aa661457ad4992fad7884e4aecf9da183236647e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10825
x-xss-protection: 0

GET
H2 200 container.html Show response
5d745c8e30503f7f13227bc3050b7c11.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 33A4 6 KB
4 KB 161ms
47ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5d745c8e30503f7f13227bc3050b7c11.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Jun 2022 05:13:13 GMT
expires: Sun, 18 Jun 2023 05:13:13 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ Frame 29FE 107 B
165 B 119ms
58ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 29FE 107 B
165 B 132ms
72ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 29FE 58 KB
12 KB 289ms
288ms XHR
text/plain 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3379929733979674&correlator=3453296308004502&eid=44761477%2C42531605&output=ldjh&gdfp_req=1&vrg=2022061301&ptt=17&impl=fif&iu_parts=330713950%2Cgam2--10451007&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=1&adks=211988754&sfv=1-0-38&ecs=20220618&fsapi=false&sc=1&cookie_enabled=1&cdm=securityaffairs.co&abxe=1&dt=1655529193325&lmt=1655529193&dlt=1655529192793&idt=522&biw=1600&bih=1200&isw=728&ish=90&adxs=320&adys=520&ucis=nkv6ymzc33li&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&nhd=1&url=about%3Ablank&top=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&frm=23&vis=1&scr_x=0&scr_y=0&psz=728x90&msz=728x0&fws=256&ohw=0&ea=0&ga_vid=901102643.1655529192&ga_sid=1655529193&ga_hid=1871185837&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

7349bcf3c205cdbf881852ec688351d7d4d5c274b3f1d5d4e428f7d82208c643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12524
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://securityaffairs.co
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 29FE 14 KB
11 KB 120ms
54ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022061301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddaa716af0aeb2764d2348a430cf2cd40c4467627d318ee9fc0f606d037f4fd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10574
x-xss-protection: 0

GET
H2 200 container.html Show response
54d2eab01fa05d420be8997a4dd07591.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9EE7 6 KB
4 KB 163ms
48ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://54d2eab01fa05d420be8997a4dd07591.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Jun 2022 05:13:13 GMT
expires: Sun, 18 Jun 2023 05:13:13 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ Frame D8BC 107 B
165 B 103ms
66ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061401.js?cb=31068112

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame D8BC 107 B
165 B 107ms
71ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061401.js?cb=31068112

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame D8BC 657 B
392 B 278ms
278ms XHR
text/plain 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4381457497904123&correlator=4054787653266196&eid=31068112%2C42531606&output=ldjh&gdfp_req=1&vrg=2022061401&ptt=17&impl=fif&iu_parts=330713950%2Cgam2--10452603&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50&ifi=1&adks=2576163042&sfv=1-0-38&ecs=20220618&fsapi=false&sc=1&cookie_enabled=1&cdm=securityaffairs.co&abxe=1&dt=1655529193351&lmt=1655529193&dlt=1655529192784&idt=552&biw=1600&bih=1200&isw=320&ish=50&adxs=320&adys=871&ucis=twlo0wncnm2t&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&nhd=1&url=about%3Ablank&top=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&frm=23&vis=1&scr_x=0&scr_y=0&psz=320x50&msz=320x0&fws=256&ohw=0&ea=0&ga_vid=901102643.1655529192&ga_sid=1655529193&ga_hid=866325110&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061401.js?cb=31068112

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

d364713a62eeb62f91220e5f92392c444800089ed7fbd99162a69b4216ce8437

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 362
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://securityaffairs.co
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D8BC 14 KB
11 KB 117ms
78ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022061401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061401.js?cb=31068112

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a5f19374c985a4fe5809852344ba6856a06f15497a847d9958ec929ce2e54f59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10713
x-xss-protection: 0

GET
H2 200 container.html Show response
76c9aae25913089a5cfd76b2151e2f77.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1E78 6 KB
4 KB 170ms
47ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://76c9aae25913089a5cfd76b2151e2f77.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061401.js?cb=31068112

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Jun 2022 05:13:13 GMT
expires: Sun, 18 Jun 2023 05:13:13 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 29FE 17 KB
7 KB 155ms
53ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 18 Jun 2022 05:13:13 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2CD1 17 KB
6 KB 145ms
67ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 18 Jun 2022 05:13:13 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D8BC 17 KB
6 KB 127ms
61ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061401.js?cb=31068112

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 18 Jun 2022 05:13:13 GMT

GET
H/1.1 200
OK bqi.php
lg3.media.net/ 15 B
15 B 42ms
41ms Image
text/javascript 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?vgd_len=1659&lf=3&&vgd_l2type=sca&pid=8PO9OT5EW&kalog=SID=8||HID=3||TLID=6||MI=2731||MPTD=128||SI=2731||TPTD=565698774569476||CI=2731||UUID=h8qzjSUT6YEZAfM9a&kals=base||pc=100||lmid=vBase||fat=1&kasts=tstype=-10401||gbid=-2&kata=at2&katbid=-2&katen=1&pc=100&cme=xBVvACyrXFkRhfCgzW1IbB5U2VIy8c2AacgOGS3vBxgPQPmj2R-D1Oq6MjOrC9pAzXMbBuZ7ypRpmXn8fCccnQWlFgsROxB_nznEH1_nDxUBbP2h43QhlgdQ9paEFTWzlnmA4WHI64t1drrspKe2sRa1bZYNuu8vN13rSeWURtsa6WjgTIjQtC5yTlbsjmhYrnaDf-i9S-6vC-KVPYb0_Q==||iQHnd549NTYzvk_KXdAyZLLiGwKSmQanujEZM33v-s9evXh1yD7P17ViH74UCDxhbNQCQKY6gIuKNna2gNY2VZQpUElLfk0EznIPyNcPvLTfRjyyhKcZZvvV8Q548P5M5ZgciIJbxO6jIoCb0cBUInVwdiIiVLU7|JctGz9OZZ6vcYTsS66ZLcecJ7VRmzgFzQ7pdHhXjjoDGWT4i7e6X8pA-QoIMbbk6ixq1IG3RnKzqsfRPpyi-2bvpfMUmaB5Prc0TR1KypP07MgDTphkgqzk2FtA3G2USX8Pb-VgRGZSYFQ7GJrjO-qVPpJmlOQSPsiXLeG1UBe_agRO9J-awuInVu4sHN-l6-pusdkmJLnTZc6gZcuTTnViFf-35cO3TLyzvpqQgJCc=|&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vi=1655529192990819439&ugd=4&cc=GB&sc=EN&startTime=1655529192313&l2type=sca&vgd_l1rakh=1655529192115763356&l1ch=1&sttm=1655529192313&upk=1655529192.22704&hvsid=00001655529192313036497500168943&verid=3121199&vgd_sc=EN&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&l1hcsd=l1!Slb1t|3978&vgd_l1rhst=contextual.media.net&vgd_uspa=0&vgd_isiolc=1&npgv=1&pvl=%7B%22mbr%22%3A1%2C%22l1rpth%22%3A%22%2Fdmedianet.js%22%2C%22pgids%22%3A2%7D&l2ch=1&vgd_pgid=p01884211750t202206180513&vgd_pgids=2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:13 GMT
ntCoent-Length: 15
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 15
Expires: Sat, 18 Jun 2022 05:13:13 GMT

GET
H/1.1 200
OK bqi.php
lg3.media.net/ 15 B
15 B 41ms
41ms Image
text/javascript 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?vgd_len=1660&lf=3&&vgd_l2type=sca&pid=8PO9OT5EW&kalog=MI=2731||TPTD=1128854894875140||TLID=6||SID=8||UUID=h8qDi1lctLMSoic1r||HID=2||CI=2731||SI=2731||MPTD=128&kals=base||pc=100||lmid=vBase||fat=1&kasts=tstype=-10401||gbid=-2&kata=at2&katbid=-2&katen=1&pc=100&cme=ZFDJH1mOatYp7KcARCwrzF55p28dKem6vTi4ZI9VLbucJ1OJ0ETN3IKx3H2FyrOxm-nx-wjT4zg4ElRLbRJFWPl-wdYnMeJ_5SWIdCZwY07Q7_ZNF9QqRp-8Uws5ExVu5MHOEt557lpoUOe52dp5YOEOQ7uhTs7Xgco_nR9BsQXDxSUA6sJ80OydAoJxE475VpjDCqOrZ032EE3c-EZGEA==||iQHnd549NTYzvk_KXdAyZLLiGwKSmQanujEZM33v-s9evXh1yD7P17ViH74UCDxhbNQCQKY6gIuKNna2gNY2VZQpUElLfk0EznIPyNcPvLTfRjyyhKcZZvvV8Q548P5M5ZgciIJbxO6jIoCb0cBUInVwdiIiVLU7|oRH49KxTBmgOHKISDkDlBaRb76LIeTKzXk_aHZOdhijBh2h65PLtGrkXoMF7K-eWt_z0VrNgB1FJr8-UuTii30wlkjCmpsBw2Q3xX4l9WTOwhKGE6ll4S587bJCQJHot4deRd42VQXxlYAF4Qo87yZm-HSVurz1VQMHGqiSD5CZly3ETdXTjwm9DQ55kHwlIqFwcRwPDHCvUi0Jp2-yaRoaj3MaYGL5-1eAixqUPHw4=|&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vi=1655529192974030167&ugd=4&cc=GB&sc=EN&startTime=1655529192321&l2type=sca&vgd_l1rakh=1655529192115763356&l1ch=1&sttm=1655529192322&upk=1655529192.22704&hvsid=00001655529192322036497500164638&verid=3121199&vgd_sc=EN&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&l1hcsd=l1!Slb1t|3978&vgd_l1rhst=contextual.media.net&vgd_uspa=0&vgd_isiolc=1&npgv=1&pvl=%7B%22mbr%22%3A1%2C%22l1rpth%22%3A%22%2Fdmedianet.js%22%2C%22pgids%22%3A2%7D&l2ch=1&vgd_pgid=p01884211750t202206180513&vgd_pgids=2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:13 GMT
ntCoent-Length: 15
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 15
Expires: Sat, 18 Jun 2022 05:13:13 GMT

GET
H/1.1 200
OK bqi.php
lg3.media.net/ 15 B
15 B 41ms
40ms Image
text/javascript 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?vgd_len=1668&lf=3&&vgd_l2type=sca&pid=8PO9OT5EW&kalog=MI=2731||TPTD=1128854894875140||TLID=6||SID=8||UUID=h8qDi1lctLMSoic1r||HID=2||CI=2731||SI=2731||MPTD=128&kals=base||pc=100||lmid=vBase||fat=1&kasts=tstype=-10401||gbid=-2&kata=at2&katbid=-2&katen=1&pc=100&cme=8K3HFGxnaDmIzeZ9yF37YzhrjUd4o8N3HniuViN7kL-0HjHL2muKNxP-69R4u94XtHaaGMVKfTcXewTsD2Z-jqNACmgopbqYe3iE3bTNTtQHWqRYT_8Kov9hqFrM9UgVUVqoceoxGmtBZ8vy4eY8jkJC38S5nRG938fTM2ArSJMpCzVDzfbZYluIo8Lmcag4CkarzXiqOZ3Y9aITEAyLoDnn-HOjkM1k||iQHnd549NTYzvk_KXdAyZLLiGwKSmQanujEZM33v-s9evXh1yD7P17ViH74UCDxhbNQCQKY6gIuKNna2gNY2VZQpUElLfk0EznIPyNcPvLTfRjyyhKcZZvvV8Q548P5M5ZgciIJbxO6jIoCb0cBUInVwdiIiVLU7|oRH49KxTBmgOHKISDkDlBaRb76LIeTKzXk_aHZOdhijBh2h65PLtGrkXoMF7K-eWt_z0VrNgB1FJr8-UuTii30wlkjCmpsBw2Q3xX4l9WTOwhKGE6ll4S587bJCQJHot4deRd42VQXxlYAF4Qo87yZm-HSVurz1VQMHGqiSD5CZly3ETdXTjwm9DQ55kHwlIqFwcRwPDHCvUi0Jp2-yaRoaj3MaYGL5-1eAixqUPHw4=|&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F132377%2Fapt%2Fchinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html&vi=1655529192185368942&ugd=4&cc=GB&sc=EN&startTime=1655529192329&l2type=sca&vgd_l1rakh=1655529192115763356&l1ch=1&sttm=1655529192330&upk=1655529192.22704&hvsid=00001655529192322036497500164638&verid=3121199&vgd_sc=EN&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D2%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&kbbq=%26sde%3D1%26adepth%3D2%26ddepth%3D1&l1hcsd=l1!Slb1t|3978&vgd_l1rhst=contextual.media.net&vgd_uspa=0&vgd_isiolc=1&npgv=1&pvl=%7B%22mbr%22%3A1%2C%22l1rpth%22%3A%22%2Fdmedianet.js%22%2C%22pgids%22%3A2%7D&l2ch=1&vgd_pgid=p01884211750t202206180513&vgd_pgids=2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Server: Apache
Date: Sat, 18 Jun 2022 05:13:13 GMT
ntCoent-Length: 15
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 15
Expires: Sat, 18 Jun 2022 05:13:13 GMT

GET runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 4462 0
0

GET aframe
www.google.com/recaptcha/api2/ Frame 5B00 0
0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012205270638000/ Frame 29FE 220 KB
61 KB 151ms
40ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205270638000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d201bb3b6a9b5c4572b54ff8cd188b8e77374e1694fead0bccd6606ffa147b2d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 389160
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61483
x-xss-protection: 0
server: sffe
date: Mon, 13 Jun 2022 17:07:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d3c2451425189fb5"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 13 Jun 2023 17:07:13 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012205270638000/v0/ Frame 29FE 14 KB
5 KB 220ms
110ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205270638000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2598751639a254b3c54ab5d1cdd4e601c0203acbe56e4f33ad5ff4e4b447f20

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 246508
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5195
x-xss-protection: 0
server: sffe
date: Wed, 15 Jun 2022 08:44:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "4bef18b80ae165d1"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 15 Jun 2023 08:44:45 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012205270638000/v0/ Frame 29FE 94 KB
28 KB 227ms
117ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205270638000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b33ef452b57bede722776b1432be568c083cd38efbcfe92491d71abfcd3fafa0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 284157
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28898
x-xss-protection: 0
server: sffe
date: Tue, 14 Jun 2022 22:17:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "7ca71f15d9979237"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 14 Jun 2023 22:17:16 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012205270638000/v0/ Frame 29FE 5 KB
2 KB 242ms
132ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205270638000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51310f9f30077e7818e6b290aae0692724791cb33999d75f916d9d623635b42a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 284128
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1900
x-xss-protection: 0
server: sffe
date: Tue, 14 Jun 2022 22:17:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "67a7e3dd539afea9"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 14 Jun 2023 22:17:45 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012205270638000/v0/ Frame 29FE 40 KB
13 KB 243ms
133ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012205270638000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78e13001bbc9c6b06ffa301191bd9e762226ed69f84e53f956d16e54f4408c7c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 284143
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12940
x-xss-protection: 0
server: sffe
date: Tue, 14 Jun 2022 22:17:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "8dbbd2e5c9e4f2da"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 14 Jun 2023 22:17:30 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 29FE 8 KB
1 KB 139ms
50ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022061301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 18 Jun 2022 04:35:56 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 18 Jun 2022 05:13:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 18 Jun 2022 05:13:13 GMT

GET
H3 200 en_bl.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 29FE 2 KB
2 KB 123ms
51ms Image
image/png 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en_bl.png

Requested by

Host: blank
URL: about:blank

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e1a3c83144fa5752c8668ca056742ec9e6d6dfe5cfb75a97a9e53d1150068f91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:29:48 GMT
x-content-type-options: nosniff
server: cafe
age: 78205
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 11660698925711390587
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2471
x-xss-protection: 0
expires: Sat, 18 Jun 2022 07:29:48 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 29FE 295 B
319 B 121ms
48ms Image
image/png 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: blank
URL: about:blank

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 09:53:05 GMT
x-content-type-options: nosniff
server: cafe
age: 69608
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Sat, 18 Jun 2022 09:53:05 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 29FE 0
0 126ms
51ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS1OzdYsVxNy7wpUIc9Tl5YIRe6Gqe-8yKFKFBbT16SueDrKBzAe4T9xlyus0_gUfXsR7ljzGVqYBnagBAgKYc-3kGXMw
Requested by: Host: blank
URL: about:blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 29FE 0
0 79ms
79ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C19U16V6tYsnQF9Wux_APu96A0AjjheO1arH9ue2KENrZHhABIKOHlh5gu4aAgNAKoAHxg_2VA8gBAeACAKgDAaoEugFP0GJ4XxiM11gw-wN4LGxgyVZU2rVJELTn-mMOU5KdT_VpeE3v5WfxP-m9Wj1XbxJz9DzZ6jp61z-04Q472Y6197JCco3IF0Msrl9u7qMlQSkd8sa5Mh7dQvxmDMDmsMvZQZ7ef-tTFoTFXVAvQXiQhT6wUkCzDauH9kJ51TJPgvJQxv8K97XmSS7PGIozVijNYm12CuX_FhxpItlKppA4StjQuCOKdW-q2eL0wLTFd9K4Z-7ma892ruLABPCdj5z_A-AEAYAHhIjcf6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEMivEtIICQiI4YAQEAEYHYAKA8gLAdgTA4gUAdAVAYAXAbIXHgocCAASFHB1Yi0xNTc1OTExNTg1NDMyNTQ4GPbdIA&sigh=mzmoOpsiYYk&uach_m=[UACH]&template_id=5001
Requested by: Host: blank
URL: about:blank
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.18.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s28-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/10643234943503200683/ Frame 29FE 1 KB
1 KB 119ms
49ms Image
image/jpeg 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10643234943503200683/downsize_200k_v1?w=100&h=100

Requested by

Host: blank
URL: about:blank

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4b5dd9a8ffa32ab0e107f83b4f5b391bf3697d7c6401c47d7468a87e3cd390

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 16:32:48 GMT
x-content-type-options: nosniff
age: 391225
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1437
x-xss-protection: 0
last-modified: Mon, 26 Aug 2019 12:09:57 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 13 Jun 2023 16:32:48 GMT

GET
DATA 200
OK truncated
/ Frame 29FE 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3c60b06f075c11b6d041e1b6f60fa6ab64409c3f363c82706e95ebbfd95dc42c

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9786 13 KB
5 KB 90ms
42ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 27544
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Jun 2022 21:34:09 GMT
expires: Sat, 17 Jun 2023 21:34:09 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 04DE 783 B
998 B 102ms
51ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2b121a122b3060ee47ba6d9dd76cfcc37abdbf17098582d2fa471348c512c5bf

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Yr_8atMSdqZme6BLrniGKg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-Yr_8atMSdqZme6BLrniGKg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 18 Jun 2022 05:13:13 GMT
expires: Sat, 18 Jun 2022 05:13:13 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C9AC 13 KB
5 KB 90ms
44ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 27544
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Jun 2022 21:34:09 GMT
expires: Sat, 17 Jun 2023 21:34:09 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0CA6 783 B
741 B 136ms
88ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

76b8ea16e9eb368b2850280652c0944d54e2442f544347bbb87eb51eb8acce74

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ftYaUc0liH6k07r5F3j8Cg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-ftYaUc0liH6k07r5F3j8Cg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 18 Jun 2022 05:13:13 GMT
expires: Sat, 18 Jun 2022 05:13:13 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET KTHYOna8VhrtXL7WgNcsIkAo3r0EoLxY2-h6-FKeiG0.js
pagead2.googlesyndication.com/bg/ Frame 9786 0
0

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 04DE 0
0

POST
H2 204 tracking.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ 0
314 B 178ms
178ms XHR
text/plain 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EE38RNO%2BBEadfh4ic3O6G4QCKySvQU2dLb9yMLySnrg8iv8d5nngBdHL3hBOSt9LGeaEv26f8HAMkx7y%2BxttvT48YjSh6CU0zAnaRVCaSosLMO86W4WFW2u2Ov9qSqYoGFNPRSOtFe5nrkR9gvkVC7fshkLJ"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=172800
access-control-allow-credentials: true
cf-ray: 71d188d559795a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:13 GMT

GET
H2 200 320x50.png
cdn.pixfuture.com/banners/ Frame 0B7D 20 KB
21 KB 70ms
70ms Image
image/png 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.pixfuture.com/banners/320x50.png
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f83d6d161d5d98ac0a6305e882cbf211c330178f30bac4095f967b5475c0e92

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53129
content-length: 20836
last-modified: Tue, 02 Feb 2021 21:40:24 GMT
server: cloudflare
etag: "6019c6c8-5164"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4VEGl%2FJKc430XoEa%2B%2F4CcwVv4kwGF1SNut9FwpEvRhJclOrCCtdRy%2BsHpu7irEaIgCgusr5u8D003Heiprh%2BMwdpwp0s0c5N2RLFi5iukLSMtnAohBVR1YEG8DQGJq0xs%2FvycONAzjHOazZxZYyj"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=172800, no-transform
accept-ranges: bytes
cf-ray: 71d188d55a655a19-MXP
expires: Sun, 19 Jun 2022 14:27:04 GMT

GET KTHYOna8VhrtXL7WgNcsIkAo3r0EoLxY2-h6-FKeiG0.js
pagead2.googlesyndication.com/bg/ Frame C9AC 0
0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 29FE 28 KB
28 KB 166ms
41ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://securityaffairs.co
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 20:36:54 GMT
x-content-type-options: nosniff
age: 203779
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Jun 2023 20:36:54 GMT

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 0CA6 0
0

POST
H2 204 tracking.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ 0
271 B 169ms
168ms XHR
text/plain 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ovNfocpuv6CVvqoMwEACI37HRLU9%2B0nySiTtU8SSEF7su2Mrer%2BdQ6t4nvK6We22YnPanoODB0CHm1AEK%2BC8Y9ASbh5Zws%2BO1U1B3iW5Zmen2coBa8BZni%2FXffthFJYNaVhtY8WTUv3i5qQRxuKo%2BaGuoDBi"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=172800
access-control-allow-credentials: true
cf-ray: 71d188d589be5a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:13 GMT

GET
H2 200 300x250.png
cdn.pixfuture.com/banners/ Frame A22D 44 KB
45 KB 68ms
67ms Image
image/png 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.pixfuture.com/banners/300x250.png
Requested by: Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6251b4b4525b9007511a48a6cda9a168f07ff77ccc4dd75759486af624a13301

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://securityaffairs.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Sat, 18 Jun 2022 05:13:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 53155
content-length: 45195
last-modified: Wed, 03 Feb 2021 20:39:58 GMT
server: cloudflare
etag: "601b0a1e-b08b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Q%2BS1wqfloSJujWpQeZgzqYEwVj6vXZjKg65M5rrNu%2F9L9eiYG1PVsT%2FA8VPqyaUwUo5g5vt71%2Bl5FeKWqay1noiJgD7ty3fpgTCBdFU5p4hhbjroUmGqwubAekA%2FHI8JQXliuEs9OWSLv1i0%2BTz"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=172800, no-transform
accept-ranges: bytes
cf-ray: 71d188d58aa35a19-MXP
expires: Sun, 19 Jun 2022 14:27:02 GMT

POST
H2 204 vtr.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ 0
613 B 168ms
167ms XHR
text/plain 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/vtr.php
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yrs5Gozg9ttwui4GKcX6pArl0zQe7bSp0hOTLlx0uQNAum6akOEoMq0%2BlOkNodkrfgDCaFLG6DJFZONZJeYxH2UeYeir%2Bg4kuVn7LdUmPxsvwMKDJro3Lz7pm0UThx%2FrsxzSWbuyWoI4V%2B609gNCUD%2B5SQnq"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=172800
access-control-allow-credentials: true
cf-ray: 71d188d589c15a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:13 GMT

POST
H2 204 vtr.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ 0
273 B 168ms
167ms XHR
text/plain 2606:4700:20::681a:744
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/vtr.php
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:744 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://securityaffairs.co/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1ENWkbmdLxuBbi59rZD%2BSuqd8U%2BPR9b8O08gwM%2Fo0xdsotOqzFUon9frUSDZsMDuudtl7OD0rv%2FSVEBHqjYeyRnI2VxBLjRky1vhSjgViSOPcskcViYzG5ILdEKrzjFdxo%2F%2FnENw5iF8Mleml4qn2xCWX2ae"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=172800
access-control-allow-credentials: true
cf-ray: 71d188d589c25a3d-MXP
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Mon, 20 Jun 2022 05:13:13 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 29FE
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

158ms
68ms

Image
text/html

2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: blank
URL: about:blank
Protocol: H2
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Redirect headers

date: Sat, 18 Jun 2022 05:13:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

POST
H2 400 r Show response
us-central1-amp-error-reporting.cloudfunctions.net/ Frame 29FE 11 B
363 B 214ms
130ms XHR
text/plain 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-amp-error-reporting.cloudfunctions.net/r
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012205270638000/amp4ads-v0.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend / Express
Resource Hash: 7c41b898c5da0cfa4aa049b65ef50248bce9a72d24bef4c723786431921b75aa

Request headers

Referer
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Sat, 18 Jun 2022 05:13:14 GMT
content-encoding: gzip
server: Google Frontend
x-powered-by: Express
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: 5705561c44580e0b8bda25567e00ad23
cache-control: private
function-execution-id: rtfz4q1ov4v4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 29FE 0
0 76ms
76ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C19U16V6tYsnQF9Wux_APu96A0AjjheO1arH9ue2KENrZHhABIKOHlh5gu4aAgNAKoAHxg_2VA8gBAeACAKgDAaoEugFP0GJ4XxiM11gw-wN4LGxgyVZU2rVJELTn-mMOU5KdT_VpeE3v5WfxP-m9Wj1XbxJz9DzZ6jp61z-04Q472Y6197JCco3IF0Msrl9u7qMlQSkd8sa5Mh7dQvxmDMDmsMvZQZ7ef-tTFoTFXVAvQXiQhT6wUkCzDauH9kJ51TJPgvJQxv8K97XmSS7PGIozVijNYm12CuX_FhxpItlKppA4StjQuCOKdW-q2eL0wLTFd9K4Z-7ma892ruLABPCdj5z_A-AEAYAHhIjcf6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEMivEtIICQiI4YAQEAEYHYAKA8gLAdgTA4gUAdAVAYAXAbIXHgocCAASFHB1Yi0xNTc1OTExNTg1NDMyNTQ4GPbdIA&sigh=mzmoOpsiYYk&vt=1&template_id=5001&uach_m=[]
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.18.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s28-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 29FE 42 B
64 B 85ms
85ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssvXt2FmNh94UWSPiIyuAUwzcNyAJF3SxwJPMiPTvEr_iD3txv67Hw38DnwfyI7RKl-t6CGlLDr3gLexBrd2Be6bvMD3rpYzdnmXoKCrAg6UGFRSjx7R_FmXEd1SRyp4w3YuWZ6TRNCbeSFQr6DrIfeCg&sai=AMfl-YTPxeLO7MwLRS_MukodLl3uGNYysteFaYhjzi08Yajc7R90cYaI8tdipxPHHsjGcW69neIDhudmhXn5nApo6PQPclvxr9M_qGfQw7AwTmCfyq3FBiT8PZwgv1TS3qCN&sig=Cg0ArKJSzM6PiIVksdsEEAE&id=ampim&o=320,520&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=1122&tls=2122&g=100&h=100&tt=2123&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=211988754

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Jun 2022 05:13:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=4e97093b82e416cc51edf59fa8938753

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=4e97093b82e416cc51edf59fa8938753

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=4e97093b82e416cc51edf59fa8938753

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=4e97093b82e416cc51edf59fa8938753

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity/envelope?pid=c2d18b01-4905-4aba-a83e-e41eac932694

Domain: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Domain: www.google.com
URL: https://www.google.com/recaptcha/api2/aframe

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/bg/KTHYOna8VhrtXL7WgNcsIkAo3r0EoLxY2-h6-FKeiG0.js

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022061401&jk=4381457497904123&rc=

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/bg/KTHYOna8VhrtXL7WgNcsIkAo3r0EoLxY2-h6-FKeiG0.js

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022061301&jk=1577477958326502&rc=

Verdicts & Comments Add Verdict or Comment

107 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
securityaffairs.co/	1970-01-20 12:37:45	Name: cookielawinfo-checkbox-necessary Value: yes
securityaffairs.co/	1970-01-20 12:37:45	Name: cookielawinfo-checkbox-non-necessary Value: yes
.securityaffairs.co/	1970-01-20 03:53:35	Name: _gid Value: GA1.2.688594561.1655529192
.securityaffairs.co/	1970-01-20 03:52:09	Name: _gat Value: 1
securityaffairs.co/	1970-01-20 03:52:10	Name: session_depth Value: securityaffairs.co%3D1%7C816788371%3D2%7C184323154%3D1%7C647633027%3D2
.securityaffairs.co/	1970-01-20 21:23:21	Name: _ga_P62M3QN974 Value: GS1.1.1655529192.1.0.1655529192.0
.securityaffairs.co/	1970-01-20 21:23:21	Name: _ga Value: GA1.1.901102643.1655529192
.agkn.com/	1970-01-20 12:37:45	Name: ab Value: 0001%3AKVSYOeRP%2Bg%2FsBHZYgIlVk4ODtJ%2FMpEdv
securityaffairs.co/	1970-01-20 04:35:21	Name: _pbjs_userid_consent_data Value: 3524755945110770
.securityaffairs.co/	1970-01-20 08:11:21	Name: _pubcid Value: af02cae6-fbef-4ac2-8599-8fa31d6324f5
securityaffairs.co/	1970-01-20 03:52:12	Name: _lr_retry_request Value: true
securityaffairs.co/	1970-01-20 04:35:21	Name: _lr_env_src_ats Value: false
securityaffairs.co/	1970-01-20 05:18:33	Name: pbjs-unifiedid Value: %7B%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222022-06-18T05%3A13%3A12%22%7D
.securityaffairs.co/	1970-01-20 13:13:45	Name: cto_bundle Value: qh6uF19HUTJFVjFlOWRkQyUyQm1BdEg5V1B6RXFSanZNdndObUxqSzZOREtOS2NNaVBENENpMXNjZmJFbVMxJTJCSlc4bDR0SFROU0FXQ2RvZ1ZUdkFYJTJGcW91U2MydiUyRjFhRHZRUXFVTDM2VWpDblZObXM4JTJGNG1ucloyTkNyYzhXalh2Z1VQb1M
.securityaffairs.co/	1970-01-20 13:13:45	Name: cto_bidid Value: 17f_3F9DbUZGcjlmSEdhSiUyRmhnZmc1RDB3TUh6TG5FaTJsWGtxSmlMZ1lTS1VXODRMMlZxc21HaDREWUVQdnFPdkMwZDZqVVE3MklvUk4ySEkxdEVtTjJ6Y0VnJTNEJTNE
.securityaffairs.co/	1970-01-20 13:13:45	Name: __gads Value: ID=598b3f65de57294e-2205f30fb7cd0069:T=1655529193:S=ALNI_MaVOVTKigiE_slDkvgl4u8Aq2G3XA
.doubleclick.net/	1970-01-20 13:13:45	Name: IDE Value: AHWqTUn1F8rbUhOb-ap0S7vOQexKffE0VV605EiQDP1KOhrIc0I0QaS_jAvNfXiSrUo
.doubleclick.net/	1970-01-20 03:52:12	Name: DSID Value: NO_DATA

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html(Line 391) Message: Mixed Content: The page at 'https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=4e97093b82e416cc51edf59fa8938753'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html(Line 392) Message: Mixed Content: The page at 'https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=4e97093b82e416cc51edf59fa8938753'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html(Line 393) Message: Mixed Content: The page at 'https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=4e97093b82e416cc51edf59fa8938753'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html(Line 394) Message: Mixed Content: The page at 'https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=4e97093b82e416cc51edf59fa8938753'. This request has been blocked; the content must be served over HTTPS.
javascript	error	URL: https://securityaffairs.co/wordpress/132377/apt/chinese-driftingcloud-apt-exploited-sophos-firewall-zero-day-before-it-was-fixed.html Message: Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity/envelope?pid=c2d18b01-4905-4aba-a83e-e41eac932694' from origin 'https://securityaffairs.co' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.rlcdn.com/api/identity/envelope?pid=c2d18b01-4905-4aba-a83e-e41eac932694 Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://cdn.ampproject.org/rtv/012205270638000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
network	error	URL: https://us-central1-amp-error-reporting.cloudfunctions.net/r Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

54d2eab01fa05d420be8997a4dd07591.safeframe.googlesyndication.com
5d745c8e30503f7f13227bc3050b7c11.safeframe.googlesyndication.com
76c9aae25913089a5cfd76b2151e2f77.safeframe.googlesyndication.com
aa.agkn.com
adservice.google.co.uk
adservice.google.com
api.rlcdn.com
buttons-config.sharethis.com
cdn.ampproject.org
cdn.pixfuture.com
contextual.media.net
fonts.googleapis.com
fonts.gstatic.com
google-analytics.com
googleads.g.doubleclick.net
gum.criteo.com
i0.wp.com
id5-sync.com
l.sharethis.com
lg3.media.net
match.adsrvr.org
maxcdn.bootstrapcdn.com
mug.criteo.com
pagead2.googlesyndication.com
pixel.wp.com
platform-api.sharethis.com
region1.google-analytics.com
secure.gravatar.com
securepubads.g.doubleclick.net
securityaffairs.co
served-by.pixfuture.com
stats.wp.com
tpc.googlesyndication.com
us-central1-amp-error-reporting.cloudfunctions.net
ws.sharethis.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
api.rlcdn.com
fonts.googleapis.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.google.com
141.95.98.71
143.204.89.14
172.217.18.2
178.250.2.146
192.0.76.3
192.0.77.2
2.18.235.93
2001:4860:4802:34::36
2001:4860:4802:36::36
2001:8d8:100f:f000::289
23.35.228.23
2600:9000:2156:1600:c:abe:f440:93a1
2600:9000:2156:8c00:3:c04e:c780:93a1
2606:4700:20::681a:744
2606:4700::6812:bcf
2a00:1450:4001:800::200a
2a00:1450:4001:803::2003
2a00:1450:4001:808::2001
2a00:1450:4001:810::2001
2a00:1450:4001:811::2002
2a00:1450:4001:813::2004
2a00:1450:4001:813::200e
2a00:1450:4001:827::2002
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2004
2a00:1450:4001:830::2002
2a00:1450:4001:830::2008
2a02:2638:1::13
2a04:fa87:fffe::c000:4902
52.223.40.198
52.57.5.215
54.76.93.140
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
02a59c96963f899010446e895abda59142439b5d01a3da630dddd3f2a59753f6
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
145d5ada31bfaa2e49cc4d1859b391f3ad42b18685a3fe6ed653d6f0654c9636
149bccf7e467541fc83e870e967ac322b26065e5d6797169c8a677a67db07e60
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1b582acaf161db1ef436343a487e95a35a5ee579d35893ad726dce7fa4b85b4c
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
2b121a122b3060ee47ba6d9dd76cfcc37abdbf17098582d2fa471348c512c5bf
2bae9fc3e57c860103d1e03360ba3246e3b6c5bcaa6f3183ce8066cc69843a5d
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347
37d925559381e9d5388c4a096fe1383570546b7b11548d7d6a7e560adcc24e5d
3c60b06f075c11b6d041e1b6f60fa6ab64409c3f363c82706e95ebbfd95dc42c
43ec4073d62958c460872f86b38f583f3187995f0147e29144340e6826e05cb9
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
4998c611029a47cc552ccda7e56f1f2278e96bbd03914ff79295e610b64f402a
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
4cdecc62f5b2c8e9f7cf7b14b9fd42e0c4787d912c1b71426cdfbe0144cede46
4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a
4f4a6b5c69143779dbb114e280b83ae91249926c95277e1d2952e65719903030
5090dab2726dc528566240086e26a34fab2917be706acbdc30d3bb4cbfba8fe1
51310f9f30077e7818e6b290aae0692724791cb33999d75f916d9d623635b42a
5248c8e706ec8be86fdad29e8929ca59b3789e9151377141695b905539cae130
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
58b38236ca737a7fcfc6ac3729e1d9304585c0243f0988050a4b1b6a575bcf58
5c4b5dd9a8ffa32ab0e107f83b4f5b391bf3697d7c6401c47d7468a87e3cd390
5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6251b4b4525b9007511a48a6cda9a168f07ff77ccc4dd75759486af624a13301
65445cc215e09e39cc11e1980cdc87c5affeb63beb1a5f450f5828a06a6d84a9
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a
6a1f7a05c4039dcc9dd76d73d334629f9945bbd573c1e508d666e3a72bbe8f5f
6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f
6d9f061cba81145d9bab0964192d66cb2e13a71591482cdfaf5b718341171da1
6f83d6d161d5d98ac0a6305e882cbf211c330178f30bac4095f967b5475c0e92
7349bcf3c205cdbf881852ec688351d7d4d5c274b3f1d5d4e428f7d82208c643
73cadf4725483d9a9290b8ea3ad87fe2afc746de5f70e89f088a3df9996bd8dd
7475124913c1e7faab65864ac77e103c43fb184503fdf982e877517219db7e31
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
76b8ea16e9eb368b2850280652c0944d54e2442f544347bbb87eb51eb8acce74
78e13001bbc9c6b06ffa301191bd9e762226ed69f84e53f956d16e54f4408c7c
79514487ea68d28f88dc96982e60092a7a701db9e2b6fad1b2eb317482cb7b78
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7c41b898c5da0cfa4aa049b65ef50248bce9a72d24bef4c723786431921b75aa
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
82f6df9bcc9a946b6588f8cf85e8c1b3dbd41db2da01ff71ba2cc20cb4987a82
87a58d458071d11248281baeeb0f3cb2752529cd395c925b7226e8e57bd0637e
89a3bd4327262614139ff4b3aa661457ad4992fad7884e4aecf9da183236647e
8bd198770be5374fbd70821b1ea71c9a40a926f444900632e336625f6c923d1f
8c3010509fc7480b59413a90d69e9fafcb3d5aa202faf7862466f6bb8be1a335
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
8f9bff533ca717c10b0a174e354bc152b3d12367b9e1a151d7c641a37a348ad9
9102b12e034f45a994efb33ec0ade589e74128ccb67ab6c244a461d1f6544a13
97c7c069ea9993a56ef75f90e8a2e8c414d41a02ae72241d2dfe1ccbc9c3e31d
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9b978821f78e7bd3a48e5ae8fd7121a291eec506579406745800ca0590f0907c
9c062d10663416484b5a59bb47a0308526bec56cc69e9f3499fa087d8eae5c7a
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a544a354863e132ed1c3eaa530ac00501e2646c3caf8cfa6b274b59348ee3362
a5f19374c985a4fe5809852344ba6856a06f15497a847d9958ec929ce2e54f59
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
aedd1b112e247314f7e990485858511f15d21e57885ee131e9e1a3fec0173d61
aeef17cb37c9f11b40b147b04e3f16ee3a2fdaa90bae2d503a7e3e99399ea682
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
b1ffaaeee716d6d06ba5ac5b46e85fbb6a3fbaedcd521c16c479b18121cd41ed
b33ef452b57bede722776b1432be568c083cd38efbcfe92491d71abfcd3fafa0
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b9498289037a897044db21bd31a4e5e878a0a95fcafebd1ce8242184419511c8
bed45cad3d55b2a8b76eb4907d83fdaef952e971f4379a4a453d854d3dd083eb
c0515f174257e5e8c2b69445e28f1cca8792be06d315b7772fc16234937d5cde
c09fa9679fb13cb821998f533f0f3b51a4a1756bbc05004aef91f8f217c54712
c12233e8d1bf606a324a8e286e847a219124fd5f7ebba263e57a215a88cac152
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
d201bb3b6a9b5c4572b54ff8cd188b8e77374e1694fead0bccd6606ffa147b2d
d364713a62eeb62f91220e5f92392c444800089ed7fbd99162a69b4216ce8437
d490f2efc64637640a21c5282a89dd22344e58974641bc7bbbfa4c7e4dc8648e
d51dc0a9a1d48343764e84a32ff7ca0ee59f7c436b6749983baa6ffc0be18677
d51fff60da7851c358bbd7e0497ef78043d512097356b99126840dea7b4fad8f
d6a573dba8f6d9d7183c45eee0b18e7e0857944b32e70384c71ff9f7aa21f971
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
dda6ad33ac53197002b0e3c6c09f3714a6c79b73969d15666500689d8fc50d3c
ddaa716af0aeb2764d2348a430cf2cd40c4467627d318ee9fc0f606d037f4fd0
dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26
e1a3c83144fa5752c8668ca056742ec9e6d6dfe5cfb75a97a9e53d1150068f91
e2598751639a254b3c54ab5d1cdd4e601c0203acbe56e4f33ad5ff4e4b447f20
e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da
e2f1d6c82d89c9a6c1faf7a2e83e00645a2fa1291756de19c937f275bb285090
e35bec407ed0d29bfcbb100e16db491396d1baef5bb5c314ca8b87604af062fd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6
e6a6be14f0222ca8d8055544104e8db8a8c44e8273097ddd2ae795314aea9532
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
ed25671db99aeb47d3c8a89baf7e318e4bfb503e8c5cbd137190eb1151420da7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f1f9eda417444f06ef060dd832d8821c84f081a98cdf62acfe981f5554c894dc
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4
fdb60418f2e23b359b2ade2aca337dccf02e24215d1a77bb816ba1820e5bbff0
feccb7346e200336e12b67bd6df849ec5da2cff1e708760fac69b5cbc7a8369d

securityaffairs.co Open in urlscan Pro 2001:8d8:100f:f000::289 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

172 Requests

92 %HTTPS

67 %IPv6

22 Domains

38 Subdomains

34 IPs

4 Countries

3264 kBTransfer

5479 kBSize

18 Cookies

24 Outgoing links

Redirected requests

172 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 16 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289 Public Scan

Screenshot
Live screenshot

Full Image

172
Requests

92 %
HTTPS

67 %
IPv6

22
Domains

38
Subdomains

34
IPs

4
Countries

3264 kB
Transfer

5479 kB
Size

18
Cookies

172 HTTP transactions
16 data transactions