threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://info.silobreaker.com/e2t/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r...
Effective URL:
https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOr...
Submission: On October 07 via api (October 7th 2020, 11:07:09 am UTC) from DE

Summary HTTP 259 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 68 IPs in 8 countries across 46 domains to perform 259 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:4700::68... 2606:4700::6811:7bb4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
11	52.84.112.113 52.84.112.113	16509 (AMAZON-02) (AMAZON-02)
7	2606:4700:e6:... 2606:4700:e6::ac40:c31a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:814::2002	15169 (GOOGLE) (GOOGLE)
8	2600:9000:215... 2600:9000:2156:b200:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
11	2600:9000:20e... 2600:9000:20eb:3e00:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
3 12	2a00:1450:400... 2a00:1450:4001:81d::2004	15169 (GOOGLE) (GOOGLE)
7	172.217.23.130 172.217.23.130	15169 (GOOGLE) (GOOGLE)
3	52.84.113.143 52.84.113.143	16509 (AMAZON-02) (AMAZON-02)
1 10	151.101.14.137 151.101.14.137	54113 (FASTLY) (FASTLY)
3	151.101.114.137 151.101.114.137	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:816::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:81f::200e	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:36a9:ecb:e518:b308	16509 (AMAZON-02) (AMAZON-02)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
12	3.128.209.198 3.128.209.198	16509 (AMAZON-02) (AMAZON-02)
4	34.237.157.170 34.237.157.170	14618 (AMAZON-AES) (AMAZON-AES)
1	165.227.252.242 165.227.252.242	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	35.156.107.113 35.156.107.113	16509 (AMAZON-02) (AMAZON-02)
1	104.111.215.135 104.111.215.135	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.241.71.237 34.241.71.237	16509 (AMAZON-02) (AMAZON-02)
2 6	185.33.221.11 185.33.221.11	29990 (ASN-APPNEX) (ASN-APPNEX)
4	69.173.144.143 69.173.144.143	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	72.251.249.13 72.251.249.13	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
8 13	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
6	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
3	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2600:9000:203... 2600:9000:203c:6000:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:400c:c06::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE)
1	64.140.160.2 64.140.160.2	18450 (WEBNX) (WEBNX)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
3	151.101.194.137 151.101.194.137	54113 (FASTLY) (FASTLY)
1 6	23.210.249.164 23.210.249.164	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.58.71.47 52.58.71.47	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:825::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:815::2001	15169 (GOOGLE) (GOOGLE)
28	2a00:1450:400... 2a00:1450:4001:81b::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2006	15169 (GOOGLE) (GOOGLE)
1 11	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
11	13.224.193.112 13.224.193.112	16509 (AMAZON-02) (AMAZON-02)
15	2a00:1450:400... 2a00:1450:4001:818::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81b::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4007:808::2003	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:400a:9::7	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:57::8	15169 (GOOGLE) (GOOGLE)
1 2	52.95.123.167 52.95.123.167	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	23.210.249.83 23.210.249.83	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	18.158.113.203 18.158.113.203	16509 (AMAZON-02) (AMAZON-02)
3	23.210.249.92 23.210.249.92	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.111.230.142 104.111.230.142	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	167.172.1.14 167.172.1.14	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3)
3 6	3.126.63.176 3.126.63.176	16509 (AMAZON-02) (AMAZON-02)
1 1	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
1	37.157.6.247 37.157.6.247	198622 (ADFORM) (ADFORM)
1 3	34.249.135.160 34.249.135.160	16509 (AMAZON-02) (AMAZON-02)
1	2a02:fa8:8806... 2a02:fa8:8806:12::1370	41041 (VCLK-EU-) (VCLK-EU-)
2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
2 2	151.101.114.49 151.101.114.49	54113 (FASTLY) (FASTLY)
259	68

2 2606:4700::6811:7bb4 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

info.silobreaker.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 52.84.112.113 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-112-113.sof50.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:e6::ac40:c31a (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2156:b200:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:20eb:3e00:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:81d::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.217.23.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s18-in-f130.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.84.113.143 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-113-143.sof50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.14.137 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vid.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.114.137 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:36a9:ecb:e518:b308 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 3.128.209.198 (Seattle, United States)

ASN16509 (AMAZON-02, US)

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.237.157.170 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 165.227.252.242 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.156.107.113 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.135 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-135.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.241.71.237 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.33.221.11 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.251.249.13 (Amsterdam, Netherlands) 1 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 8 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.244.159.8 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:203c:6000:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.140.160.2 (Los Angeles, United States)

ASN18450 (WEBNX, US)
PTR: threatintelligenceplatform.com

geo.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.194.137 (United States)

ASN54113 (FASTLY, US)

img.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.210.249.164 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-164.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.58.71.47 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-71-47.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ec20b48d4567d77ce3b9d37ea692291e.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a00:1450:4001:81b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 13.224.193.112 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-112.fra2.r.cloudfront.net

math-aids-threatpost-tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:818::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4007:808::2003 (Ireland)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400a:9::7 (Ireland) 1 redirects

ASN15169 (GOOGLE, US)

r2---sn-1gi7znes.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:57::8 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

r2---sn-4g5ednle.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.95.123.167 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

public.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.249.83 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-83.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.158.113.203 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.249.92 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-92.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.230.142 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.172.1.14 (United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.126.63.176 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-63-176.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.6.247 (Denmark)

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.249.135.160 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-135-160.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:12::1370 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.114.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
35	threatpost.com threatpost.com assets.threatpost.com media.threatpost.com	911 KB
34	googlesyndication.com ec20b48d4567d77ce3b9d37ea692291e.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	225 KB
28	connatix.com 1 redirects cd.connatix.com cds.connatix.com capi.connatix.com vid.connatix.com img.connatix.com	1 MB
22	adlightning.com tagan.adlightning.com math-aids-threatpost-tagan.adlightning.com	227 KB
20	advertising.com 11 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com	10 KB
15	ampproject.org cdn.ampproject.org	322 KB
14	google.com 3 redirects www.google.com adservice.google.com	3 KB
13	doubleclick.net 2 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	126 KB
9	adnxs.com 2 redirects ib.adnxs.com acdn.adnxs.com	5 KB
7	gstatic.com www.gstatic.com fonts.gstatic.com csi.gstatic.com	312 KB
7	admetricspro.com qd.admetricspro.com	289 KB
6	googleapis.com imasdk.googleapis.com fonts.googleapis.com	110 KB
6	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	233 B
6	openx.net teachingaids-d.openx.net eu-u.openx.net u.openx.net	1 KB
5	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	7 KB
5	amazon-adsystem.com 1 redirects c.amazon-adsystem.com aax-eu.amazon-adsystem.com	32 KB
4	casalemedia.com 1 redirects htlb.casalemedia.com as-sec.casalemedia.com ssum.casalemedia.com	4 KB
4	a-mo.net prebid.a-mo.net	1 KB
3	yahoo.com ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	3 KB
3	adsrvr.org 1 redirects match.adsrvr.org	1 KB
3	indexww.com js-sec.indexww.com
3	3lift.com 1 redirects tlx.3lift.com eb2.3lift.com	621 B
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com	9 KB
3	google-analytics.com www.google-analytics.com	19 KB
3	googletagservices.com www.googletagservices.com	73 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	467 B
2	googlevideo.com 1 redirects r2---sn-1gi7znes.googlevideo.com r2---sn-4g5ednle.googlevideo.com	3 MB
2	google.de www.google.de adservice.google.de	274 B
2	lijit.com 1 redirects ap.lijit.com	1 KB
2	servenobid.com ads.servenobid.com public.servenobid.com	493 B
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	267 B
2	silobreaker.com 1 redirects info.silobreaker.com	3 KB
1	dotomi.com aol-match.dotomi.com	104 B
1	adform.net c1.adform.net	188 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	2mdn.net s0.2mdn.net	11 KB
1	reddit.com www.reddit.com	1 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	582 B
1	twitter.com analytics.twitter.com	651 B
1	ipify.org geo.ipify.org	1 KB
1	t.co t.co	448 B
1	quantcount.com rules.quantcount.com	354 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	googletagmanager.com www.googletagmanager.com	47 KB
1	kasperskycontenthub.com kasperskycontenthub.com	399 B
259	46

	Domain	Requested by
28	tpc.googlesyndication.com	tagan.adlightning.com threatpost.com cdn.ampproject.org
16	threatpost.com	info.silobreaker.com threatpost.com
15	cdn.ampproject.org	threatpost.com
13	adserver-us.adtech.advertising.com	8 redirects threatpost.com
12	capi.connatix.com	cd.connatix.com
12	www.google.com	3 redirects threatpost.com tagan.adlightning.com
11	math-aids-threatpost-tagan.adlightning.com	tagan.adlightning.com
11	media.threatpost.com	threatpost.com
11	tagan.adlightning.com	threatpost.com tagan.adlightning.com
9	vid.connatix.com	cd.connatix.com
8	assets.threatpost.com	threatpost.com assets.threatpost.com
7	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
7	qd.admetricspro.com	threatpost.com qd.admetricspro.com
6	pixel.advertising.com	3 redirects
6	ib.adnxs.com	2 redirects qd.admetricspro.com cds.connatix.com
5	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
4	fonts.gstatic.com	fonts.googleapis.com
4	fonts.googleapis.com	threatpost.com
4	fastlane.rubiconproject.com	qd.admetricspro.com
4	prebid.a-mo.net	qd.admetricspro.com
3	match.adsrvr.org	1 redirects
3	ads.pubmatic.com	qd.admetricspro.com cds.connatix.com
3	acdn.adnxs.com	qd.admetricspro.com cds.connatix.com
3	js-sec.indexww.com	qd.admetricspro.com cds.connatix.com
3	googleads.g.doubleclick.net
3	img.connatix.com	threatpost.com www.googletagservices.com
3	hbopenbid.pubmatic.com	qd.admetricspro.com cds.connatix.com
3	teachingaids-d.openx.net	qd.admetricspro.com cds.connatix.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com threatpost.com
3	cds.connatix.com	threatpost.com tagan.adlightning.com cd.connatix.com
3	c.amazon-adsystem.com	qd.admetricspro.com c.amazon-adsystem.com
3	www.googletagservices.com	threatpost.com tagan.adlightning.com securepubads.g.doubleclick.net
2	sync-tm.everesttech.net	2 redirects
2	ups.analytics.yahoo.com
2	u.openx.net	cds.connatix.com
2	cm.g.doubleclick.net	2 redirects
2	eb2.3lift.com	1 redirects qd.admetricspro.com
2	aax-eu.amazon-adsystem.com	1 redirects tagan.adlightning.com
2	imasdk.googleapis.com	cd.connatix.com imasdk.googleapis.com
2	adservice.google.com	tagan.adlightning.com imasdk.googleapis.com
2	as-sec.casalemedia.com	cds.connatix.com
2	pixel.quantserve.com	1 redirects threatpost.com
2	ap.lijit.com	1 redirects qd.admetricspro.com
2	www.gstatic.com	www.google.com
2	info.silobreaker.com	1 redirects
1	pr-bh.ybp.yahoo.com
1	aol-match.dotomi.com
1	c1.adform.net
1	ssum.casalemedia.com	1 redirects
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	eus.rubiconproject.com	qd.admetricspro.com
1	eu-u.openx.net	qd.admetricspro.com
1	public.servenobid.com	qd.admetricspro.com
1	r2---sn-4g5ednle.googlevideo.com
1	r2---sn-1gi7znes.googlevideo.com	1 redirects
1	csi.gstatic.com	imasdk.googleapis.com
1	s0.2mdn.net	imasdk.googleapis.com
1	ec20b48d4567d77ce3b9d37ea692291e.safeframe.googlesyndication.com	tagan.adlightning.com
1	adservice.google.de	tagan.adlightning.com
1	ads.adaptv.advertising.com	cds.connatix.com
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	analytics.twitter.com	tagan.adlightning.com
1	geo.ipify.org	qd.admetricspro.com
1	www.google.de	threatpost.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	t.co	threatpost.com
1	rules.quantcount.com	secure.quantserve.com
1	ads.servenobid.com	qd.admetricspro.com
1	htlb.casalemedia.com	qd.admetricspro.com
1	tlx.3lift.com	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	www.googletagmanager.com	threatpost.com
1	kasperskycontenthub.com	threatpost.com
1	cd.connatix.com	1 redirects
259	79

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feedly.com
www.instagram.com
www.nytimes.com
www.fbi.gov
akismet.com
t.co
indd.adobe.com
spotlight.threatpost.com

Subject Issuer	Validity	Valid
info.silobreaker.com Cloudflare Inc ECC CA-3	`2020-06-30` - `2021-06-30`	a year	crt.sh
threatpost.com DigiCert SHA2 Secure Server CA	`2020-06-10` - `2021-06-15`	a year	crt.sh
*.adlightning.com Amazon	`2020-07-22` - `2021-08-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-10` - `2021-08-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
*.connatix.com Go Daddy Secure Certificate Authority - G2	`2020-09-29` - `2021-10-19`	a year	crt.sh
kasperskycontenthub.com DigiCert SHA2 Secure Server CA	`2020-06-01` - `2021-06-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.a-mo.net Amazon	`2020-08-24` - `2021-09-24`	a year	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-09-18` - `2020-12-17`	3 months	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.servenobid.com Amazon	`2020-03-12` - `2021-04-12`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.ipify.org COMODO RSA Domain Validation Secure Server CA	`2018-01-24` - `2021-01-23`	3 years	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-10-02` - `2021-04-02`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-02-22`	6 months	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-07-29` - `2021-01-25`	6 months	crt.sh
*.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.c.docs.google.com GTS CA 1O1	`2020-09-29` - `2020-12-08`	2 months	crt.sh
aax-eu.amazon-adsystem.com Amazon	`2020-06-15` - `2021-06-15`	a year	crt.sh
public.servenobid.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-08-25`	a year	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2020-01-02` - `2021-04-02`	a year	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2020-10-04` - `2021-03-31`	6 months	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-27` - `2020-11-23`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-06-02` - `2020-11-29`	6 months	crt.sh

This page contains 29 frames:

Primary Page: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Frame ID: 4B05575F0E97FB2507795388B6BF1D86
Requests: 116 HTTP requests in this frame

Frame: https://cds.connatix.com/p/64536/connatix.player.dc.js
Frame ID: 3ABB93DA025832AC6730C4E28B662432
Requests: 37 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=standard&size=normal&cb=b7yejbha2xe
Frame ID: C0A38A5F305FBE85FBCCCCE05DC8EA6E
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=light&size=normal&cb=640vf2ao52cj
Frame ID: AAAEE243FFCAEF2CBDBD5BD9AD960477
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=4af0t3db3jus
Frame ID: 9565BCBF77CC6A031EF9E10A6049F1F0
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=vpzzwtwhyb3q
Frame ID: B511EC5D9C609BBF9040D9E15C5FF595
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.415.1_en.html
Frame ID: 83984E7461ADA526386BB882F2B90CCB
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c6d10f56.js
Frame ID: 9CD0B4C3F5C3A7598FAB86CCFA7C58D6
Requests: 35 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c6d10f56.js
Frame ID: 9DB4EA58D2E095C6932B6C9F638D7281
Requests: 18 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c6d10f56.js
Frame ID: 7C431BC662E8A92B3CA90479198365FA
Requests: 22 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c6d10f56.js
Frame ID: 2C09F92B2B3142E43C33BE65265B0181
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/217/runner.html
Frame ID: 0BE943B71588AB1997626B2FDCFA8975
Requests: 1 HTTP requests in this frame

Frame: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t
Frame ID: 771B50BF29D40689433027D3BFE984F3
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 9080315C08E9563A138D37EEC438639F
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 0191E642D19BD9AF2A1A6FD80A6EEC95
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 4B473E884D18C1E3EC01F7BE62D7D131
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 5712DAB28256AC07ED41CF284E1A7C9F
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: 8D196D28E44B24B78267AC45080A24EA
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 487EA3FC7C768388072D6D21D06A5546
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 627437818FB05E37ECCF247856D4F854
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 1F665046E170F2EC0E32141FC0C53601
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: D7AADA3BB154341C90F3DC4A5002BC92
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: F1E123CD02A256A0C2544846C35E0B80
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: DD69E289CB68D84E9BCCEF2890B38628
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: FC8B17CFC18C60662838B0E3BC8EE165
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 807D4BCB0EF08F1E75C441F3BCB0535D
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 6C85BA2E6516D7ECAB579F06B8B0F2DB
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: 8105C550B5A7176B5DFFFBF0ECE45777
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: F41C41C46F474ADE47BF811238F3B1D6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://info.silobreaker.com/e2t/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3... Page URL
https://info.silobreaker.com/events/public/v1/track/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV... HTTP 307
https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_r... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

259
Requests

100 %
HTTPS

45 %
IPv6

46
Domains

79
Subdomains

68
IPs

8
Countries

7364 kB
Transfer

12327 kB
Size

5
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatpost/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/threatpost

Search URL Search Domain Scan URL

URL: https://feedly.com/threatpost

Search URL Search Domain Scan URL

URL: https://www.instagram.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2020/10/03/technology/clinical-trials-ransomware-attack-drugmakers.html?auth=login-google1tap&login=google1tap
Title: broke the story

Search URL Search Domain Scan URL

URL: https://www.fbi.gov/news/pressrel/press-releases/fbi-and-cisa-warn-against-chinese-targeting-of-covid-19-research-organizations
Title: warned that

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23cyberattack
Title: #cyberattack

Search URL Search Domain Scan URL

URL: https://t.co/nsYgUqL8L3
Title: https://t.co/nsYgUqL8L3

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost
Title: Follow @threatpost

Search URL Search Domain Scan URL

URL: https://indd.adobe.com/view/01579c19-a6ca-4cb0-8106-ed4d5d02a292
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://spotlight.threatpost.com/
Title: HackerOne Spotlight

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://info.silobreaker.com/e2t/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r2WVP8b5vTmW51J0z160sXRcW62SxV81WWNVVW94q2Rc4b4fk6VbzmpD11jwQlW14S8y81Xh-nwW4tRqpn1hjJ4zW43p49h98jxrJW50qpfR2NWCwFW7JbQYk3X6vqjW15NGzH5vYXgVW8nRkhQ171nspW5SWnxh7NJy6rW3XhYzd89VH-nW5C3LhV84YrQZW47kzxz4rbF-tW11NK583xsJ1-N9fdFQCmctQMVZK6vt7k8N_bN6D27MbXGyrg34w31 Page URL
https://info.silobreaker.com/events/public/v1/track/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r2WVP8b5vTmW51J0z160sXRcW62SxV81WWNVVW94q2Rc4b4fk6VbzmpD11jwQlW14S8y81Xh-nwW4tRqpn1hjJ4zW43p49h98jxrJW50qpfR2NWCwFW7JbQYk3X6vqjW15NGzH5vYXgVW8nRkhQ171nspW5SWnxh7NJy6rW3XhYzd89VH-nW5C3LhV84YrQZW47kzxz4rbF-tW11NK583xsJ1-N9fdFQCmctQMVZK6vt7k8N_bN6D27MbXGyrg34w31?_ud=c43fb938-c9a9-4d35-bece-23858d10b861&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p HTTP 307
https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 36

https://cd.connatix.com/connatix.player.js HTTP 302
https://cds.connatix.com/p/64536/connatix.player.dc.js

Request Chain 69

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5890dcc3457aec;misc=1602068810193; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1602068810;v=2;cmd=bid;cors=yes;alias=5890dcc3457aec;misc=1602068810193 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A32fccc04-088d-11eb-bd49-121160e138ec;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=5890dcc3457aec;misc=1602068810193

Request Chain 70

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5950ebc2ce3dd4e;misc=1602068810193; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=5950ebc2ce3dd4e;misc=1602068810193 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A32f9df44-088d-11eb-b123-126f1f1ee25e;cfp=1;rndc=1602068810;v=2;cmd=bid;cors=yes;alias=5950ebc2ce3dd4e;misc=1602068810193

Request Chain 71

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=609e870ceb962e5;misc=1602068810194; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=609e870ceb962e5;misc=1602068810194

Request Chain 72

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61bd4e38e64523a;misc=1602068810194; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=61bd4e38e64523a;misc=1602068810194 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A32fd6402-088d-11eb-88db-1212911483a0;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=61bd4e38e64523a;misc=1602068810194

Request Chain 73

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62f077d5a77de0c;misc=1602068810194; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=62f077d5a77de0c;misc=1602068810194

Request Chain 205

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 208

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 209

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 214

https://r2---sn-1gi7znes.googlevideo.com/videoplayback?expire=1602097612&ei=TKF9X6P7Ac2H8gPvqayADA&ip=185.156.175.107&id=6ae7a7fcab967ba5&itag=22&source=youtube&requiressl=yes&mh=br&mm=31&mn=sn-1gi7znes&ms=au&mv=m&mvi=2&pl=24&susc=gvp&acao=yes&ctier=L&mime=video/mp4&dur=29.605&lmt=1591682903286921&mt=1602068688&txp=5535432&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,dur,lmt&sig=AOq0QJ8wRgIhAKCdXE0xoQcvQ7oAUvWdvCLkgdwVSZoo-h3OGXSxHO7JAiEArdqUoybpvgFlxC0npz98VlpJgizbrUKmZeMomoVMxmA=&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRQIgbPOKM1cfC-K4XYYH71gSuOQCJpPMY-r_R3t_Y70fwdUCIQDpcAIa01EJJPGN1h7Mipw7_scnOKK1uYibFc_pxaJWAw==&cpn=t71nK0SuO8VD9b75 HTTP 302
https://r2---sn-4g5ednle.googlevideo.com/videoplayback?expire=1602097612&ei=TKF9X6P7Ac2H8gPvqayADA&ip=185.156.175.107&id=6ae7a7fcab967ba5&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&ctier=L&mime=video/mp4&dur=29.605&lmt=1591682903286921&txp=5535432&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,dur,lmt&sig=AOq0QJ8wRgIhAKCdXE0xoQcvQ7oAUvWdvCLkgdwVSZoo-h3OGXSxHO7JAiEArdqUoybpvgFlxC0npz98VlpJgizbrUKmZeMomoVMxmA=&cpn=t71nK0SuO8VD9b75&redirect_counter=1&rm=sn-1giez7l&req_id=494ff35414d036e2&cms_redirect=yes&ipbypass=yes&mh=br&mip=2a01:4f8:192:5414::2&mm=31&mn=sn-4g5ednle&ms=au&mt=1602068688&mv=m&mvi=2&pl=40&lsparams=ipbypass,mh,mip,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRgIhAPl8AQk8KneTkZ7buseStqSDP0zUY19bIKx93d6Cwx8LAiEAqSAEG4DaQrlbmCMHHtNsWOOW-VycKoKH62Cisut6TIo%3D

Request Chain 222

https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5 HTTP 302
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t

Request Chain 230

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 234

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 235

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=pInJtvDeyrC83M_j9YzTtKHezba82puz9dZQaCUz

Request Chain 236

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUEzMmY5ZGY0NC0wODhkLTExZWItYjEyMy0xMjZmMWYxZWUyNWU%3D&gdpr=1&gdpr_consent=&_origin=0 HTTP 302
https://pixel.advertising.com/ups/55946/sync?uid=CAESEKciDMAC8g5mUgG7ycLe0L4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

Request Chain 238

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D980603e9-e7f5-4dde-ad0c-a89329a7515e%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=index_rtb&uid=X32hSlVbL24AACJ7oacAAADE%26663

Request Chain 239

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D980603e9-e7f5-4dde-ad0c-a89329a7515e%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D980603e9-e7f5-4dde-ad0c-a89329a7515e%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID HTTP 302
https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=appnexus&uid=5866401317439406104

Request Chain 241

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D980603e9-e7f5-4dde-ad0c-a89329a7515e%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=sovrn&uid=f142e46104197fea70a436b6

Request Chain 254

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEOIz00SmxJ1hfFf1WBEgfyc&google_cver=1 HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEOIz00SmxJ1hfFf1WBEgfyc&google_cver=1&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEOIz00SmxJ1hfFf1WBEgfyc&google_cver=1&apid=UP35819ea5-088d-11eb-8739-02bdf99ce582

Request Chain 256

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=X32hTgAAAEn_Uik1 HTTP 302
https://pixel.advertising.com/ups/55986/sync?uid=X32hTgAAAEn_Uik1&_origin=0&gdpr=0&gdpr_consent=&_test=X32hTgAAAEn_Uik1 HTTP 302
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X32hTgAAAEn_Uik1&_origin=0&gdpr=0&gdpr_consent=&_test=X32hTgAAAEn_Uik1&apid=UP35819ea5-088d-11eb-8739-02bdf99ce582

Request Chain 257

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1

259 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r2WVP8b5vTmW51J0z160sXRcW62SxV81WWNVVW94q2Rc4b4fk6VbzmpD11jwQlW14S8y81Xh-nwW4tRqpn1hjJ4zW43p49h98jxrJW50qpfR2... Show response
info.silobreaker.com/e2t/tc/ 8 KB
3 KB 77ms
60ms Document
text/html 2606:4700::6811:7bb4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.silobreaker.com/e2t/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r2WVP8b5vTmW51J0z160sXRcW62SxV81WWNVVW94q2Rc4b4fk6VbzmpD11jwQlW14S8y81Xh-nwW4tRqpn1hjJ4zW43p49h98jxrJW50qpfR2NWCwFW7JbQYk3X6vqjW15NGzH5vYXgVW8nRkhQ171nspW5SWnxh7NJy6rW3XhYzd89VH-nW5C3LhV84YrQZW47kzxz4rbF-tW11NK583xsJ1-N9fdFQCmctQMVZK6vt7k8N_bN6D27MbXGyrg34w31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:7bb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34163ada8ec5c994e662bd733588938b4bcf7d709e8f27fce5d817c42526a439

Request headers

:method: GET
:authority: info.silobreaker.com
:scheme: https
:path: /e2t/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r2WVP8b5vTmW51J0z160sXRcW62SxV81WWNVVW94q2Rc4b4fk6VbzmpD11jwQlW14S8y81Xh-nwW4tRqpn1hjJ4zW43p49h98jxrJW50qpfR2NWCwFW7JbQYk3X6vqjW15NGzH5vYXgVW8nRkhQ171nspW5SWnxh7NJy6rW3XhYzd89VH-nW5C3LhV84YrQZW47kzxz4rbF-tW11NK583xsJ1-N9fdFQCmctQMVZK6vt7k8N_bN6D27MbXGyrg34w31
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Wed, 07 Oct 2020 11:06:47 GMT
content-type: text/html;charset=utf-8
set-cookie: __cfduid=df0ccefe8e91c3d50622054d1ae62b0701602068807; expires=Fri, 06-Nov-20 11:06:47 GMT; path=/; domain=.info.silobreaker.com; HttpOnly; SameSite=Lax __cfruid=5df6c5f68889bba30921b08539d2b1259665d7bb-1602068807; path=/; domain=.info.silobreaker.com; HttpOnly; Secure; SameSite=None
cf-ray: 5de727a0db8005b3-FRA
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
cf-request-id: 05a457188b000005b34a1cf200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
server: cloudflare
content-encoding: br

GET
H/1.1

200
OK

Primary Request / Show response
threatpost.com/covid-19-clinical-trials-ransomware/159877/
Redirect Chain

https://info.silobreaker.com/events/public/v1/track/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r2WVP8b5vTmW51J0z160sXRcW62SxV81WWNVVW94q2Rc4b4fk6Vbzm...
https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoB...

78 KB
20 KB

940ms
565ms

Document
text/html

35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Requested by

Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r2WVP8b5vTmW51J0z160sXRcW62SxV81WWNVVW94q2Rc4b4fk6VbzmpD11jwQlW14S8y81Xh-nwW4tRqpn1hjJ4zW43p49h98jxrJW50qpfR2NWCwFW7JbQYk3X6vqjW15NGzH5vYXgVW8nRkhQ171nspW5SWnxh7NJy6rW3XhYzd89VH-nW5C3LhV84YrQZW47kzxz4rbF-tW11NK583xsJ1-N9fdFQCmctQMVZK6vt7k8N_bN6D27MbXGyrg34w31

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

0065bb71138a0636731ddfa21587233b21d0706ce5dcba223e00a9c1ad98f19a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://info.silobreaker.com/e2t/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r2WVP8b5vTmW51J0z160sXRcW62SxV81WWNVVW94q2Rc4b4fk6VbzmpD11jwQlW14S8y81Xh-nwW4tRqpn1hjJ4zW43p49h98jxrJW50qpfR2NWCwFW7JbQYk3X6vqjW15NGzH5vYXgVW8nRkhQ171nspW5SWnxh7NJy6rW3XhYzd89VH-nW5C3LhV84YrQZW47kzxz4rbF-tW11NK583xsJ1-N9fdFQCmctQMVZK6vt7k8N_bN6D27MbXGyrg34w31

Response headers

Server: nginx
Date: Wed, 07 Oct 2020 11:06:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/?p=159877>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: MISS
Content-Encoding: gzip

Redirect headers

status: 307
date: Wed, 07 Oct 2020 11:06:48 GMT
location: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
cf-ray: 5de727a14cab05b3-FRA
link: <https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04>; rel="canonical"
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
cf-request-id: 05a45718cc000005b34a1dd200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
x-robots-tag: none
server: cloudflare

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 253 KB
39 KB 456ms
220ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:49 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:32 GMT
Server: nginx
ETag: W/"5f7b2034-3f2b8"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 14 Oct 2020 11:06:49 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 37 KB
14 KB 131ms
45ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d8aa22200ab4c8fa70aa53ff832f12b9064acafc1db78c8f3d2ba5cce688e620

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: e1kxLytk.H9HyzM3ea2f48A6PumWmbvH
content-encoding: gzip
etag: "efeb65529844c0a8235adbc435bb0039"
age: 1118
x-cache: Hit from cloudfront
status: 200
content-length: 13456
x-amz-meta-git_commit: 9a4f7ce
last-modified: Wed, 07 Oct 2020 00:40:26 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 10:48:12 GMT
content-type: application/javascript
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
x-amz-cf-id: E65du37UzvtozEM7wsWbUO_Tq4vgbQzAOdlmNUqhTLqVjahy543BTA==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 22 KB
3 KB 49ms
21ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 247
status: 200
cf-request-id: 05a4571d490000dfcb88aea200000001
last-modified: Thu, 06 Aug 2020 02:14:13 GMT
server: cloudflare
etag: W/"579e-5ac2c0b6aa2e7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602068809"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de727a87a45dfcb-FRA
expires: Wed, 07 Oct 2020 11:07:30 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 51 KB
17 KB 48ms
45ms Script
text/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e12e8c837766da5daa890c579163a37d2bc1c8b4e956d5ded9ea37d3c3f2c90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "655 / 646 of 1000 / last-modified: 1602063781"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 17470
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:06:49 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 305 KB
82 KB 64ms
37ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d89d98593ac65c9f002b856f3e22a1479f3aea866f7fd15c85903c0a6d66f0e3

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 247
status: 200
cf-request-id: 05a4571d4a0000dfcb88aeb200000001
last-modified: Tue, 25 Aug 2020 22:57:08 GMT
server: cloudflare
etag: W/"4c455-5adbb9f62c25a-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602068809"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de727a87a48dfcb-FRA
expires: Wed, 07 Oct 2020 11:07:36 GMT

GET
H2 200 uspcmp.js Show response
qd.admetricspro.com/js/threatpost/ 148 KB
55 KB 58ms
30ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 247
status: 200
cf-request-id: 05a4571d4a0000dfcb88aec200000001
last-modified: Sat, 08 Aug 2020 22:40:07 GMT
server: cloudflare
etag: W/"24e50-5ac65673cef1c-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602068809"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de727a87a4adfcb-FRA
expires: Wed, 07 Oct 2020 11:07:36 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
716 B 46ms
18ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 246
status: 200
cf-request-id: 05a4571d4a0000dfcb88aed200000001
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602068809"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de727a87a4cdfcb-FRA
expires: Wed, 07 Oct 2020 11:10:43 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 399 KB
113 KB 71ms
44ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 246
status: 200
cf-request-id: 05a4571d4a0000dfcb88aee200000001
last-modified: Fri, 02 Oct 2020 04:32:28 GMT
server: cloudflare
etag: W/"63c0e-5b0a89ec6a525-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602068809"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de727a87a4fdfcb-FRA
expires: Wed, 07 Oct 2020 11:10:43 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 25 KB
7 KB 49ms
23ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa90c2d77583dd25e7fbdc1411c8d718f29d9665ab48f985ffe6f3a38b34b6a7

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 246
status: 200
cf-request-id: 05a4571d4a0000dfcb88aef200000001
last-modified: Wed, 26 Aug 2020 03:04:19 GMT
server: cloudflare
etag: W/"637a-5adbf1363c190-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602068809"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de727a87a52dfcb-FRA
expires: Wed, 07 Oct 2020 11:10:43 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 89 KB
18 KB 395ms
359ms Stylesheet
text/css 2600:9000:2156:b200:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:b200:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

15e9840f31982980328598c38e5c60434072901f2c902713ef9c4d4900e05307

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 18049
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:31 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: i7EuvRmr-YxiQpgT4nxGOW19ZeYatrSPIe0N7ZkeAEiF9r4M_lcjUQ==
expires: Wed, 07 Oct 2020 15:54:13 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 482ms
234ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Jun 2020 22:05:38 GMT
Server: nginx
ETag: W/"5ee15932-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 14 Oct 2020 11:06:49 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 177 KB
55 KB 397ms
361ms Script
application/x-javascript 2600:9000:2156:b200:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:b200:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 56256
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:32 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: clHmjSPtoXitGnQcxEJR_-FtgwaG2luhL_GqXNLtrLZUyBbLWkQKsQ==
expires: Wed, 07 Oct 2020 15:53:50 GMT

GET
H2 200 vulnerable-medical-featured.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/30091211/ 345 KB
346 KB 40ms
8ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/30091211/vulnerable-medical-featured.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7d0a56533a6883357182ea8c20b0649f2e1bf359c732246d1780f375c5fa4daf

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 04 Oct 2020 11:00:32 GMT
via: 1.1 9e627a2e7bf673974b02e3bf374bb843.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Thu, 30 Aug 2018 13:12:13 GMT
server: AmazonS3
age: 259577
etag: "4af4ac401efbf8f4f5159af37b9e5eed"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 352953
x-amz-cf-id: UYf5LY_QU1GF2Of-Nl8vmV_Xu4TQypIPHCqtCl9m0GNN7ZH0ACpmjg==
expires: Fri, 30 Aug 2019 13:12:11 GMT

GET
H2 200 Tara-headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/ 13 KB
13 KB 51ms
20ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/Tara-headshot.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 00:04:39 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Fri, 17 Aug 2018 16:22:08 GMT
server: AmazonS3
age: 558131
etag: "dee18dfeea6de13bec60c1e5237eb723"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 13097
x-amz-cf-id: xitPRegRH10D031sf6kzVwDIy3jTznuRkCW16TI3dspSmV1juIFRnA==
expires: Sat, 17 Aug 2019 16:22:07 GMT

GET
H2 200 subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 8 KB
9 KB 39ms
8ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 08:11:35 GMT
via: 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Tue, 19 Feb 2019 20:14:58 GMT
server: AmazonS3
age: 1306515
etag: "5ba45563f793f39ef6baf02645651654"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 8281
x-amz-cf-id: m60sQHoE90eDe1rsnZK37b3iel7nMjLy9YlST1ZXesOzBdBaBE8l0Q==
expires: Wed, 19 Feb 2020 20:14:57 GMT

GET
H2 200 Cyberattack-Generic-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/02/21083450/ 48 KB
49 KB 47ms
17ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/02/21083450/Cyberattack-Generic-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7379335cd9f3d277bedb32028c3126359baa1ce7b6d43c8e19698e8d4b3782b7

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:00:29 GMT
via: 1.1 821feb380ab4aeca6ae9157aa1190ff2.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Fri, 21 Feb 2020 13:34:53 GMT
server: AmazonS3
age: 72381
etag: "cb6310785f3501422a7d63aa8ebc87b9"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 49333
x-amz-cf-id: 5DIsGxVLsFeIasN2D79CHAMU2kZtNKeKxPmUAX80aY5TlmHy-35GzA==
expires: Sat, 20 Feb 2021 13:34:50 GMT

GET
H2 200 HackBit-Ransomware-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/06/23094011/ 34 KB
34 KB 41ms
11ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/06/23094011/HackBit-Ransomware-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3bf5e5a5381944084f99c7a3bb3e2dd4771902f6aa5cbc412f412c4711fc80f7

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 22:53:23 GMT
via: 1.1 e0064d0a2437e206ed082e1fa1cdae61.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jun 2020 13:40:15 GMT
server: AmazonS3
age: 1599206
etag: "de9a1e5b48e3adc46acf9a748a1453e0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA2-C1
accept-ranges: bytes
content-length: 34786
x-amz-cf-id: Oi6zVk7xA7YPujxrX8OUdemWNqwz2EftxCeEmcz6v2QCdAS91m51Ug==
expires: Wed, 23 Jun 2021 13:40:14 GMT

GET
H2 200 voter-registration-phishing-attacl-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/02155653/ 35 KB
35 KB 61ms
31ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/02155653/voter-registration-phishing-attacl-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 499c5a9228a8f4eb18a0d0f6d1ff3f02245776d3d26e90070ef3e5199af085d1

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 20:39:41 GMT
via: 1.1 2395e6175733260a159a0b484ed8febd.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Fri, 02 Oct 2020 19:56:56 GMT
server: AmazonS3
age: 397628
etag: "1b3c1e15d00603ac6461cebdda75a42b"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 35850
x-amz-cf-id: R1VXOdz3E-au4jDME_WgI1LNsszI7pj20Tk-IKEkkgIPP3wx5iNc3g==
expires: Sat, 02 Oct 2021 19:56:55 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
645 B 18ms
18ms Script
text/javascript 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f45068d9955109994e74e581521de618f9f6aea2414383c1aa8096eabc780ee4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 557
x-xss-protection: 1; mode=block
expires: Wed, 07 Oct 2020 11:06:49 GMT

GET
H2 200 QR-Code-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/ 8 KB
9 KB 25ms
23ms Image
image/png 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/QR-Code-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Sep 2020 19:19:50 GMT
via: 1.1 06d36e78e8dfd9468327f09115761a9e.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Tue, 15 Sep 2020 17:58:41 GMT
server: AmazonS3
age: 1871220
etag: "f2a1360e4c2d784aff00a9f87f6bb703"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 8421
x-amz-cf-id: 8-kjFT_o-1eblUSPWZIzm3eTf7ur2fPwxjP3c4Bl_8VVT1y6rm_F4w==
expires: Wed, 15 Sep 2021 17:58:37 GMT

GET
H2 200 botnet-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/ 2 KB
2 KB 24ms
23ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/botnet-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 17:17:17 GMT
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Thu, 14 Nov 2019 14:06:22 GMT
server: AmazonS3
age: 668973
etag: "985f90dddb9367ad3b074a54645a8bc3"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 1866
x-amz-cf-id: 8BkEcx5hGD8QfTznmaRVOXHbsXzwrNx_LOKmwklElpx6jTR71zDqcA==
expires: Fri, 13 Nov 2020 14:06:19 GMT

GET
H2 200 work-from-home-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/18135511/ 2 KB
2 KB 23ms
22ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/18135511/work-from-home-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 17:57:04 GMT
via: 1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Fri, 18 Sep 2020 17:55:32 GMT
server: AmazonS3
age: 1616986
etag: "fd4942a0704785b24b44d177f4a57d86"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 2098
x-amz-cf-id: D5SWt-sMDsNpCcidlI3B9fQVX9nPba7PK7lKC4kI3ag9ZXCrJgQtmw==
expires: Sat, 18 Sep 2021 17:55:28 GMT

GET
H2 200 zero-trust-b_w-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/ 3 KB
3 KB 24ms
22ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/zero-trust-b_w-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 10:30:08 GMT
via: 1.1 c5c25772c7f14e267596e0f8ce51d9bc.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Mon, 07 Sep 2020 14:07:21 GMT
server: AmazonS3
age: 1643802
etag: "5fb2f76c4c77c7e774eb0dc933ab39f0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA2-C1
accept-ranges: bytes
content-length: 2602
x-amz-cf-id: M0dt0BS3yrjCZKRUxpEj_lYgT7v__I2GN8QSh2un5g1qeM54ttDRTw==
expires: Tue, 07 Sep 2021 14:07:19 GMT

GET
H2 200 social_media-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/08/26112855/ 3 KB
3 KB 23ms
21ms Image
image/jpeg 2600:9000:20eb:3e00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/08/26112855/social_media-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3e00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 791135f98b21bbd99c1cbcd56e2827cab155856c144602a8749a57acaa5aa813

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 17:54:56 GMT
via: 1.1 16dc09493f48bbc1fd2cdd6e175a94f7.cloudfront.net (CloudFront), 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Mon, 26 Aug 2019 15:29:14 GMT
server: AmazonS3
age: 1617114
etag: "fcf0de78ef3c45c8f8256c7cec2c35c0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA2-C1
accept-ranges: bytes
content-length: 2834
x-amz-cf-id: NiTsQQbOMQUBHRl5pgJZmICh41SE-6uSMpBcODAyISnGQ5jc7GkMYg==
expires: Tue, 25 Aug 2020 15:29:11 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 267ms
267ms Script
application/x-javascript 2600:9000:2156:b200:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:b200:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 926
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:30 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: wJcLLRiHcuSGSp_A7Aegpg65fAtIwhl4Myq0qcP6YBes9k6xVrQAMQ==
expires: Wed, 07 Oct 2020 15:53:50 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 34 KB
12 KB 963ms
117ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:24 GMT
Server: nginx
ETag: W/"5f7b202c-88c2"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 7 KB
3 KB 279ms
272ms Script
application/x-javascript 2600:9000:2156:b200:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:b200:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 2685
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:30 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: ybb68u26L-h4WLYXKDpFlswDoAbjAZQALtoUnIxWyocz29WrL9Cbtg==
expires: Wed, 07 Oct 2020 15:54:13 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 276ms
270ms Script
application/x-javascript 2600:9000:2156:b200:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:b200:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 1747
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:30 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: UEwM2wDPV7jGLuM4ibF_JGC1fXwmBQ_vO95fZ6nQnD6VGxdZ1eObvQ==
expires: Wed, 07 Oct 2020 15:54:30 GMT

GET
H3-Q050 200 api.js Show response
www.google.com/recaptcha/ 852 B
993 B 45ms
26ms Script
text/javascript 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.4.2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

185d5ff3cb0b3a389078f0bef7eb09cbb75c7e50a4047dceb2339424ba239429

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 558
x-xss-protection: 1; mode=block
expires: Wed, 07 Oct 2020 11:06:49 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 362ms
357ms Script
application/x-javascript 2600:9000:2156:b200:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:b200:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 973
x-cache-hit: HIT
last-modified: Wed, 10 Jun 2020 22:05:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: OFrT_16abiHdH9lnG791lFsKmUbVj9dO7OCAjDaX-nhcs2ZmG-wWmA==
expires: Wed, 07 Oct 2020 15:53:57 GMT

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ 61 KB
21 KB 51ms
48ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1673857
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: RQKH2MzjQ9P2q6_wnafypeu4fPhzqq8WaM1mI_vP1foS7L1wJMfHVQ==

GET
H2 200 bl-04a3385-c6d10f56.js Show response
tagan.adlightning.com/math-aids-threatpost/ 73 KB
21 KB 64ms
61ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c6d10f56.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 36ea03bb3518394f6f6559784b58b800653eb18b629eebc7dfe09f42ca43a47f

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 00:42:47 GMT
content-encoding: gzip
age: 37443
x-cache: Hit from cloudfront
status: 200
content-length: 21045
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 07 Oct 2020 00:40:07 GMT
server: AmazonS3
etag: "19beac0df8ccb3359c3045bc00def5ef"
x-amz-version-id: wcuzbG9p5cKip7cGpXdnUtIEtxvpCS0O
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: ikR2M4pityRmNhm3B7QJQ0BjhyF8ylOus8LXqivDVrJxupBarlqY6A==

GET
H2 200 pubads_impl_2020100501.js Show response
securepubads.g.doubleclick.net/gpt/ 271 KB
96 KB 90ms
33ms Script
text/javascript 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020100501.js?21067676

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f130.1e100.net

Software

sffe /

Resource Hash

ce9fc9f45a3f5d71caa5b1cb264f152f8d1a1aad40d91fe4247c083521340ff5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 05 Oct 2020 08:42:08 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97451
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:06:49 GMT

GET
H2 200 vendor-list.json Show response
qd.admetricspro.com/js/cmp2/ 286 KB
29 KB 178ms
158ms XHR
application/json 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05a4571fdc0000befb648c3200000001
last-modified: Tue, 06 Oct 2020 19:31:27 GMT
server: cloudflare
etag: W/"4773b-5b105a5302c6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602068810"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 5de727ac9f42befb-FRA
expires: Wed, 07 Oct 2020 11:16:49 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 109 KB
28 KB 132ms
46ms Script
application/javascript 52.84.113.143
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.113.143 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-113-143.sof50.r.cloudfront.net
Software: Server /
Resource Hash: 5876f68bf30a82eb99d9ec29e561f5c925ea347243c3e022021dd87823c65813

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 18:11:03 GMT
content-encoding: gzip
server: Server
age: 60945
etag: 0ef1f140246b7e0337b522d7332711d3
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: VacNts_f92Nd4ee0865jdC1vFJldkat9eyp2r_L7THqzAlSUveclBg==
via: 1.1 ab553edf4372e7270c4dfe91ddaa27ec.cloudfront.net (CloudFront)

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/64536/ Frame 3ABB
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/64536/connatix.player.dc.js

887 KB
219 KB

74ms
23ms

Script
application/javascript

151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/64536/connatix.player.dc.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: c79988700fbb1c66daba344650a7a0679ba4f34ec6f52d5cdffef16dd8748796

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: gzip
age: 62055
x-cache: HIT, HIT
status: 200
content-length: 223442
x-served-by: cache-dca17747-DCA, cache-hhn4066-HHN
access-control-allow-origin: *
last-modified: Tue, 06 Oct 2020 17:49:11 GMT
x-timer: S1602068810.914318,VS0,VE0
etag: "13c143db3f8d388303587be9363f44ab"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 3118

Redirect headers

date: Wed, 07 Oct 2020 11:06:49 GMT
via: 1.1 varnish
server: Varnish
age: 0
x-served-by: cache-fra19163-FRA
status: 302
x-cache: HIT
location: https://cds.connatix.com/p/64536/connatix.player.dc.js
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
x-timer: S1602068810.785106,VS0,VE0
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
399 B 637ms
158ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=1949930537&back=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 11:06:50 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/javascript
x-cache-hit: MISS
Transfer-Encoding: chunked
X-Debug-Auth: off
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 149 KB
47 KB 18ms
17ms Script
application/javascript 2a00:1450:4001:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

591d09bb8a2193a0324896b819b64a80c043e51071fea910995d42f688249965

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:49 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48415
x-xss-protection: 0
last-modified: Wed, 07 Oct 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 07 Oct 2020 11:06:49 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 13 KB
5 KB 797ms
119ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 13 KB
5 KB 359ms
121ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 328ms
123ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: "5f7b202e-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 210ms
121ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:49 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: "5f7b202e-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Thu, 07 Oct 2021 11:06:49 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 450ms
216ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:31 GMT
Server: nginx
ETag: "5f7b2033-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Thu, 07 Oct 2021 11:06:50 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 361ms
121ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: "5f7b202e-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Thu, 07 Oct 2021 11:06:50 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 464ms
224ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:31 GMT
Server: nginx
ETag: "5f7b2033-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Thu, 07 Oct 2021 11:06:50 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/Y5tQ3lKwn1XL5hGgLz1kR4-1/ 340 KB
134 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/Y5tQ3lKwn1XL5hGgLz1kR4-1/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01c3a4ce829c1fbf0971eb258b96314724a64d2c5e50b8c088f60328c4f35df1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 10:30:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2202
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136974
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 22:01:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 07 Oct 2021 10:30:07 GMT

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 714ms
118ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 603ms
126ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 288ms
121ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: "5f7b202e-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Thu, 07 Oct 2021 11:06:50 GMT

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 346ms
116ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 349ms
117ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 07 Oct 2020 11:06:50 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: "5f7b202e-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 1989
date: Wed, 07 Oct 2020 10:33:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Wed, 07 Oct 2020 12:33:40 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 31ms
8ms Script
application/javascript 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
etag: "O/+l6c17R2TQ0JQMJXOiXA=="
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 69ms
23ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
age: 48863
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4057-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1602068810.059541,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 124ms
41ms XHR
application/javascript 52.84.113.143
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.113.143 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-113-143.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 12:20:32 GMT
content-encoding: gzip
vary: Origin
age: 81979
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Wed, 30 Sep 2020 05:43:29 GMT
server: AmazonS3
etag: "a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 a492e3d7e1e07970b5b6e383c833d8a0.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: SOF50-C1
x-amz-cf-id: kUIVpJ-VT1NK4FKa_wpJqlT4-mXdPHY3OiznF_AKtsZlIsCFlHcNag==

POST
H/1.1 200
OK e Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 535ms
133ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/e
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 connatix.player.css
cds.connatix.com/p/64536/ 53 KB
9 KB 24ms
24ms Stylesheet
text/css 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/64536/connatix.player.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 072ab2e24f8ac0a6f43c0c0214b33e72c1f80b4cdea9503a416483a3d4cee21f

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
age: 62055
x-cache: HIT, HIT
status: 200
content-length: 8784
x-served-by: cache-dca17782-DCA, cache-hhn4066-HHN
access-control-allow-origin: *
last-modified: Tue, 06 Oct 2020 17:49:11 GMT
x-timer: S1602068810.168756,VS0,VE0
etag: "3c5fd80775ec68e957c0f096c2c519f7"
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 3589

POST
H2 200 c Show response
prebid.a-mo.net/a/ 652 B
834 B 419ms
177ms XHR
application/json 34.237.157.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.157.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 116e5aa02b653ec7db7a5f7f7054c164f75feb9ceb7814d9f6affe326cd5f81a

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
server: Cowboy
status: 200
x-amzn-trace-id: Bids=0;Placement=dGhyZWF0cG9zdC5jb20
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 325

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
168 B 360ms
117ms XHR
application/json 165.227.252.242
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Wed, 07 Oct 2020 11:06:50 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com
content-length: 16
vary: Origin
content-type: application/json

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
311 B 74ms
25ms XHR
application/json 35.156.107.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.10.0&referrer=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&tmax=1200&gdpr=false

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.107.113 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
x-auction-status: 12, 12, 12
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 25 B
568 B 262ms
180ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%2213ed9be15227de1%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2214faddea9ecf797%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2215668b7ae39af56%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2216e30124feaff56%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2214faddea9ecf797%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2214faddea9ecf797%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2215668b7ae39af56%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2216e30124feaff56%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2ffe521369b76cf33cc43c0bf1c7d0364b994ae528adb8b6b23aea7e1f485b03

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
server: Apache
status: 200
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-type: application/json
content-length: 45
expires: Wed, 07 Oct 2020 11:06:50 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 340 B
493 B 173ms
58ms XHR
application/json 34.241.71.237
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=6139
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.241.71.237 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e8fb48dbf4c0d6ee5c317fa722351493db6756e0603c32af7c21e6211e8c6d97

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
status: 200
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
713 B 127ms
51ms XHR
application/json 185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.11 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:50 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 733.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.87:80
AN-X-Request-Uuid: 9b42e9c4-07a4-45c0-83c5-24664b7f3cb8
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 263 B
2 KB 158ms
86ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&tk_flint=pbjs_lite_v4.10.0&x_source.tid=bbda5628-3cbc-4fb8-8a73-9e0b349b6c29&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9438269622328876
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 95e9d32cd4913300b99a678b253eb36962f32e02ff06fc56176c54d5967a8588

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:50 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 263
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 158ms
86ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&tk_flint=pbjs_lite_v4.10.0&x_source.tid=340ef3a8-3a82-45bf-a0f3-5e1dc75419a3&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9972388149301137
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 6211a4606fe7072356e3224f9fa7385ccaab22889c201db12a759ccdd4305e01

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:50 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 153ms
82ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&tk_flint=pbjs_lite_v4.10.0&x_source.tid=7efb8e86-e717-4833-9dc0-88777770ecff&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5407745263757673
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 6ad38a3b2980c56582422f7982441150b4cb9b6d946979c5bd14457ade184cf1

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:50 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 164ms
90ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&tk_flint=pbjs_lite_v4.10.0&x_source.tid=7efb8e86-e717-4833-9dc0-88777770ecff&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9305825955264844
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: f1368681d37c38bbbded5fb55ed12b9fcf6bf44329b19251c3fba5f2afac24cd

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:50 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
755 B 100ms
39ms XHR
application/json 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.10.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: ff192cb613e7624adcb95906971aaf4f746bf22d5bdb0316e00d0fe319d2df10

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2

200

ADTECH;apid=1A32fccc04-088d-11eb-bd49-121160e138ec;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=5890dcc3457aec;misc=1602068810193 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5890dcc3457aec;misc=1602068810193;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1602068810;v=2;cmd=bid;cors=yes;alias=5890dcc3457aec;misc=1602068810193
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A32fccc04-088d-11eb-bd49-121160e138ec;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=5890dcc3457aec;misc=160...

1 KB
2 KB

148ms
148ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A32fccc04-088d-11eb-bd49-121160e138ec;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=5890dcc3457aec;misc=1602068810193
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 8e3b65c9ba7bc049f2d690aa5bf77e27921d07e4119826ca54726081584157d2

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A32fccc04-088d-11eb-bd49-121160e138ec;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=5890dcc3457aec;misc=1602068810193
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A32f9df44-088d-11eb-b123-126f1f1ee25e;cfp=1;rndc=1602068810;v=2;cmd=bid;cors=yes;alias=5950ebc2ce3dd4e;misc=1602068810193 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5950ebc2ce3dd4e;misc=1602068810193;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=5950ebc2ce3dd4e;misc=1602068810193
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A32f9df44-088d-11eb-b123-126f1f1ee25e;cfp=1;rndc=1602068810;v=2;cmd=bid;cors=yes;alias=5950ebc2ce3dd4e;misc=16...

1 KB
2 KB

165ms
165ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A32f9df44-088d-11eb-b123-126f1f1ee25e;cfp=1;rndc=1602068810;v=2;cmd=bid;cors=yes;alias=5950ebc2ce3dd4e;misc=1602068810193
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 14f61c0a45e00c687f4f0801fd4111430eda8e18275cf81d2d62f46ef9c6fa54

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A32f9df44-088d-11eb-b123-126f1f1ee25e;cfp=1;rndc=1602068810;v=2;cmd=bid;cors=yes;alias=5950ebc2ce3dd4e;misc=1602068810193
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=609e870ceb962e5;misc=1602068810194 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=609e870ceb962e5;misc=1602068810194;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=609e870ceb962e5;misc=1602068810194

1 KB
2 KB

165ms
164ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=609e870ceb962e5;misc=1602068810194
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 0556999beeb2bafc5f0ebcf90d9642f7e2b3c0e10c0e1d87ce035545328b224d

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=609e870ceb962e5;misc=1602068810194
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A32fd6402-088d-11eb-88db-1212911483a0;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=61bd4e38e64523a;misc=1602068810194 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61bd4e38e64523a;misc=1602068810194;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=61bd4e38e64523a;misc=1602068810194
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A32fd6402-088d-11eb-88db-1212911483a0;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=61bd4e38e64523a;misc=16...

1 KB
2 KB

155ms
155ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A32fd6402-088d-11eb-88db-1212911483a0;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=61bd4e38e64523a;misc=1602068810194
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 91f1a6b77eca7c8f180f3b0f52308bd754a2c03db65594381365323c99a3c54f

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A32fd6402-088d-11eb-88db-1212911483a0;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=61bd4e38e64523a;misc=1602068810194
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=62f077d5a77de0c;misc=1602068810194 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62f077d5a77de0c;misc=1602068810194;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=62f077d5a77de0c;misc=1602068810194

46 B
79 B

162ms
161ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=62f077d5a77de0c;misc=1602068810194
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 71773ad95c85f98348e623cf8ca320b7834511ab5dd8f2f110d73808eecc9173

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 46
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1602068809;v=2;cmd=bid;cors=yes;alias=62f077d5a77de0c;misc=1602068810194
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 174 B
560 B 265ms
214ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=bbda5628-3cbc-4fb8-8a73-9e0b349b6c29%2Cbbda5628-3cbc-4fb8-8a73-9e0b349b6c29%2C340ef3a8-3a82-45bf-a0f3-5e1dc75419a3%2C7efb8e86-e717-4833-9dc0-88777770ecff%2C7efb8e86-e717-4833-9dc0-88777770ecff&nocache=1602068810196&gdpr=0&x_gdpr_f=1&pubcid=6d8ca0bf-aa87-42ef-9c8e-5b334b5c892e&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash: 538b0b758da92e30e5faa05193488c5c3f93538eed46494649783cdfccc3068d

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
server: OXGW/16.194.0
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
712 B 119ms
47ms XHR
application/json 185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.11 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:50 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 733.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.6:80
AN-X-Request-Uuid: aab57814-9751-431e-8eef-65d934b24f04
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 146ms
84ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 07 Oct 2020 11:06:50 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 119 B
505 B 2502ms
2502ms XHR
text/javascript 52.84.113.143
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&pid=IfDdQGKMXWs5W&cb=0&ws=1600x1200&v=7.55.00&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.113.143 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-113-143.sof50.r.cloudfront.net
Software: Server /
Resource Hash: c2fc358dbbf2a7c80b1f45be493848dc05b65a71a063ec4a8c620c65c0622bad

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:52 GMT
content-encoding: gzip
server: Server
x-amz-cf-pop: SOF50-C1
status: 200
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 128
via: 1.1 ab553edf4372e7270c4dfe91ddaa27ec.cloudfront.net (CloudFront)
x-amz-cf-id: dA4b3hdLg_bQTFTOSRmHRoJKkhH6aRMVEpxU8wpGLvdgWxPiguPVwA==

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
124 B 40ms
14ms XHR
text/plain 2a00:1450:4001:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&aip=1&a=793907976&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&ul=en-us&de=UTF-8&dt=COVID-19%20Clinical%20Trials%20Slowed%20After%20Ransomware%20Attack%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=2049966330&gjid=112815272&cid=223366644.1602068810&tid=UA-35676203-21&_gid=643618841.1602068810&_r=1&gtm=2wg9n1PM29HLF&z=263777936

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
392 B 22ms
13ms Image
image/gif 2a00:1450:4001:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&aip=1&a=793907976&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&ul=en-us&de=UTF-8&dt=COVID-19%20Clinical%20Trials%20Slowed%20After%20Ransomware%20Attack%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=223366644.1602068810&tid=UA-35676203-21&_gid=643618841.1602068810&gtm=2wg9n1PM29HLF&z=1747979768

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 14:30:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 74208
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
354 B 576ms
504ms Script
application/x-javascript 2600:9000:203c:6000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:203c:6000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:05:08 GMT
via: 1.1 87deed598e54ca9db1f50a3898faa714.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 103
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: WzoX2vednoE5lOh87ReomkrElLcpP_5qkl52_Xbg-uFcks8iq8ueoQ==

POST
H/1.1 200
OK pls Show response
capi.connatix.com/core/ Frame 3ABB 6 KB
2 KB 547ms
148ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: 95a588b736d6341c1040f51b4491b20d8a215544160c70128fb56643a81a6cf4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
transfer-encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 200 adsct
t.co/i/ 43 B
448 B 194ms
135ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 106
pragma: no-cache
last-modified: Wed, 07 Oct 2020 11:06:50 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 880e7151162b45158917368e95f06880
x-transaction: 00803cda00faebce
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
86 B 15ms
15ms XHR
text/plain 2a00:1450:400c:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-35676203-21&cid=223366644.1602068810&jid=2049966330&gjid=112815272&_gid=643618841.1602068810&_u=YEBAAEAAAAAAAC~&z=842251677

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 07 Oct 2020 11:06:50 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
276 B 18ms
18ms Image
image/gif 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-35676203-21&cid=223366644.1602068810&jid=2049966330&_u=YEBAAEAAAAAAAC~&z=237197941

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 22ms
21ms Image
image/gif 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-35676203-21&cid=223366644.1602068810&jid=2049966330&_u=YEBAAEAAAAAAAC~&z=237197941

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/Y5tQ3lKwn1XL5hGgLz1kR4-1/ 340 KB
134 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/Y5tQ3lKwn1XL5hGgLz1kR4-1/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.4.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01c3a4ce829c1fbf0971eb258b96314724a64d2c5e50b8c088f60328c4f35df1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 10:30:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2203
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136974
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 22:01:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 07 Oct 2021 10:30:07 GMT

GET
H/1.1 200
OK v1 Show response
geo.ipify.org/api/ 438 B
1 KB 682ms
317ms XHR
application/json 64.140.160.2
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL

https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.140.160.2 Los Angeles, United States, ASN18450 (WEBNX, US),

Reverse DNS

threatintelligenceplatform.com

Software

nginx /

Resource Hash

c718e2c8d750801ee84db85084f6d862318ad1711d0a80523ea247a42ed2ca64

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 11:06:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 200 flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 236 B
566 B 267ms
267ms Image
image/svg+xml 2600:9000:2156:b200:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:b200:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
last-modified: Mon, 05 Oct 2020 13:31:25 GMT
server: nginx
x-amz-cf-pop: FRA50-C1
etag: W/"5f7b202d-ec"
x-cache: Miss from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=604800, public
x-amz-cf-id: byvbNEYYWAn8A0nuFyteG3QMeVeWX_EIiYBqnDdnlmFthWVQkTTaRw==
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
expires: Wed, 14 Oct 2020 11:06:50 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 368ms
352ms Font
font/woff2 2600:9000:2156:b200:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:b200:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin: https://threatpost.com
Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
via: 1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 77160
pragma: public
last-modified: Mon, 05 Oct 2020 13:31:32 GMT
server: nginx
etag: "5f7b2034-12d68"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: Dp_YWZJ0Um7AtKU6Xdcvacn1Ie_iBqWDbHETUnz7zmRlo2f_Y9EDfA==
expires: Thu, 07 Oct 2021 11:06:50 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 219ms
154ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 123
pragma: no-cache
last-modified: Wed, 07 Oct 2020 11:06:50 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 66cd7c98cf84488dd6e18502d9a4c9d7
x-transaction: 007ea0ad00a52619
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame C0A3 0
0 29ms
28ms Document
text/html 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=standard&size=normal&cb=b7yejbha2xe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-VcboF+KomaLUfSTk7Xlu5g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=standard&size=normal&cb=b7yejbha2xe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 07 Oct 2020 11:06:50 GMT
content-security-policy: script-src 'report-sample' 'nonce-VcboF+KomaLUfSTk7Xlu5g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10825
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 400 / Show response
graph.facebook.com/ 202 B
582 B 55ms
36ms XHR
application/json 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ac4ef908129db8daeddac032d978d5c8944f6dbb6eea49ead9ed216ddbf16f10

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status: 400
x-fb-rev: 1002783068
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 149
pragma: no-cache
x-fb-debug: y7tFcPOa3wKgifJDlq9dWVaKia8ulgcIY8dGXfNY4jDnUPXVu/pKAMcGBZSf0WVeixcKCSqZLVlQooizcnRlBA==
x-fb-trace-id: FGWoBGMFub+
date: Wed, 07 Oct 2020 11:06:50 GMT
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AGk72oO2lfYbfo9FwvFaZt2
cache-control: no-store
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 193ms
193ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F&format=jsonp&callback=jQuery112406055079940921646_1602068809729&_=1602068809730
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 102 B
1 KB 259ms
163ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:50 GMT
via: 1.1 varnish
x-content-type-options: nosniff
status: 200
content-length: 102
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame AAAE 0
0 38ms
38ms Document
text/html 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=light&size=normal&cb=640vf2ao52cj

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qDDrOdla5Fgc2GjBpmPtUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=light&size=normal&cb=640vf2ao52cj
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 07 Oct 2020 11:06:50 GMT
content-security-policy: script-src 'report-sample' 'nonce-qDDrOdla5Fgc2GjBpmPtUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10795
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 133ms
133ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:50 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 3_media.bin Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 3ABB 232 B
469 B 76ms
23ms XHR
application/octet-stream 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/3_media.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: gzip
age: 734088
x-cache: HIT, HIT
status: 200
content-length: 204
x-served-by: cache-bwi5143-BWI, cache-fra19155-FRA
last-modified: Thu, 17 Sep 2020 01:42:41 GMT
x-timer: S1602068811.043952,VS0,VE1
etag: "796c77896c9738780ae744fd3eb73483"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 1.png
img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/ 4 KB
5 KB 84ms
25ms Image
image/webp 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 1040017
x-cache: HIT, HIT
fastly-io-info: ifsz=8114 idim=288x42 ifmt=png ofsz=4328 odim=288x42 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 4351
x-served-by: cache-dca17721-DCA, cache-hhn4057-HHN
x-timer: S1602068811.060532,VS0,VE1
etag: "E00cBQTrMvE7BFKf7WtTa6oGFTVX3QMTXtfExBtu+i8"
vary: Accept
x-amz-request-id: 73558CDC7A440D38
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1, 1

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 133ms
133ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:51 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 273ms
141ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:51 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ 2 KB
2 KB 26ms
26ms Image
image/webp 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 1080226
x-cache: HIT, HIT
fastly-io-info: ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=2098 odim=400x225 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 2066
x-served-by: cache-dca17725-DCA, cache-hhn4057-HHN
x-timer: S1602068811.112875,VS0,VE1
etag: "iDhG33Z1a+GgxtfhSqjNbZ1Iz0hjRhSMeN4Q5WPVjm0"
vary: Accept
x-amz-request-id: 9718C29D2B1AEC8D
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1, 19

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame 9565 0
0 20ms
19ms Document
text/html 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=4af0t3db3jus

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-O2z2995HagJf7LATCN70rA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=4af0t3db3jus
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 07 Oct 2020 11:06:51 GMT
content-security-policy: script-src 'report-sample' 'nonce-O2z2995HagJf7LATCN70rA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1173
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 prebid3.25.0-1.js Show response
cds.connatix.com/p/plugins/ Frame 3ABB 286 KB
89 KB 24ms
24ms Script
application/javascript 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: gzip
age: 1992166
x-cache: HIT, HIT
status: 200
content-length: 90468
x-served-by: cache-dca17730-DCA, cache-hhn4066-HHN
access-control-allow-origin: *
last-modified: Mon, 14 Sep 2020 09:43:49 GMT
x-timer: S1602068811.204315,VS0,VE0
etag: "9c38c88a790efaae20de0f5391a27029"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 5199

GET
H2 200 pixel;r=49013570;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rD...
pixel.quantserve.com/ 35 B
371 B 11ms
8ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=49013570;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04;fpan=1;fpa=P0-908932403-1602068811191;ns=0;ce=1;qjs=1;qv=3364aec3-20201006003021;cm=;gdpr=0;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=1;et=1602068811191;tzo=-120;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2018%2F08%2F30091211%2Fvulne%2Ctype.article%2Ctitle.COVID-19%20Clinical%20Trials%20Slowed%20After%20Ransomware%20Attack%2Cdescription.The%20attack%20on%20eResearchTechnology%20potentially%20slowed%20down%20coronavirus%20research%20w%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fcovid-19-clinical-trials-ransomware%2F159877%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:51 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame B511 0
0 27ms
27ms Document
text/html 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=vpzzwtwhyb3q

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-YWuNPgIX1YhWnSs85jNBXQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=vpzzwtwhyb3q
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 07 Oct 2020 11:06:51 GMT
content-security-policy: script-src 'report-sample' 'nonce-YWuNPgIX1YhWnSs85jNBXQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1173
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 playlist.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 3ABB 309 B
332 B 23ms
23ms XHR
application/x-mpegurl 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/playlist.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: gzip
age: 783288
x-cache: HIT, HIT
status: 200
content-length: 164
x-served-by: cache-bwi5141-BWI, cache-fra19155-FRA
last-modified: Mon, 07 Sep 2020 18:49:42 GMT
x-timer: S1602068811.236552,VS0,VE0
etag: "8a966507b13615ecdc1330a4bc9dcfe1"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 3

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 3ABB 92 B
285 B 44ms
43ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=63b1d8f7-e43e-4636-b575-e37db354bd04&nocache=1602068811279&auid=540882779&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:51 GMT
via: 1.1 google
server: OXGW/16.194.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 3ABB 24 B
1 KB 311ms
223ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%2231c950b38cf7fd%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2245aee9a62fa6db%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: fc7fd2b763c01bb2e44e93a500790491d8f950a5631e81f606373e68593ba308

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:51 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 44
Expires: Wed, 07 Oct 2020 11:06:51 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 3ABB 0
59 B 35ms
34ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 07 Oct 2020 11:06:51 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 3ABB 92 B
282 B 49ms
49ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=02a993ac-70dc-4ce3-9ef1-86d0357bed1c&nocache=1602068811285&auid=540882778&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:51 GMT
via: 1.1 google
server: OXGW/16.194.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 3ABB 24 B
1 KB 294ms
210ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%229ba286d0cadf4f%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2210e8f0b92703415%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 03649218aa84e7a154d4f4bbd90ee1c29ec4bc7457e0c302a86d1b37fc3f8867

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:51 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 44
Expires: Wed, 07 Oct 2020 11:06:51 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 3ABB 0
59 B 34ms
33ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 07 Oct 2020 11:06:51 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 3ABB 19 B
714 B 83ms
83ms XHR
application/json 185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.11 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:51 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 733.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.242:80
AN-X-Request-Uuid: 02d99b9e-fdbc-468f-881d-f475c66d6cc2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 3ABB 19 B
714 B 76ms
75ms XHR
application/json 185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.11 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:51 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 733.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.181:80
AN-X-Request-Uuid: a5481af9-bc3c-457c-b066-9c0cdfc6e511
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 3ABB 0
215 B 125ms
29ms XHR
application/json 52.58.71.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.71.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-71-47.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 0.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 3ABB 5 KB
1 KB 24ms
23ms XHR
application/x-mpegurl 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: gzip
age: 783289
x-cache: HIT, HIT
status: 200
content-length: 959
x-served-by: cache-bwi5151-BWI, cache-fra19155-FRA
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
x-timer: S1602068811.317861,VS0,VE0
etag: "3a71266b043248350b2f39a55da8294e"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 3

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 35ms
35ms Other 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 07 Oct 2020 11:06:51 GMT
x-served-by: cache-fra19155-FRA
x-cache: HIT
x-cache-hits: 0
x-timer: S1602068811.346003,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 3ABB 1 KB
2 KB 26ms
23ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-1428

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 783285
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5137-BWI, cache-fra19155-FRA
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 0-1428/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1602068811.385352,VS0,VE0
access-control-allow-origin: *
Content-Length: 1429
x-cache-hits: 2, 1

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 3ABB 444 KB
445 KB 24ms
23ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=1429-456334

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 783285
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5137-BWI, cache-fra19155-FRA
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 1429-456334/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1602068811.444665,VS0,VE0
access-control-allow-origin: *
Content-Length: 454906
x-cache-hits: 2, 2

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
168 B 15ms
15ms Script
application/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
168 B 16ms
15ms Script
application/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 182 KB
30 KB 497ms
464ms XHR
text/plain 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=503200782921396&correlator=4010628601793115&output=ldjh&impl=fifs&eid=21067119%2C21067676%2C21067447&vrg=2020100501&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201007&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fcovid-19-clinical-trials-ransomware%252F159877%252F%26urlquery%3Dgoogfc%26contentid%3D159877%26category%3Dmalware-2%26contenttags%3Dastrazeneca%252Cbristol-myers-squibb%252Cclinical-trials%252Ccoronavirus-research%252Ccovid-19%252Ccyberattack%252Ceresearchtechnology%252Ciqvia%252Cpen-and-paper%252Cransomware-attack%252Cstealing-research%252Cvaccines&cookie_enabled=1&bc=31&abxe=1&lmt=1602068811&dt=1602068811432&dlt=1602068808995&idt=645&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1534%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fcovid-19-clinical-trials-ransomware%2F159877%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04&dssz=55&icsg=171811933184&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=223366644.1602068810&ga_sid=1602068811&ga_hid=793907976&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020100501.js?21067676

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f130.1e100.net

Software

cafe /

Resource Hash

b2b66d94581872c3528b84fdf93298b3dc91dc7fd97ef1012740a3a7389ced5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29631
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
ec20b48d4567d77ce3b9d37ea692291e.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 86ms
42ms Other
text/html 2a00:1450:4001:815::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ec20b48d4567d77ce3b9d37ea692291e.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 6ms
6ms Other
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 23ms
23ms Other 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 07 Oct 2020 11:06:51 GMT
x-served-by: cache-fra19155-FRA
x-cache: HIT
x-cache-hits: 0
x-timer: S1602068811.421212,VS0,VE0
cache-control: max-age=31557600
content-length: 0

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 23ms
22ms Other 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 07 Oct 2020 11:06:51 GMT
x-served-by: cache-fra19155-FRA
x-cache: HIT
x-cache-hits: 0
x-timer: S1602068812.554277,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 3ABB 390 KB
390 KB 24ms
24ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=456335-855191

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 783285
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5137-BWI, cache-fra19155-FRA
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 456335-855191/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1602068812.577613,VS0,VE0
access-control-allow-origin: *
Content-Length: 398857
x-cache-hits: 2, 3

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 3ABB 310 KB
107 KB 32ms
13ms Script
text/javascript 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a342ab6bee2e8546163f7798ea3978ce275888e65c62f01e57eb000d22dd5d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 109249
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:06:51 GMT

GET
H3-Q050 200 bridge3.415.1_en.html
imasdk.googleapis.com/js/core/ Frame 8398 0
0 26ms
13ms Document
text/html 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.415.1_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.415.1_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 201092
date: Fri, 02 Oct 2020 22:40:46 GMT
expires: Sat, 02 Oct 2021 22:40:46 GMT
last-modified: Fri, 02 Oct 2020 22:32:56 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 390365
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 3ABB 26 KB
11 KB 33ms
14ms Script
text/javascript 2a00:1450:4001:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10523
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:06:51 GMT

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ Frame 3ABB 109 B
868 B 37ms
23ms Script
application/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 07 Oct 2020 11:06:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

POST
H/1.1 200
OK mq Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 133ms
133ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/mq?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:51 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 bl-04a3385-c6d10f56.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 9CD0 73 KB
21 KB 47ms
47ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c6d10f56.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 36ea03bb3518394f6f6559784b58b800653eb18b629eebc7dfe09f42ca43a47f

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 00:42:47 GMT
content-encoding: gzip
age: 37446
x-cache: Hit from cloudfront
status: 200
content-length: 21045
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 07 Oct 2020 00:40:07 GMT
server: AmazonS3
etag: "19beac0df8ccb3359c3045bc00def5ef"
x-amz-version-id: wcuzbG9p5cKip7cGpXdnUtIEtxvpCS0O
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: j3w7Cv47qekyE8CbrR7T8PgTIE98yYfYWJ4as2etCW3NmeLMajzmig==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 9CD0 61 KB
21 KB 47ms
47ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1673860
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: zCoi8U08diTot76YpaMVD4tVhXHEt8mytGPAkIDiMXVBAebp8hi7Yg==

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
57 B 14ms
14ms Image
image/gif 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&pvsid=503200782921396&r=300x250%7C336x280&w=300&h=250&a=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bl-04a3385-c6d10f56.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 9DB4 73 KB
21 KB 45ms
45ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c6d10f56.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 36ea03bb3518394f6f6559784b58b800653eb18b629eebc7dfe09f42ca43a47f

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 00:42:47 GMT
content-encoding: gzip
age: 37446
x-cache: Hit from cloudfront
status: 200
content-length: 21045
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 07 Oct 2020 00:40:07 GMT
server: AmazonS3
etag: "19beac0df8ccb3359c3045bc00def5ef"
x-amz-version-id: wcuzbG9p5cKip7cGpXdnUtIEtxvpCS0O
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: hKGw3mhWWrflE3xXdfH7uDVrNtPKmEUV2tFoVg9T6NFxu5n_Q2VgYQ==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 9DB4 61 KB
21 KB 45ms
45ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1673860
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: r5keKJfc6ytZWoqCeQiCkDxhOTL_Mt0muogNmeaAMVb7Z-sP8bQTPg==

GET
H2 200 bl-04a3385-c6d10f56.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 7C43 73 KB
21 KB 45ms
44ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c6d10f56.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 36ea03bb3518394f6f6559784b58b800653eb18b629eebc7dfe09f42ca43a47f

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 00:42:47 GMT
content-encoding: gzip
age: 37446
x-cache: Hit from cloudfront
status: 200
content-length: 21045
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 07 Oct 2020 00:40:07 GMT
server: AmazonS3
etag: "19beac0df8ccb3359c3045bc00def5ef"
x-amz-version-id: wcuzbG9p5cKip7cGpXdnUtIEtxvpCS0O
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: __XqbzImPuBHKGcvFWlxa8IpopRvTEvrBBe7YEOFB9ZbsBej-5e5KA==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 7C43 61 KB
21 KB 45ms
44ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1673860
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: eYru0oma-J4f76qqqZsM1cw8ZUhUVQ7fVuY-nXL_N89N_XM1IGlwFw==

GET
H2 200 bl-04a3385-c6d10f56.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 2C09 73 KB
21 KB 46ms
44ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c6d10f56.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 36ea03bb3518394f6f6559784b58b800653eb18b629eebc7dfe09f42ca43a47f

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 00:42:47 GMT
content-encoding: gzip
age: 37446
x-cache: Hit from cloudfront
status: 200
content-length: 21045
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 07 Oct 2020 00:40:07 GMT
server: AmazonS3
etag: "19beac0df8ccb3359c3045bc00def5ef"
x-amz-version-id: wcuzbG9p5cKip7cGpXdnUtIEtxvpCS0O
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: DTn0oXClCPYYEk0AohAVIuDM5bYS9qOhIW5iC4zqD1nko9wBX1-kOQ==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 2C09 61 KB
21 KB 46ms
44ms Script
application/javascript 52.84.112.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-113.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1673860
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b13dfc8227e37a6afa27b672a48db76c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: MgzvCTCkamM0JzxYa1YtTDiULajZH4-P4Fh_OOjYpm7-NVbQN5kpqA==

GET
H3-Q050 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 2C09 330 B
492 B 31ms
15ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 11:08:27 GMT
x-content-type-options: nosniff
age: 86305
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 11:08:27 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201001/r20110914/ Frame 2C09 18 KB
7 KB 30ms
14ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201001/r20110914/abg_lite_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93ee1cf33c2f89ea4b40725a3fa6e12ef339841146b9725bab9d7607afd25f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 09:36:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5437
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 4444408978987076335
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 21 Oct 2020 09:36:15 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201001/r20110914/client/ Frame 2C09 3 KB
2 KB 29ms
13ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201001/r20110914/client/window_focus_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

87adcd951526f566dd8a1eb655a8c4736a3bad8167f6e09a255e54650aeeb655

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 08:21:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9920
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1330
x-xss-protection: 0
server: cafe
etag: 15429208973290199181
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 21 Oct 2020 08:21:32 GMT

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2C09 74 KB
29 KB 36ms
21ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e065984f0b5379a6b11ab4dc497fe57f7b56efd8326952d59ae1d57566e9fe4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1601897795664432"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28872
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:06:52 GMT

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 34ms
21ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020100501.js?21067676

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6879bf69ca14159cb61c4420c496946a303da8a9a37f6e0b4f4e12e79cbbf06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1601897795664432"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27576
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:06:52 GMT

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 9 KB
7 KB 39ms
26ms XHR
application/json 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020100501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020100501.js?21067676

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b0c671ac97d882d197521eaa9f2ef51b4ce6899520ec43471e04e25fa40f782a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 07 Oct 2020 11:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6711
x-xss-protection: 0

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
427 B 112ms
34ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=0&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vY292aWQtMTktY2xpbmljYWwtdHJpYWxzLXJhbnNvbXdhcmUvMTU5ODc3Lz9faHNtaT04ODk3NDc0NCZfaHNlbmM9cDJBTnF0ei1fckR5Y3lJdzRJYmtSVnhOYk1lcE9yYUlscFFGYW11UlVzNVhGeE9MaGRLc3BNWEZyU0M3QkJXMDVUZ2k3M1EyTE5pQ0JkOEZZVm9oYnV3SG9USzI4ekgtU21Gc1RXX1lWT29CWnJ1X1hlX1JWcEIwNCIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTk3MHgyNTAtQVRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDU5NDU1OTc1MiIsImNhbXBhaWduSWQiOiIyNjU0MDI1MDM5IiwiY3JlYXRpdmVJZCI6IjEzODMwMTUzNDE5OCIsImxpbmVpdGVtSWQiOiI1Mjc2MDQ3MzgyIiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjcyOCwiaGVpZ2h0Ijo5MCwid3YiOiIxLjAuMCs5YTRmN2NlIiwiYnYiOiIxLjAuMCs5YTRmN2NlIiwidGFnTWFya3VwIjoiPGh0bWwgYW1wNGFkcz1cIlwiIGNsYXNzPVwiaS1hbXBodG1sLWluYWJveFwiIGktYW1waHRtbC1sYXlvdXQ9XCJcIiBpLWFtcGh0bWwtbm8tYm9pbGVycGxhdGU9XCJcIj48aGVhZD48c2NyaXB0IHNyYz1cImh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2JsLTA0YTMzODUtYzZkMTBmNTYuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMtdGhyZWF0cG9zdC9iLTlhNGY3Y2UtYTdmNjA5OGMuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdD53aW5kb3dbXCIzNTY5NzY0Ml9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXSA9IHdpbmRvd1tcIjM1Njk3NjQyX21hdGgtYWlkcy10aHJlYXRwb3N0XCJdIHx8IHt9O3dpbmRvd1tcIjM1Njk3NjQyX21hdGgtYWlkcy10aHJlYXRwb3N0XCJdLnRhZ0RldGFpbHMgPSB3aW5kb3dbXCIzNTY5NzY0Ml9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXS50YWdEZXRhaWxzIHx8IHtcInNpdGVJZFwiOlwibWF0aC1haWRzLXRocmVhdHBvc3RcIixcInd2XCI6XCIxLjAuMCs5YTRmN2NlXCIsXCJ0b3BEb21haW5cIjpcImh0dHBzOi8vdGhyZWF0cG9zdC5jb20vY292aWQtMTktY2xpbmljYWwtdHJpYWxzLXJhbnNvbXdhcmUvMTU5ODc3Lz9faHNtaT04ODk3NDc0NCZfaHNlbmM9cDJBTnF0ei1fckR5Y3lJdzRJYmtSVnhOYk1lcE9yYUlscFFGYW11UlVzNVhGeE9MaGRLc3BNWEZyU0M3QkJXMDVUZ2k3M1EyTE5pQ0JkOEZZVm9oYnV3SG9USzI4ekgtU21Gc1RXX1lWT29CWnJ1X1hlX1JWcEIwNFwiLFwiY3VycmVudFRhZ0lkXCI6XCJhZGx0YWdfa2Z6YWVtcnZfdDY5WlJYMmtYVDhcIixcImF1XCI6XCIvMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC05NzB4MjUwLUFURl8wXCIsXCJzbG90RWxlbWVudElkXCI6XCJkaXYtZ3B0LWFkLTY3OTQ2NzAtMlwiLFwiYWRTZXJ2ZXJEZXRhaWxzXCI6e1wiYWR2ZXJ0aXNlcklkXCI6XCI0NTk0NTU5NzUyXCIsXCJjYW1wYWlnbklkXCI6XCIyNjU0MDI1MDM5XCIsXCJjcmVhdGl2ZUlkXCI6XCIxMzgzMDE1MzQxOThcIixcImxpbmVpdGVtSWRcIjpcIjUyNzYwNDczODJcIixcImFkU2VydmVyXCI6XCJkZnBcIn0sXCJ3XCI6NzI4LFwiaFwiOjkwfTt3aW5kb3cuYmxvY2tlciAmJiBibG9ja2VyKFwiMzU2OTc2NDJfbWF0aC1haWRzLXRocmVhdHBvc3RcIiwgXCI8IS0tQURMX1dSQVBQRUQtLT5cIiwgZmFsc2UsIHdpbmRvdywge30pOzwvc2NyaXB0PjwvaGVhZD48L2h0bWw%2BPCEtLSBJRlJBTUUgSU5ORVIgQ09OVEVOVCAtLT4iLCJtZXRhIjp7InBsUmF0aW8iOjAuMDF9fQ%3D%3D&i=1-1&t=adltag_kfzaemrv_t69ZRX2kXT8&r=ec840448cd4064884b2849284dd3d57&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: VxaKjGOyTQV4rtpDxB4PHxpr5vgjTF7QJTGyrN9GgGdMzHtn6hxjyA==

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012009282107000/ Frame 9CD0 206 KB
56 KB 33ms
7ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33901d23b88c104fc2e9d2d029542d2c89eb30dff24f698f339a175d3a4267fa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93534
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57253
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:07:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0138da5df6f877a3"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:07:58 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 9CD0 16 KB
7 KB 32ms
6ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-ad-exit-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00e1ffbde89afc301abf43ed68bc52d7d7bae9f81d0bd93638394f4e287b12f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93532
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5763
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:08:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0dd94cdacc228659"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:08:00 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 9CD0 96 KB
29 KB 43ms
18ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-analytics-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

239733db63c823ff0f27720321732ff16ae6591fd0a41b6793ee665e9226b42f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 94021
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29503
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 08:59:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "59cc65a87e598f8b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 08:59:51 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 9CD0 4 KB
2 KB 42ms
17ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-fit-text-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82f60467c442f1292050ac1673c3074047283bfd9ff9be7480a65fddf6a24969

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93532
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1805
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:08:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d5686bc7b82e539c"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:08:00 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 9CD0 47 KB
14 KB 40ms
15ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-form-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f34e56bbdec33105361cc35f3805704b6d3df415b0bf044ef2a6f11764bd8a20

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93994
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14600
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:00:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9a6f012caf7a1c6f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:00:18 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9CD0 5 KB
738 B 19ms
16ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 07 Oct 2020 09:54:32 GMT
server: ESF
date: Wed, 07 Oct 2020 11:06:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Oct 2020 11:06:52 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9CD0 5 KB
761 B 18ms
15ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 07 Oct 2020 10:09:31 GMT
server: ESF
date: Wed, 07 Oct 2020 11:06:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Oct 2020 11:06:52 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18095304898287668287/ Frame 9CD0 6 KB
6 KB 10ms
8ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18095304898287668287/downsize_200k_v1?sqp=4sqPyQSUAUKRAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhgIqAEQWBgBIAEtAAAAPzCoAThYRQAAgD8&rs=AOga4qngttuQYizhE3BjQBomZ711ZfFSZw

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e0dfdc9511d1bc5302b207c68d81ecd9a4ef11cb1f45f6d5821506d31c1658d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 05:43:32 GMT
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2019 15:23:35 GMT
server: sffe
age: 19400
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6130
x-xss-protection: 0
expires: Thu, 07 Oct 2021 05:43:32 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/8478110452070049984/ Frame 9CD0 21 KB
21 KB 11ms
9ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8478110452070049984/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qnabhgOJjIg7v3oP2WA1-u5sg6h8g

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35a32d460faa84b73cd644d1fc250fd7cbdf3d3724382980fa00a26df7670735

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:46:51 GMT
x-content-type-options: nosniff
last-modified: Mon, 16 Sep 2019 23:58:20 GMT
server: sffe
age: 69601
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21153
x-xss-protection: 0
expires: Wed, 06 Oct 2021 15:46:51 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9CD0 0
0 39ms
36ms Image
text/html 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C47UUS6F9X_zWItHl7gOO-Kx4wp6lzV-7u4zYqAyPz-idswkQASDRh9IgYPWVzoHgBKABlIKG5QPIAQapAght91njR7I-4AIAqAMByAMKqgSrA0_Ql4_AID7dFT0wiYMxL786uDUuOXcVYq7OvGz_LZzyGAUivNLlDJ_vgw4ettoiOrQxpcBSe2aFG2ln39pjMS-kjolHN_wgZjWNuElKpe3LImRufsTvFxRKoSTISBl5mpSnQXkEArROCWjY_Djp1Aptz4jMVA8wBoi00A6KHhWIBE5gaQ41UQotCyNW7HN1PH6iWJF8XszhvNUOMn1SWsAqnO5l9uHTDZXJ_zRcOSc3x2uy2W4h5jrvvD6wCpuzqayYEbfJt5zgKqwndcA0XeqLlS1AUxeLFB-DU10vuQfeuy95a5L2rdjoiA76KyOGiziVMj_N34R3J0VpeKYwy5Z2B_c-UNVqJxHKE_m4OsZdpfnMyWnAU6ENLi1T82mcdRTiaKfWTq8zJ0-TnvWydE0viaOIpuJu3ecbSxfY2vIlnEYob0ijSUBpp3EXMdwcjqSfHj2VGdKdfvFc1HFK3Lc2IBkVR3AqWt44rCfCppXPtbLIMFdZe2-xEsj89PrBhg-o8rmswsVY4a1gmvr1j490uWS8RdESGt8_LoBHbXU0jyGp11yEpENGfo3ABMTipd0d4AQBkgUECAQYAZIFBAgFGASgBjeAB9T9-RqoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gH7paxAqgHpr4bqAfs1RvYBwHyBwQQqtoQ0ggJCIDhgEAQARgd8ggbYWR4LXN1YnN5bi03MjYzNTczNDQ2ODA0MDc4gAoDyAsBsgwUcHViLTk2ODU3MzQ0NDU0NzY4MTTYEwyIFAM&sigh=Zq5htXgtzdE&template_id=492&tpd=AGWhJmuBN6YVm8jBuWchVe6FG2B1_Vw7yAgZ7tH_TE-zjOY0XA
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.23.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s18-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 9CD0 0
0 16ms
14ms Image
text/html 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSbXV8V3XKGC87Jl9rou4igUwgBaKBNGm__IY_9ED2ZkvNw6DhfYCvj_nxSdMxD2VxBcwui
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9CD0 2 KB
3 KB 9ms
7ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 23:34:19 GMT
x-content-type-options: nosniff
server: cafe
age: 41553
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 23:34:19 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9CD0 295 B
388 B 10ms
8ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 47611
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 07 Oct 2020 21:53:21 GMT

GET
DATA 200
OK truncated
/ Frame 9CD0 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc609056631b36cdd26ce90db1eb9ac8628d155d5f1dabd522be1db5772a7a4d

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012009282107000/ Frame 9DB4 206 KB
56 KB 29ms
15ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33901d23b88c104fc2e9d2d029542d2c89eb30dff24f698f339a175d3a4267fa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93534
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57253
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:07:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0138da5df6f877a3"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:07:58 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 9DB4 16 KB
7 KB 26ms
13ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-ad-exit-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00e1ffbde89afc301abf43ed68bc52d7d7bae9f81d0bd93638394f4e287b12f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93532
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5763
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:08:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0dd94cdacc228659"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:08:00 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 9DB4 96 KB
29 KB 27ms
14ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-analytics-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

239733db63c823ff0f27720321732ff16ae6591fd0a41b6793ee665e9226b42f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 94021
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29503
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 08:59:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "59cc65a87e598f8b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 08:59:51 GMT

GET
H3-Q050 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 9DB4 4 KB
2 KB 29ms
15ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-fit-text-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82f60467c442f1292050ac1673c3074047283bfd9ff9be7480a65fddf6a24969

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93532
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1805
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:08:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d5686bc7b82e539c"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:08:00 GMT

GET
H3-Q050 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 9DB4 47 KB
14 KB 28ms
15ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-form-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f34e56bbdec33105361cc35f3805704b6d3df415b0bf044ef2a6f11764bd8a20

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93994
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14600
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:00:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9a6f012caf7a1c6f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:00:18 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9DB4 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 23:34:19 GMT
x-content-type-options: nosniff
server: cafe
age: 41553
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 23:34:19 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9DB4 295 B
319 B 7ms
6ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 47611
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 07 Oct 2020 21:53:21 GMT

GET
H3-Q050 200 9218822267371636908
tpc.googlesyndication.com/simgad/ Frame 9DB4 33 KB
33 KB 8ms
7ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9218822267371636908?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkTcHHEVVwGrZM4X6M3S4BuxiqH7g

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bdc060cb39aca616d2973647b7d55b2c5e7a8cfc41ca8b81370a68bfa4461b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 19:24:37 GMT
x-content-type-options: nosniff
last-modified: Thu, 01 Oct 2020 09:05:11 GMT
server: sffe
age: 56535
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34074
x-xss-protection: 0
expires: Wed, 06 Oct 2021 19:24:37 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 9DB4 0
0 14ms
14ms Image
text/html 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTRgBzN4FtJNjEnJH8JVyjDYC5zqli8wLGshuVvEsMxPAP9ITVpItGnCGxXPRMDzATQ1Qjm
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9DB4 0
0 39ms
39ms Image
text/html 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CDzS5S6F9X_3WItHl7gOO-Kx4x5SMxF_-o6izqAyWgs2FiBYQASDRh9IgYPWVzoHgBKAByeyrhwPIAQKpAght91njR7I-4AIAqAMByAMIqgSuA0_QVLe5EBkkOEwT9ufyXO2sxA0o6Ou70EpMpcYQNmJvPIOygOdLgEbTgBjJCXmoAL7zTFYOeah_6j5n-Nb-CJo8lJvMoDQRipZEoxOIXV-zWQZAQ0D5LxLghvosQhGGiqE3YHgTs27Gn29tDyVQ7-Dx0B5kwqSeSbtLF7gNne-wLI6-dadx7YYIu0HkgWhRHSsdsooWobwudT1o_YuWxN9eW5OYOtuzFJR8dSzoI249Ze_StaFsFOGJfqbpsTh-1DVHR7LaMPJR391sAZu-uFDKUPhP8iDGqe58ZmEl-xu73EX7EtAH1nRmV5ExEvq_1mcY7nGvB4AClCuOiiHDK07OeNsTCk282mI5iudmNOuPkh67N7hnT6JC9qqoXcXrUjVTyMY7Fs-azFEG9oXj8gdhet51sySz5-jP-B51j8wiR89jnUNYle5f_nT_3iDk9OdSUzE864TAJR8o22aAMS7W1LIwiq0sC70g8QrBImfzNbaghfDiGFKvUuesrNW76jIaQYGFmvDPWz6qtDWsTEd-1EmHqEUWP1S0xhOAmxjtWq71JPupEhaAjbnF4cXABI_imumoA-AEAZIFBAgEGAGSBQQIBRgEoAYCgAf_-dI2qAeOzhuoB9XJG6gHk9gbqAe6BqgH8NkbqAfy2RuoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEKGJGNIICQiA4YBAEAEYHfIIG2FkeC1zdWJzeW4tNzI2MzU3MzQ0NjgwNDA3OIAKA8gLAbIMFHB1Yi05Njg1NzM0NDQ1NDc2ODE02BMN&sigh=IfYaeCVSvMg&tpd=AGWhJms1Vw5JSM1T4xQs_ZkhLKkwSKHEqAxZBk_a0USS-VXZHA
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.23.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s18-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 9DB4 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ecfa64a701a71b3e640b8806d0a0f43753d7c53a1fafd8e773dc2c8620bca38

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ef0cc99ae155124895f712a9b68285f7b0a8c3f3c151e86107a25b61cf22085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1601061966610483"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6293
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:06:52 GMT

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 9CD0 11 KB
11 KB 27ms
13ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 14:47:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 73140
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Wed, 06 Oct 2021 14:47:52 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 9CD0 11 KB
11 KB 26ms
13ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 11:04:06 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 172966
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Tue, 05 Oct 2021 11:04:06 GMT

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012009282107000/ Frame 7C43 206 KB
56 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33901d23b88c104fc2e9d2d029542d2c89eb30dff24f698f339a175d3a4267fa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93534
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57253
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:07:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0138da5df6f877a3"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:07:58 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 7C43 16 KB
6 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-ad-exit-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00e1ffbde89afc301abf43ed68bc52d7d7bae9f81d0bd93638394f4e287b12f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93532
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5763
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:08:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0dd94cdacc228659"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:08:00 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 7C43 96 KB
29 KB 13ms
10ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-analytics-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

239733db63c823ff0f27720321732ff16ae6591fd0a41b6793ee665e9226b42f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 94021
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29503
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 08:59:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "59cc65a87e598f8b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 08:59:51 GMT

GET
H3-Q050 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 7C43 4 KB
2 KB 15ms
12ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-fit-text-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82f60467c442f1292050ac1673c3074047283bfd9ff9be7480a65fddf6a24969

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93532
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1805
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:08:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d5686bc7b82e539c"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:08:00 GMT

GET
H3-Q050 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 7C43 47 KB
14 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-form-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f34e56bbdec33105361cc35f3805704b6d3df415b0bf044ef2a6f11764bd8a20

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 93994
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14600
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 09:00:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9a6f012caf7a1c6f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 09:00:18 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 7C43 7 KB
1 KB 37ms
20ms Stylesheet
text/css 2a00:1450:4001:81b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d3838febe02ee1538a1336ac01f452a6fe7682106cd21b46cda9c40092c8e3aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 07 Oct 2020 09:18:50 GMT
server: ESF
date: Wed, 07 Oct 2020 11:06:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Oct 2020 11:06:52 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 7C43 5 KB
687 B 37ms
20ms Stylesheet
text/css 2a00:1450:4001:81b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 07 Oct 2020 09:07:32 GMT
server: ESF
date: Wed, 07 Oct 2020 11:06:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Oct 2020 11:06:52 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/10254325216188902687/ Frame 7C43 16 KB
16 KB 97ms
95ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10254325216188902687/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIqgIQqgIYASABLQAAAD8wqgI4qgJFAACAPw&rs=AOga4qll2DZsvgwAgOUrVgvq2wRHx2dmCw

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ce7cfe7e2321139641863f7800584777bc76f66b58b52245c36ba4551168f29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 08 May 2020 09:08:31 GMT
server: sffe
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16118
x-xss-protection: 0
expires: Thu, 07 Oct 2021 11:06:52 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5430776376497345576/ Frame 7C43 16 KB
17 KB 11ms
9ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5430776376497345576/downsize_200k_v1?sqp=4sqPyQR5QncIABIUDc3MzD4VAAAAQB0AAAAAJQAAAAAYACIKDQAAgD8VAACAPypPCFoQAR0AALRCIAEoATAGOANAgMLXL0gAUABYAGBacAJ4AIABAIgBAJABAJ0BAACAP6ABAKgBALABgK3iBLgB____________AcUBLbKdPg&rs=AOga4qlEdWtEhh92Oa9a3Khz6IceqsBhfw

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46f23e01311f1209f618ed0b6e79960ed2a26f6931c5edcdf7f0509e7f8a2e4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 09:49:58 GMT
x-content-type-options: nosniff
last-modified: Thu, 23 Aug 2018 15:35:20 GMT
server: sffe
age: 177414
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16849
x-xss-protection: 0
expires: Tue, 05 Oct 2021 09:49:58 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7C43 0
0 41ms
39ms Image
text/html 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CjyQFS6F9X_7WItHl7gOO-Kx457-2gV_Zt8qD7Avc2R4QASDRh9IgYPWVzoHgBKAB3IGX3QPIAQapAilrAVhWsbM-4AIAqAMByAMKqgSrA0_QBaWWeMoMB8MJicCDh6ptF_j1EhcAhZ69dpECICPTxdcqUX0h4FUGxJCmyLI_XnQFkGO-LqG29KOkz03kHH58yBPqy_oRmDDWaBccQPEjw2-kH7KGlTaHUwIPG4jU6K1430NBIRw8IT3TABlmMLYYjA2mDrf3NdwI3kq4wJy_jd7AZ5PmYzstfnuZMwYUrlqlScswwsyaNH4to0dwgQNirSCE6X7lkSqDykhn3-DhRp0I2-CpiXE6K9W_K5KgM53v5diRS8aWZtZ5TDO6_kDD4NDEaCyY2VN9r4SeT6UxPj-MCksslcNpjnQoeeM1QPE7XO0XYHP_2GNA9jgaj3CtUJj_TJmthe133slDIocOoJfp6DxoV9f_h0fITswg9982o4n9AUTVCAxfvrszxd4FFKCANn28A3EjOcWJfNRG_RyAOJl3DzhxhBBEoYPnv2PWc4ZvEoms4nAvZd1AefClmyNUmRErZS9aM9pXD-lO0icB8uzHFWID_djQ7R9H0f8F0Z0-72bJWZwBlkgrb0YKFOcW3PyifqfsDmGfUGuW-TmTwgBXU9azpufABJrfhNaaA-AEAaAGN4AHjP7oIqgHjs4bqAfVyRuoB5PYG6gHugaoB_DZG6gH8tkbqAfulrECqAemvhuoB-zVG9gHAfIHBBDj2yDSCAkIgOGAQBABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwGyDBRwdWItOTY4NTczNDQ0NTQ3NjgxNNgTA4gUAQ&sigh=HMUQq6VzBF8&template_id=492&tpd=AGWhJmsCmVnDbAGSXXzgiueeX9u60gIlvRRC9SUtl7qr6JrY4w
Requested by: Host: threatpost.com
URL: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.23.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s18-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7C43 2 KB
2 KB 10ms
8ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 23:34:19 GMT
x-content-type-options: nosniff
server: cafe
age: 41553
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 23:34:19 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7C43 295 B
320 B 10ms
8ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 47611
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 07 Oct 2020 21:53:21 GMT

GET
DATA 200
OK truncated
/ Frame 7C43 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60f4bee6c11ccdbfdc12e297a909d4b22b043a5ed5be0450960f4a1e7181b1b6

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2C09 0
0 38ms
38ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvH0alI4Wz_0u6bkvUduRjrUKBC77iM4A_X-qAYLUwPbpwTITOfUnq0zjIQDQG75ByHLg8lMG0lvtSoezDxr0z655lQe9MY_VjYFUeMqphHHBZGnPLb7iGlIp0-SJsLLtcSobcUIWMSDGnMNPDMX0Ko9wqp1_SUwvD237YzBR7sJCAdQ_JwvXX8FFQm-nHhgcY8_GewznjNBPRWCBL6Ce0-ZsJ3rigOwy8wzie9WW136rnpG8rzEqnHm5HJSnbl84yEKCm6A6VQgTrrbIC3bg&sai=AMfl-YSqEEOfHF-2uQx4JzbxGgxTwCuEx8ll3KEU5vOcE83X9OHdJRgD0VIiSRYMB10x3Pg4ZTqPFE7RoCH8r2IYNf-yqkrllZAbK94qXCyMD8Z7rDgWD42H8SsdyuiuMZpk&sig=Cg0ArKJSzDcF6FJ2_0L_EAE&adurl=

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f130.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 07 Oct 2020 11:06:52 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2C09 0
21 B 37ms
36ms Image
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst5kEhTin9sx1qmYszzXNvAQTNH23p6ctPbB0HTUOBTfA0hA55tXSDohlyGq8BM09eOc9oJZNrwG9o3dR0h_QifRcn1XNWCQMS4-xJAWGbBgwytveDtJyq6HIm9qiOlqaeUPHOUKTVCt8qctgL44TZPUchk_I9EwGezumTv-DHpl2xkvRsusb54uEeng8MJM2V_w-4WVMce_7XnsIQ5Xmx2o-R6QwyXgI4ZxgJg8JuStuAf58mq8gZ3-Wh6DSjmnRT2UXQ1-rvLi4OpGSgvc3wR&sai=AMfl-YQv1DkJwjQB2xmu1CH4vb-MzX-5oHky3tRfs7sS2B8IchZmmOOJ0TSuOpOJrLAcMr2BBkEJ8G6PEIQD-lQwE1FbK_FiumZC5C7SZpCGFDFhEU9Jynu3cF-gETasJSyD&sig=Cg0ArKJSzIcOsGQwGLiEEAE&adurl=

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f130.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 07 Oct 2020 11:06:52 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2C09 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4dfa3a43d01512ef5180464359b4272bf14570f2fcfd26904a400b0664d7fd71

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 7C43 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 11:04:06 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 172966
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Tue, 05 Oct 2021 11:04:06 GMT

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 7C43 11 KB
11 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 14:47:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 73140
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Wed, 06 Oct 2021 14:47:52 GMT

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
426 B 37ms
35ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vY292aWQtMTktY2xpbmljYWwtdHJpYWxzLXJhbnNvbXdhcmUvMTU5ODc3Lz9faHNtaT04ODk3NDc0NCZfaHNlbmM9cDJBTnF0ei1fckR5Y3lJdzRJYmtSVnhOYk1lcE9yYUlscFFGYW11UlVzNVhGeE9MaGRLc3BNWEZyU0M3QkJXMDVUZ2k3M1EyTE5pQ0JkOEZZVm9oYnV3SG9USzI4ekgtU21Gc1RXX1lWT29CWnJ1X1hlX1JWcEIwNCIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTk3MHgyNTAtQVRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDU5NDU1OTc1MiIsImNhbXBhaWduSWQiOiIyNjU0MDI1MDM5IiwiY3JlYXRpdmVJZCI6IjEzODMwMTUzNDE5OCIsImxpbmVpdGVtSWQiOiI1Mjc2MDQ3MzgyIiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjcyOCwiaGVpZ2h0Ijo5MCwid3YiOiIxLjAuMCs5YTRmN2NlIiwiYnYiOiIxLjAuMCs5YTRmN2NlIiwidGFnTWFya3VwIjoiPGh0bWwgYW1wNGFkcz1cIlwiIGNsYXNzPVwiaS1hbXBodG1sLWluYWJveCBpLWFtcGh0bWwtc2luZ2xlZG9jIGktYW1waHRtbC1zdGFuZGFsb25lIGktYW1waHRtbC1pZnJhbWVkXCIgaS1hbXBodG1sLWxheW91dD1cIlwiIGktYW1waHRtbC1uby1ib2lsZXJwbGF0ZT1cIlwiIGFtcC12ZXJzaW9uPVwiMjAwOTI4MjEwNzAwMFwiPjxoZWFkPjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYmwtMDRhMzM4NS1jNmQxMGY1Ni5qc1wiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD48c2NyaXB0IHNyYz1cImh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2ItOWE0ZjdjZS1hN2Y2MDk4Yy5qc1wiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD48c2NyaXB0PndpbmRvd1tcIjM1Njk3NjQyX21hdGgtYWlkcy10aHJlYXRwb3N0XCJdID0gd2luZG93W1wiMzU2OTc2NDJfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0gfHwge307d2luZG93W1wiMzU2OTc2NDJfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0udGFnRGV0YWlscyA9IHdpbmRvd1tcIjM1Njk3NjQyX21hdGgtYWlkcy10aHJlYXRwb3N0XCJdLnRhZ0RldGFpbHMgfHwge1wic2l0ZUlkXCI6XCJtYXRoLWFpZHMtdGhyZWF0cG9zdFwiLFwid3ZcIjpcIjEuMC4wKzlhNGY3Y2VcIixcInRvcERvbWFpblwiOlwiaHR0cHM6Ly90aHJlYXRwb3N0LmNvbS9jb3ZpZC0xOS1jbGluaWNhbC10cmlhbHMtcmFuc29td2FyZS8xNTk4NzcvP19oc21pPTg4OTc0NzQ0Jl9oc2VuYz1wMkFOcXR6LV9yRHljeUl3NElia1JWeE5iTWVwT3JhSWxwUUZhbXVSVXM1WEZ4T0xoZEtzcE1YRnJTQzdCQlcwNVRnaTczUTJMTmlDQmQ4RllWb2hidXdIb1RLMjh6SC1TbUZzVFdfWVZPb0JacnVfWGVfUlZwQjA0XCIsXCJjdXJyZW50VGFnSWRcIjpcImFkbHRhZ19rZnphZW1ydl90NjlaUlgya1hUOFwiLFwiYXVcIjpcIi8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTk3MHgyNTAtQVRGXzBcIixcInNsb3RFbGVtZW50SWRcIjpcImRpdi1ncHQtYWQtNjc5NDY3MC0yXCIsXCJhZFNlcnZlckRldGFpbHNcIjp7XCJhZHZlcnRpc2VySWRcIjpcIjQ1OTQ1NTk3NTJcIixcImNhbXBhaWduSWRcIjpcIjI2NTQwMjUwMzlcIixcImNyZWF0aXZlSWRcIjpcIjEzODMwMTUzNDE5OFwiLFwibGluZWl0ZW1JZFwiOlwiNTI3NjA0NzM4MlwiLFwiYWRTZXJ2ZXJcIjpcImRmcFwifSxcIndcIjo3MjgsXCJoXCI6OTB9O3dpbmRvdy5ibG9ja2VyICYmIGJsb2NrZXIoXCIzNTY5NzY0Ml9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiLCBcIjwhLS1BRExfV1JBUFBFRC0tPlwiLCBmYWxzZSwgd2luZG93LCB7fSk7PC9zY3JpcHQ%2BPG1ldGEgbmFtZT1cInJlZmVycmVyXCIgY29udGVudD1cIm9yaWdpblwiPjxtZXRhIGh0dHAtZXF1aXY9XCJDb250ZW50LVNlY3VyaXR5LVBvbGljeVwiIGNvbnRlbnQ9XCJzY3JpcHQtc3JjIGh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnLztvYmplY3Qtc3JjICdub25lJztjaGlsZC1zcmMgYmxvYjo7ZnJhbWUtc3JjICdub25lJ1wiPjxtZXRhIGNoYXJzZXQ9XCJ1dGYtOFwiPjxzdHlsZSBhbXAtcnVudGltZT1cIlwiIGktYW1waHRtbC12ZXJzaW9uPVwiMDEyMDA5MjgyMTA3MDAwXCI%2BW2hpZGRlbl17ZGlzcGxheTpub25lIWltcG9ydGFudH0uaS1hbXBodG1sLWVsZW1lbnR7ZGlzcGxheTppbmxpbmUtYmxvY2t9LmktYW1waHRtbC1ibHVycnktcGxhY2Vob2xkZXJ7dHJhbnNpdGlvbjpvcGFjaXR5IDAuM3MgY3ViaWMtYmV6aWVyKDAuMCwwLjAsMC4yLDEpIWltcG9ydGFudDtwb2ludGVyLWV2ZW50czpub25lfVtsYXlvdXQ9bm9kaXNwbGF5XTpub3QoLmktYW1waHRtbC1lbGVtZW50KXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtbGF5b3V0LWZpeGVkLFtsYXlvdXQ9Zml4ZWRdW3dpZHRoXVtoZWlnaHRdOm5vdCguaS1hbXBodG1sLWxheW91dC1maXhlZCl7ZGlzcGxheTppbmxpbmUtYmxvY2s7cG9zaXRpb246cmVsYXRpdmV9LmktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSxbbGF5b3V0PXJlc3BvbnNpdmVdW3dpZHRoXVtoZWlnaHRdOm5vdCguaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlKSxbd2lkdGhdW2hlaWdodF1baGVpZ2h0c106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSksW3dpZHRoXVtoZWlnaHRdW3NpemVzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlKXtkaXNwbGF5OmJsb2NrO3Bvc2l0aW9uOnJlbGF0aXZlfS5pLWFtcGh0bWwtbGF5b3V0LWludHJpbnNpYyxbbGF5b3V0PWludHJpbnNpY11bd2lkdGhdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWludHJpbnNpYyl7ZGlzcGxheTppbmxpbmUtYmxvY2s7cG9zaXRpb246cmVsYXRpdmU7bWF4LXdpZHRoOjEwMCV9LmktYW1waHRtbC1sYXlvdXQtaW50cmluc2ljIC5pLWFtcGh0bWwtc2l6ZXJ7bWF4LXdpZHRoOjEwMCV9LmktYW1waHRtbC1pbnRyaW5zaWMtc2l6ZXJ7bWF4LXdpZHRoOjEwMCU7ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9LmktYW1waHRtbC1sYXlvdXQtY29udGFpbmVyLC5pLWFtcGh0bWwtbGF5b3V0LWZpeGVkLWhlaWdodCxbbGF5b3V0PWNvbnRhaW5lcl0sW2xheW91dD1maXhlZC1oZWlnaHRdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWZpeGVkLWhlaWdodCl7ZGlzcGxheTpibG9jaztwb3NpdGlvbjpyZWxhdGl2ZX0uaS1hbXBodG1sLWxheW91dC1maWxsLC5pLWFtcGh0bWwtbGF5b3V0LWZpbGwuaS1hbXBodG1sLW5vdGJ1aWx0LFtsYXlvdXQ9ZmlsbF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWZpbGwpe2Rpc3BsYXk6YmxvY2s7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDtwb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtsZWZ0OjA7Ym90dG9tOjA7cmlnaHQ6MH0uaS1hbXBodG1sLWxheW91dC1mbGV4LWl0ZW0sW2xheW91dD1mbGV4LWl0ZW1dOm5vdCguaS1hbXBodG1sLWxheW91dC1mbGV4LWl0ZW0pe2Rpc3BsYXk6YmxvY2s7cG9zaXRpb246cmVsYXRpdmU7LW1zLWZsZXg6MSAxIGF1dG87ZmxleDoxIDEgYXV0b30uaS1hbXBodG1sLWxheW91dC1mbHVpZHtwb3NpdGlvbjpyZWxhdGl2ZX0uaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWR7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudH0uaS1hbXBodG1sLWxheW91dC1hd2FpdGluZy1zaXple3Bvc2l0aW9uOmFic29sdXRlIWltcG9ydGFudDt0b3A6YXV0byFpbXBvcnRhbnQ7Ym90dG9tOmF1dG8haW1wb3J0YW50fWktYW1waHRtbC1zaXplcntkaXNwbGF5OmJsb2NrIWltcG9ydGFudH1Ac3VwcG9ydHMgKGFzcGVjdC1yYXRpbzoxLzEpe2ktYW1waHRtbC1zaXplci5pLWFtcGh0bWwtZGlzYWJsZS1mb3ItYXJ7ZGlzcGxheTpub25lIWltcG9ydGFudH19LmktYW1waHRtbC1ibHVycnktcGxhY2Vob2xkZXIsLmktYW1waHRtbC1maWxsLWNvbnRlbnR7ZGlzcGxheTpibG9jaztoZWlnaHQ6MDttYXgtaGVpZ2h0OjEwMCU7bWF4LXdpZHRoOjEwMCU7bWluLWhlaWdodDoxMDAlO21pbi13aWR0aDoxMDAlO3dpZHRoOjA7bWFyZ2luOmF1dG99LmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIC5pLWFtcGh0bWwtZmlsbC1jb250ZW50e3Bvc2l0aW9uOmFic29sdXRlO3RvcDowO2xlZnQ6MDtib3R0b206MDtyaWdodDowfS5pLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudCwuaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7cGFkZGluZzowIWltcG9ydGFudDtib3JkZXI6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVye3Bvc2l0aW9uOmZpeGVkIWltcG9ydGFudDt0b3A6MHB4IWltcG9ydGFudDtsZWZ0OjBweCFpbXBvcnRhbnQ7d2lkdGg6NHB4IWltcG9ydGFudDtoZWlnaHQ6NHB4IWltcG9ydGFudDtvcGFjaXR5OjAhaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7bWFyZ2luOjAhaW1wb3J0YW50O2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50O3Zpc2liaWxpdHk6dmlzaWJsZSFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcntsZWZ0OjhweCFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDoxMnB4IWltcG9ydGFudH0uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ%2BLmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDoxNnB4IWltcG9ydGFudH0uaS1hbXBodG1sLXVucmVzb2x2ZWR7cG9zaXRpb246cmVsYXRpdmU7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudH0uaS1hbXBodG1sLXNlbGVjdC1kaXNhYmxlZHstd2Via2l0LXVzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50Oy1tb3otdXNlci1zZWxlY3Q6bm9uZSFpbXBvcnRhbnQ7LW1zLXVzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50O3VzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtbm90YnVpbHQsW2xheW91dF06bm90KC5pLWFtcGh0bWwtZWxlbWVudCksW3dpZHRoXVtoZWlnaHRdW2hlaWdodHNdOm5vdChbbGF5b3V0XSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCksW3dpZHRoXVtoZWlnaHRdW3NpemVzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpe3Bvc2l0aW9uOnJlbGF0aXZlO292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7Y29sb3I6dHJhbnNwYXJlbnQhaW1wb3J0YW50fS5pLWFtcGh0bWwtbm90YnVpbHQ6bm90KC5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lcik%2BKixbbGF5b3V0XTpub3QoW2xheW91dD1jb250YWluZXJdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT4qLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpPiosW3dpZHRoXVtoZWlnaHRdW3NpemVzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpPip7ZGlzcGxheTpub25lfWFtcC1pbWc6bm90KC5pLWFtcGh0bWwtZWxlbWVudClbaS1hbXBodG1sLXNzcl0%2BaW1nLmktYW1waHRtbC1maWxsLWNvbnRlbnR7ZGlzcGxheTpibG9ja30uaS1hbXBodG1sLW5vdGJ1aWx0Om5vdCguaS1hbXBodG1sLWxheW91dC1jb250YWluZXIpLFtsYXlvdXRdOm5vdChbbGF5b3V0PWNvbnRhaW5lcl0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KXtjb2xvcjp0cmFuc3BhcmVudCFpbXBvcnRhbnQ7bGluZS1oZWlnaHQ6MCFpbXBvcnRhbnR9LmktYW1waHRtbC1naG9zdHt2aXNpYmlsaXR5OmhpZGRlbiFpbXBvcnRhbnR9LmktYW1waHRtbC&i=1-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: DeotcE_fWtZdDF0BAo_9DyF6ty8HdM8f_U6HqEqZMffRO3FbsBTfbg==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
426 B 39ms
36ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=1lbGVtZW50PltwbGFjZWhvbGRlcl0sW2xheW91dF06bm90KC5pLWFtcGh0bWwtZWxlbWVudCk%2BW3BsYWNlaG9sZGVyXSxbd2lkdGhdW2hlaWdodF1baGVpZ2h0c106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT5bcGxhY2Vob2xkZXJdLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT5bcGxhY2Vob2xkZXJde2Rpc3BsYXk6YmxvY2t9LmktYW1waHRtbC1lbGVtZW50PltwbGFjZWhvbGRlcl0uYW1wLWhpZGRlbiwuaS1hbXBodG1sLWVsZW1lbnQ%2BW3BsYWNlaG9sZGVyXS5oaWRkZW57dmlzaWJpbGl0eTpoaWRkZW59LmktYW1waHRtbC1lbGVtZW50Om5vdCguYW1wLW5vdHN1cHBvcnRlZCk%2BW2ZhbGxiYWNrXSwuaS1hbXBodG1sLWxheW91dC1jb250YWluZXI%2BW3BsYWNlaG9sZGVyXS5hbXAtaGlkZGVuLC5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lcj5bcGxhY2Vob2xkZXJdLmhpZGRlbntkaXNwbGF5Om5vbmV9LmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkPltmYWxsYmFja10sLmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkPltwbGFjZWhvbGRlcl17cG9zaXRpb246YWJzb2x1dGUhaW1wb3J0YW50O3RvcDowIWltcG9ydGFudDtsZWZ0OjAhaW1wb3J0YW50O3JpZ2h0OjAhaW1wb3J0YW50O2JvdHRvbTowIWltcG9ydGFudDt6LWluZGV4OjF9LmktYW1waHRtbC1ub3RidWlsdD5bcGxhY2Vob2xkZXJde2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fS5pLWFtcGh0bWwtaGlkZGVuLWJ5LW1lZGlhLXF1ZXJ5e2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50LWVycm9ye2JhY2tncm91bmQ6cmVkIWltcG9ydGFudDtjb2xvcjojZmZmIWltcG9ydGFudDtwb3NpdGlvbjpyZWxhdGl2ZSFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50LWVycm9yOmJlZm9yZXtjb250ZW50OmF0dHIoZXJyb3ItbWVzc2FnZSl9aS1hbXAtc2Nyb2xsLWNvbnRhaW5lcixpLWFtcGh0bWwtc2Nyb2xsLWNvbnRhaW5lcntwb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtsZWZ0OjA7cmlnaHQ6MDtib3R0b206MDtkaXNwbGF5OmJsb2NrfWktYW1wLXNjcm9sbC1jb250YWluZXIuYW1wLWFjdGl2ZSxpLWFtcGh0bWwtc2Nyb2xsLWNvbnRhaW5lci5hbXAtYWN0aXZle292ZXJmbG93OmF1dG87LXdlYmtpdC1vdmVyZmxvdy1zY3JvbGxpbmc6dG91Y2h9LmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lcntkaXNwbGF5OmJsb2NrIWltcG9ydGFudDtwb2ludGVyLWV2ZW50czpub25lO3otaW5kZXg6MX0uaS1hbXBodG1sLW5vdGJ1aWx0Pi5pLWFtcGh0bWwtbG9hZGluZy1jb250YWluZXJ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9LmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lci5hbXAtaGlkZGVue3Zpc2liaWxpdHk6aGlkZGVufS5pLWFtcGh0bWwtZWxlbWVudD5bb3ZlcmZsb3dde2N1cnNvcjpwb2ludGVyO3Bvc2l0aW9uOnJlbGF0aXZlO3otaW5kZXg6Mjt2aXNpYmlsaXR5OmhpZGRlbjtkaXNwbGF5OmluaXRpYWw7bGluZS1oZWlnaHQ6bm9ybWFsfS5pLWFtcGh0bWwtZWxlbWVudD5bb3ZlcmZsb3ddLmFtcC12aXNpYmxle3Zpc2liaWxpdHk6dmlzaWJsZX10ZW1wbGF0ZXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fS5hbXAtYm9yZGVyLWJveCwuYW1wLWJvcmRlci1ib3ggKiwuYW1wLWJvcmRlci1ib3ggOmFmdGVyLC5hbXAtYm9yZGVyLWJveCA6YmVmb3Jle2JveC1zaXppbmc6Ym9yZGVyLWJveH1hbXAtcGl4ZWx7ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtYW5hbHl0aWNzLGFtcC1hdXRvLWFkcyxhbXAtc3RvcnktYXV0by1hZHN7cG9zaXRpb246Zml4ZWQhaW1wb3J0YW50O3RvcDowIWltcG9ydGFudDt3aWR0aDoxcHghaW1wb3J0YW50O2hlaWdodDoxcHghaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7dmlzaWJpbGl0eTpoaWRkZW59aHRtbC5pLWFtcGh0bWwtZmllPmFtcC1hbmFseXRpY3N7cG9zaXRpb246aW5pdGlhbCFpbXBvcnRhbnR9W3Zpc2libGUtd2hlbi1pbnZhbGlkXTpub3QoLnZpc2libGUpLGZvcm0gW3N1Ym1pdC1lcnJvcl0sZm9ybSBbc3VibWl0LXN1Y2Nlc3NdLGZvcm0gW3N1Ym1pdHRpbmdde2Rpc3BsYXk6bm9uZX1hbXAtYWNjb3JkaW9ue2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fWFtcC1hY2NvcmRpb24%2Bc2VjdGlvbntmbG9hdDpub25lIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uPnNlY3Rpb24%2BKntmbG9hdDpub25lIWltcG9ydGFudDtkaXNwbGF5OmJsb2NrIWltcG9ydGFudDtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uLGFtcC1hY2NvcmRpb24%2Bc2VjdGlvbnttYXJnaW46MH1hbXAtYWNjb3JkaW9uPnNlY3Rpb24%2BOmxhc3QtY2hpbGR7ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uPnNlY3Rpb25bZXhwYW5kZWRdPjpsYXN0LWNoaWxke2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fVxuLyojIHNvdXJjZVVSTD0vY3NzL2FtcHNoYXJlZC5jc3MqL2h0bWwuaS1hbXBodG1sLWluYWJveHt3aWR0aDoxMDAlIWltcG9ydGFudDtoZWlnaHQ6MTAwJSFpbXBvcnRhbnR9PC9zdHlsZT48bWV0YSBjb250ZW50PVwid2lkdGg9ZGV2aWNlLXdpZHRoLG1pbmltdW0tc2NhbGU9MSxpbml0aWFsLXNjYWxlPTFcIiBuYW1lPVwidmlld3BvcnRcIj48bWV0YSBjb250ZW50PVwidmVuZG9yPWRvdWJsZWNsaWNrLHR5cGU9aW1wcmVzc2lvbi1pZCx2YWx1ZT1DTHlvcmJPcm91d0NGZEd5ZXdvZERqd0xEd1wiIG5hbWU9XCJhbXA0YWRzLWlkXCI%2BPGxpbmsgYXM9XCJzY3JpcHRcIiBocmVmPVwiaHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvcnR2LzAxMjAwOTI4MjEwNzAwMC9hbXA0YWRzLXYwLmpzXCIgcmVsPVwicHJlbG9hZFwiPjxzY3JpcHQgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDA5MjgyMTA3MDAwL2FtcDRhZHMtdjAuanNcIj48L3NjcmlwdD48c2NyaXB0IGFzeW5jPVwiXCIgY3VzdG9tLWVsZW1lbnQ9XCJhbXAtYWQtZXhpdFwiIHNyYz1cImh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDkyODIxMDcwMDAvdjAvYW1wLWFkLWV4aXQtMC4xLmpzXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYz1cIlwiIGN1c3RvbS1lbGVtZW50PVwiYW1wLWFuYWx5dGljc1wiIHNyYz1cImh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDkyODIxMDcwMDAvdjAvYW1wLWFuYWx5dGljcy0wLjEuanNcIj48L3NjcmlwdD48c2NyaXB0IGFzeW5jPVwiXCIgY3VzdG9tLWVsZW1lbnQ9XCJhbXAtZml0LXRleHRcIiBzcmM9XCJodHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDA5MjgyMTA3MDAwL3YwL2FtcC1maXQtdGV4dC0wLjEuanNcIj48L3NjcmlwdD48c2NyaXB0IGFzeW5jPVwiXCIgY3VzdG9tLWVsZW1lbnQ9XCJhbXAtZm9ybVwiIHNyYz1cImh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDkyODIxMDcwMDAvdjAvYW1wLWZvcm0tMC4xLmpzXCI%2BPC9zY3JpcHQ%2BPGxpbmsgaHJlZj1cImh0dHBzOi8vZm9udHMuZ29vZ2xlYXBpcy5jb20vY3NzP2ZhbWlseT1Sb2JvdG86NDAwLDUwMCZhbXA7bGFuZz1lblwiIHJlbD1cInN0eWxlc2hlZXRcIiB0eXBlPVwidGV4dC9jc3NcIj48bGluayBocmVmPVwiaHR0cHM6Ly9mb250cy5nb29nbGVhcGlzLmNvbS9jc3M%2FZmFtaWx5PVJvYm90bzo0MDAsNTAwJmFtcDt0ZXh0PVwiIHJlbD1cInN0eWxlc2hlZXRcIiB0eXBlPVwidGV4dC9jc3NcIj48c3R5bGUgYW1wLWN1c3RvbT1cIlwiPmF7Y29sb3I6IzAwODhmZn1ib2R5LHRhYmxlLGRpdix1bCxsaXttYXJnaW46MDtwYWRkaW5nOjB9Ym9keXtmb250LWZhbWlseTpBcmlhbCxhcmlhbCxzYW5zLXNlcmlmO30jYWR1bml0IHtvdmVyZmxvdzogaGlkZGVuO3dpZHRoOiA3MjhweDtoZWlnaHQ6IDkwcHg7cG9zaXRpb246IGFic29sdXRlO3RvcDogMDtsZWZ0OiAwO30jYWR1bml0IC5hZHMgLmFkIHtvdmVyZmxvdzogaGlkZGVuO30uYXR0cmlidXRpb24ge3otaW5kZXg6IDk5OTt9YW1wLWltZy5jb250YWluIGltZyB7b2JqZWN0LWZpdDogY29udGFpbjt9I2FkdW5pdCAjYWRzIC5pbWFnZSAuaW1hZ2UtbGluayB7d2lkdGg6IDE2OHB4O2hlaWdodDogODhweDtiYWNrZ3JvdW5kLWNvbG9yOiB0cmFuc3BhcmVudDtwb3NpdGlvbjogcmVsYXRpdmU7fWJvZHl7YmFja2dyb3VuZC1jb2xvcjojZmZmO2JvcmRlcjoxcHggc29saWQgI2RkZDtmb250LWZhbWlseTonUm9ib3RvJyxzYW5zLXNlcmlmO2ZvbnQtc2l6ZToxMnB4O2hlaWdodDo4OHB4O3Bvc2l0aW9uOnJlbGF0aXZlO3dpZHRoOjcyNnB4fS5hdHRyaWJ1dGlvbntiYWNrZ3JvdW5kLWNvbG9yOiNmZmY7Ym9yZGVyLXJhZGl1czoycHg7Ym94LXNoYWRvdzowIDFweCAycHggcmdiYSgwLDAsMCwuNSk7Zm9udC1zaXplOjExcHg7bGVmdDo0cHg7cGFkZGluZy1yaWdodDozcHg7cGFkZGluZy1sZWZ0OjNweDtwb3NpdGlvbjphYnNvbHV0ZTt0b3A6NHB4fS50aXRsZXtwYWRkaW5nLXJpZ2h0OjMwcHg7cGFkZGluZy10b3A6MTdweH0udGl0bGUgYXtjb2xvcjojMjEyMTIxO2ZvbnQtc2l6ZToyMHB4O2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjQ7dGV4dC1kZWNvcmF0aW9uOm5vbmV9LmltYWdle2Zsb2F0OmxlZnQ7cGFkZGluZy1yaWdodDoxNHB4O3dpZHRoOjE2OHB4fS5pbWFnZSBhbXAtaW1ne2hlaWdodDoxMDAlO3dpZHRoOjEwMCV9LmltYWdlIC5pbWFnZS1saW5re2hlaWdodDoxMDAlO3dpZHRoOjEwMCV9LmNhbGwtdG8tYWN0aW9ue2JvcmRlci1sZWZ0OjFweCBzb2xpZCAjZGRkO2Zsb2F0OnJpZ2h0O3BhZGRpbmctYm90dG9tOjM0cHg7cGFkZGluZy1sZWZ0OjMwcHg7cGFkZGluZy1yaWdodDozMHB4O3BhZGRpbmctdG9wOjM4cHh9LmNhbGwtdG8tYWN0aW9uIGF7Y29sb3I6IzQyODVmNDtmb250LXNpemU6MTRweDtmb250LXdlaWdodDo1MDA7dGV4dC1kZWNvcmF0aW9uOm5vbmV9LmxvZ297ZmxvYXQ6bGVmdDtwYWRkaW5nLXRvcDo1cHg7cGFkZGluZy1yaWdodDoxMHB4O3dpZHRoOjIzcHh9LmxvZ28gYW1wLWltZ3tkaXNwbGF5OmZsZXg7aGVpZ2h0OjEwMCU7d2lkdGg6MTAwJX0ubG9nbyAubG9nby1saW5re2hlaWdodDoxMDAlO3dpZHRoOjEwMCV9LmFkdmVydGlzZXJ7cGFkZGluZy10b3A6MTBweH0uYWR2ZXJ0aXNlciBhe2NvbG9yOiM3Nzc7Zm9udC1zaXplOjEycHg7Zm9udC13ZWlnaHQ6NDAwO3RleHQtZGVjb3JhdGlvbjpub25lfS5hZHMgLmltYWdlLWxpbmsge2Rpc3BsYXk6aW5saW5lLWJsb2NrfS5hZHMgLmltYWdlLWxpbmsgaW1nIHtkaXNwbGF5OmJsb2NrfS5yZXZpZXdzIHtsaW5lLWhlaWdodDowfS5ib2R5LWxpbmssLmJvZHktbGluazpob3ZlciwuYm9keS1saW5rOnZpc2l0ZWQge3RleHQtZGVjb3JhdGlvbjpub25lO2NvbG9yOmluaGVyaXR9LmFiZ2Mge3Bvc2l0aW9uOmFic29sdXRlO3otaW5kZXg6MjE0NzQ4MzY0NjtyaWdodDowO3RvcDowO30uYWJnYyBhbXAtaW1nLCAuYWJnYyBpbWcge2Rpc3BsYXk6YmxvY2s7fS5hYmdzIHtwb3NpdGlvbjphYnNvbHV0ZTstd2Via2l0LXRyYW5zZm9ybTp0cmFuc2xhdGVYKDc2cHgpO3RyYW5zZm9ybTp0cmFuc2xhdGVYKDc2cHgpO3JpZ2h0OjE2cHg7dG9wOjA7fS5hYmdjcCB7cG9zaXRpb246YWJzb2x1dGU7cmlnaHQ6MDt0b3A6MDt3aWR0aDozMXB4O2hlaWdodDoxNXB4O3BhZGRpbmctbGVmdDoxMHB4O3BhZGRpbmctYm90dG9tOjEwcHg7fS5hYmdiIHtwb3NpdGlvbjpyZWxhdGl2ZTttYXJnaW4tcmlnaHQ6MTZweDt0b3A6MDt9LmFiZ2M6aG92ZXIgLmFiZ3Mgey13ZWJraXQtdHJhbnNmb3JtOm5vbmU7dHJhbnNmb3JtOm5vbmU7fS5jYmIge2Rpc3BsYXk6IGJsb2NrO3Bvc2l0aW9uOiBhYnNvbHV0ZTtyaWdodDowO3RvcDowO2N1cnNvcjogcG9pbnRlcjtoZWlnaHQ6IDE1cHg7d2lkdGg6IDE1cHg7ei1pbmRleDogOTAyMDtwYWRkaW5nLWxlZnQ6MTZweDt9LmJ0biB7ZG&i=2-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: RfPnKkOPOUEu-bbLDRsHmbA3W1l5DwoO2T5ibOENeUlVuu_yWliTWQ==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
427 B 52ms
49ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=lzcGxheTogaW5saW5lLWJsb2NrO2JvcmRlci1yYWRpdXM6IDJweDstbW96LWJveC1zaXppbmc6IGJvcmRlci1ib3g7LXdlYmtpdC1ib3gtc2l6aW5nOiBib3JkZXItYm94O2JveC1zaXppbmc6IGJvcmRlci1ib3g7Ym94LXNoYWRvdzogMHB4IDBweCAycHggcmdiYSgwLDAsMCwwLjEyKSwgMHB4IDFweCAzcHggcmdiYSgwLDAsMCwwLjI2KTtjdXJzb3I6IHBvaW50ZXI7Zm9udC1zaXplOiAwLjdlbTttYXJnaW46IDAgMXB4IDAuNGVtIDFweDt9QG1lZGlhIChtYXgtd2lkdGg6IDM3NXB4KSBhbmQgKG1pbi1oZWlnaHQ6IDEwMHB4KSB7LmJ0biB7ZGlzcGxheTogYmxvY2s7d2lkdGg6IDkwJTttYXgtd2lkdGg6IDI0MHB4O21hcmdpbi1sZWZ0OiBhdXRvO21hcmdpbi1yaWdodDogYXV0bzt9fSNzcHYxIGFtcC1maXQtdGV4dD5kaXYgey13ZWJraXQtanVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O2p1c3RpZnktY29udGVudDogZmxleC1zdGFydDt9LmptLnNoICNzcHYxIGFtcC1maXQtdGV4dD5kaXYgey13ZWJraXQtanVzdGlmeS1jb250ZW50OiBjZW50ZXI7anVzdGlmeS1jb250ZW50OiBjZW50ZXI7fS5idG4gPiBzcGFuIHtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7cGFkZGluZzogMC41ZW0gMC42ZW07bGluZS1oZWlnaHQ6IDFlbTt9I3NidG4ge2JhY2tncm91bmQtY29sb3I6ICNGRkZGRkY7Y29sb3I6ICM5RTlFQTY7dGV4dC1kZWNvcmF0aW9uOiBub25lO30jc2J0bjpob3Zlciwjc2J0bjphY3RpdmUge2JhY2tncm91bmQtY29sb3I6ICNGNUY1RjU7fSNyYnRuIHtiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoNjYsMTMzLDI0NSk7Y29sb3I6IHdoaXRlO30jcmJ0bjpob3ZlciwjcmJ0bjphY3RpdmUge2JhY2tncm91bmQtY29sb3I6ICMzMjc1RTU7fSNtdGEge3Bvc2l0aW9uOmFic29sdXRlO3RvcDogMDtsZWZ0OiAwO2ZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjtmb250LXNpemU6IDEycHg7Zm9udC13ZWlnaHQ6IDQwMDtsaW5lLWhlaWdodDogMWVtO30jbXRhIGlucHV0W3R5cGU9XCJyYWRpb1wiXSB7ZGlzcGxheTogbm9uZTt9I210YSAucG4ge3JpZ2h0OiAtNzI4cHg7dG9wOiAtOTBweDt3aWR0aDo3MjhweDtoZWlnaHQ6OTBweDtwb3NpdGlvbjogYWJzb2x1dGU7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O2JhY2tncm91bmQtY29sb3I6ICNGQUZBRkE7dGV4dC1hbGlnbjogY2VudGVyO30jc3B2MiB7ZGlzcGxheTogLXdlYmtpdC1mbGV4O2Rpc3BsYXk6IGZsZXg7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7anVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0Oy13ZWJraXQtZmxleC13cmFwOiBub3dyYXA7ZmxleC13cmFwOiBub3dyYXA7b3ZlcmZsb3c6IGhpZGRlbjtiYWNrZ3JvdW5kLWNvbG9yOiAjRkFGQUZBO2ZvbnQtc2l6ZTogMDt9LnNoICNzcHYyIHstd2Via2l0LWZsZXgtZGlyZWN0aW9uOiByb3c7ZmxleC1kaXJlY3Rpb246IHJvdzstd2Via2l0LWp1c3RpZnktY29udGVudDogY2VudGVyO2p1c3RpZnktY29udGVudDogY2VudGVyO30uc2guc3IgI3NwdjIgey13ZWJraXQtanVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O2p1c3RpZnktY29udGVudDogZmxleC1zdGFydDt9LmptLnNoICNzcHYyIHstd2Via2l0LWFsaWduLWl0ZW1zOiBjZW50ZXI7YWxpZ24taXRlbXM6IGNlbnRlcjt9I3NwdjIgKiB7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O30jc3ByMTpjaGVja2VkIH4gI2NiYiwjc3ByMjpjaGVja2VkIH4gI2NiYiwjc3ByMzpjaGVja2VkIH4gI2NiYntkaXNwbGF5OiBub25lO30jc3B2MyB7b3BhY2l0eToxO30uYW1wLWFuaW1hdGUgI3NwdjQge29wYWNpdHk6MDt0cmFuc2l0aW9uOiBvcGFjaXR5IDAuNXMgbGluZWFyIDIuNXM7fS5hbXAtYW5pbWF0ZSAgI3NwdjMgYW1wLWZpdC10ZXh0IHtvcGFjaXR5OjE7dHJhbnNpdGlvbjogb3BhY2l0eSAwLjVzIGxpbmVhciAyczt9I3NwcjM6Y2hlY2tlZCB%2BICNzcHYzIGFtcC1maXQtdGV4dCB7b3BhY2l0eTowfSNzcHIzOmNoZWNrZWQgfiAjc3B2NCB7b3BhY2l0eToxO30jc3ByMTpjaGVja2VkIH4gI3NwdjEsI3NwcjI6Y2hlY2tlZCB%2BICNzcHYyLCNzcHIzOmNoZWNrZWQgfiAjc3B2Mywjc3ByMzpjaGVja2VkIH4gI3NwdjR7cmlnaHQ6IDBweDt0b3A6IDBweDt9LmNsb3NlIHtwb3NpdGlvbjogYWJzb2x1dGU7dG9wOiAycHg7Y29sb3I6IGJsYWNrO2ZvbnQtc2l6ZTogMTVweDtsaW5lLWhlaWdodDogMTVweDtvcGFjaXR5OiAwLjU7aGVpZ2h0OiAxNXB4O3dpZHRoOiAxNXB4O3VzZXItc2VsZWN0OiBub25lO2N1cnNvcjogcG9pbnRlcjt9W2Rpcj1cInJ0bFwiXSAuY2xvc2Uge3RyYW5zZm9ybTogc2NhbGVYKC0xKTt9LmN0IHN2ZyB7Ym9yZGVyOiAwO21hcmdpbjogMCAwIC0wLjQ1ZW0gMDtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7aGVpZ2h0OiAxLjM4ZW07b3BhY2l0eTogMC40O30uY3Qge2Rpc3BsYXk6IGlubGluZS1ibG9jaztsaW5lLWhlaWdodDogMS4yOGVtO2NvbG9yOiByZ2JhKDAsMCwwLDAuNCk7dGV4dC1hbGlnbjpjZW50ZXI7cGFkZGluZzogMC4zZW07fS5mY3Qge3BhZGRpbmc6IDFlbTt9I3BjdCB7ZGlzcGxheTogYmxvY2s7Zm9udC13ZWlnaHQ6IGJvbGQ7cGFkZGluZzogMWVtIDAuM2VtO30jdGkge3dpZHRoOiA3MjhweDt9I2J0bnMge3dpZHRoOiA3MjhweDt9LmZsIHt3aWR0aDogNzI4cHg7aGVpZ2h0OjkwcHg7fSNzaSB7cG9zaXRpb246IHJlbGF0aXZlO2Rpc3BsYXk6IGlubGluZS1ibG9jazttYXJnaW4tYm90dG9tOiAtMC4xNWVtO2hlaWdodDogMWVtO3dpZHRoOiAxZW07b3BhY2l0eTogMC40O30uc2Ige2ZsZXgtc2hyaW5rOiAwO2hlaWdodDogNTBweDt9LnNvIHtwb3NpdGlvbjogcmVsYXRpdmU7ei1pbmRleDogOTExMDtvdmVyZmxvdzogaGlkZGVuO2Rpc3BsYXk6IGlubGluZS1ibG9jaztwYWRkaW5nOiAxcHggNXB4O3dpZHRoOiA5NnB4O2hlaWdodDogNTBweDtib3JkZXI6IDFweCBzb2xpZCAjRTBFMEUwO2JhY2tncm91bmQtY29sb3I6ICNGRkZGRkY7Y3Vyc29yOiBwb2ludGVyO30uc286aG92ZXIsLnNvOmFjdGl2ZSB7YmFja2dyb3VuZC1jb2xvcjogI0Y1RjVGNTt9LnNvIGRpdiB7ZGlzcGxheTogLXdlYmtpdC1mbGV4O2Rpc3BsYXk6IGZsZXg7LXdlYmtpdC1hbGlnbi1pdGVtczogY2VudGVyO2FsaWduLWl0ZW1zOiBjZW50ZXI7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGNlbnRlcjtqdXN0aWZ5LWNvbnRlbnQ6IGNlbnRlcjt3aWR0aDogMTAwJTtoZWlnaHQ6IDEwMCU7fS5zbyBzcGFuIHtjb2xvcjogIzQyODVGNDtmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7dGV4dC1hbGlnbjogY2VudGVyO2ZvbnQtc2l6ZTogMTJweDtsaW5lLWhlaWdodDogMTRweDt3aGl0ZS1zcGFjZTogbm9ybWFsO31AbWVkaWEgKG1pbi1oZWlnaHQ6IDU0cHgpIHsuc2guc3MgLnNvLC5zdiAuc28ge2JveC1zaGFkb3c6IDBweCAwcHggMnB4IHJnYmEoMCwwLDAsMC4xMiksIDBweCAxcHggM3B4IHJnYmEoMCwwLDAsMC4yNik7Ym9yZGVyOiBub25lO319LnNoIC5zbyB7bWFyZ2luLWxlZnQ6IC0xcHg7Ym94LXNoYWRvdzogbm9uZTt9LnNoIC5zbzpmaXJzdC1jaGlsZCB7bWFyZ2luLWxlZnQ6IDA7fS5zaC5zcyAuc28ge21hcmdpbi1sZWZ0OiA4cHg7fS5zaC5zcyAuc286Zmlyc3QtY2hpbGQge21hcmdpbi1sZWZ0OiAwO30uc3YgLnNvLC5zaC5zcyAuc28ge2JvcmRlci1yYWRpdXM6IDJweDt9PC9zdHlsZT48bGluayByZWw9XCJwcmVjb25uZWN0XCIgaHJlZj1cImh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbVwiIHJlZmVycmVycG9saWN5PVwib3JpZ2luXCI%2BPC9oZWFkPjxib2R5IGNsYXNzPVwiYW1wLWFuaW1hdGUgYW1wLW1vZGUtbW91c2VcIiBtYXJnaW53aWR0aD1cIjBcIiBtYXJnaW5oZWlnaHQ9XCIwXCIgc3R5bGU9XCJvcGFjaXR5OiAxOyB2aXNpYmlsaXR5OiB2aXNpYmxlOyBhbmltYXRpb246IDBzIGVhc2UgMHMgMSBub3JtYWwgbm9uZSBydW5uaW5nIG5vbmU7XCI%2BPGRpdiBpZD1cImFkdW5pdFwiPjxkaXYgY2xhc3M9XCJhZHNcIiBpZD1cImFkc1wiPjxkaXYgY2xhc3M9XCJhZCBhZC0xXCIgaWQ9XCJ0YXcwXCI%2BPGRpdiBjbGFzcz1cImF0dHJpYnV0aW9uXCI%2BQWQ8L2Rpdj48ZGl2IGNsYXNzPVwiaW1hZ2VcIj48YSBjbGFzcz1cImltYWdlLWxpbmtcIiBocmVmPVwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvYWNsaz9zYT1sJmFtcDthaT1DSkhtOVM2RjlYX3pXSXRIbDdnT08tS3g0d3A2bHpWLTd1NHpZcUF5UHotaWRzd2tRQVNEUmg5SWdZUFdWem9IZ0JLQUJsSUtHNVFQSUFRYXBBZ2h0OTFualI3SS00QUlBcUFNQnlBTUtxZ1N1QTBfUWw0X0FJRDdkRlQwd2lZTXhMNzg2dURVdU9YY1ZZcTdPdkd6X0xaenlHQVVpdk5MbERKX3ZndzRldHRvaU9yUXhwY0JTZTJhRkcybG4zOXBqTVMta2pvbEhOX3dnWmpXTnVFbEtwZTNMSW1SdWZzVHZGeFJLb1NUSVNCbDVtcFNuUVhrRUFyUk9DV2pZX0RqcDFBcHR6NGpNVkE4d0JvaTAwQTZLSGhXSUJFNWdhUTQxVVFvdEN5Tlc3SE4xUEg2aVdKRjhYc3podk5VT01uMVNXc0Fxbk81bDl1SFREWlhKX3pSY09TYzN4MnV5Mlc0aDVqcnZ2RDZ3Q3B1enFheVlFYmZKdDV6Z0txd25kY0EwWGVxTGxTMUFVeGVMRkItRFUxMHZ1UWZldXk5NWE1TDJyZGpvaUE3Nkt5T0dpemlWTWpfTjM0UjNKMFZwZUtZd3k1WjJCX2MtVU5WcUp4SEtFX200T3NaZHBmbk15V25BVTZFTkxpMVQ4Mm1jZFJUaWFLZldUcTh6SjAtVG52V3lkRTB2aWFPSXB1SnUzZWNiU3hmWTJ2SWxuRVlvYjBpalNVQnBwM0VYTWR3Y2pxU2ZIajJWR2RLZGZ2RmMxSEZLM0xjMklCa1ZSM0FxV3Q0NHJDZkNwcFhQdGJMSU1GZFplMi14RXNqODlQckJoZy1vOHJtc3dzVlk0YTFnbXZyMWo0OTB1V1M4UmRFU0d0OF9Mb0FGYjN1bWZJWmt6ZVZKbDdxbUNINlRSb0RBQk1UaXBkMGQ0QVFCb0FZM2dBZlVfZmthcUFlT3podW9COVhKRzZnSGs5Z2JxQWU2QnFnSDhOa2JxQWZ5MlJ1b0ItNldzUUtvQjZhLUc2Z0g3TlVicUFmejBSdW9CLXpWRzZnSGx0Z2JxQWZDMmh2WUJ3SFNDQWtJZ09HQVFCQUJHQjN5Q0J0aFpIZ3RjM1ZpYzNsdUxUY3lOak0xTnpNME5EWTRNRFF3TnppeENaYW5YdlhTMUdmQ2dBb0RtQXNCeUFzQjJCTU1pQlFEJmFtcDthZT0xJmFtcDtudW09MSZhbXA7Y2lkPUNBQVNQZVJvQjFxQXRiNGFkRHR3aUlWN3c2RnBpb0ZpNHF0MUlLcm9HVHUxai0zZEZzY09KWGM2aVlQU3FTd3RVM2R6Tkp1OEwxbzdHMzJnUGJPQ2ZRZyZhbXA7c2lnPUFPRDY0XzFvZkZVTjlOQlFUS2RvLWRjSG5mbEZFZUZSMWcmYW1wO2NsaWVudD1jYS1wdWItOTY4NTczNDQ0NTQ3NjgxNCZhbXA7bng9Q0xJQ0tfWCZhbXA7bnk9Q0xJQ0tfWSZhbXA7bmI9OSZhbXA7YWR1cmw9aHR0cHM6Ly9tb25leXBhcmsuY2gvZW4vdGhlLXNpbXBsZXN0LXdheS9mb3JtLyUzRnV0bV9zb3VyY2UlM0RhZHdvcmRzJTI2dXRtX21lZGl1bSUzRGNwYyUyNnV0bV9jYW1wYWlnbiUzREVOX0NIX0FBX01PX0dETl9STUtUJTI2Z2NsaWQlM0RFQUlhSVFvYkNoTUl2S2l0czZ1aTdBSVYwYko3Q2gwT1BBc1BFQUVZQVNBQUVnS3E3ZkRfQndFXCIgb249XCJ0YXA6ZXhpdC1hcGkuZXhpdCh0YXJnZXQ9JzgzMDkyMjEwNjYyMzA2ODkzNjknLF9uYj0nOScpXCIgdGFyZ2V0PVwiX2JsYW5rXCI%2BPGFtcC1pbWcgYWx0PVwiXCIgY2xhc3M9XCJpbWdfYWQgaS1hbXBodG1sLWxheW91dC1maWxsIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50XCIgaS1hbXBodG1sLWxheW91dD1cImZpbGxcIiBpLWFtcGh0bWwtc3NyPVwiXCIgbGF5b3V0PVwiZmlsbFwiIHNyYz1cImh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9zaW1nYWQvMTgwOTUzMDQ4OTgyODc2NjgyODcvZG93bnNpemVfMjAwa192MT9zcXA9NHNxUHlRU1VBVUtSQVFnQUVoUU56Y3pNUGhVQUFBQkFI&i=3-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: kxhrVwRk0DPGRZeTyK---gpYdZop6Kwu7_8-i0hRJHYRdwqELYBrPQ==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
427 B 56ms
53ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=UUFBQUFBbEFBQUFBQmdBSWdvTkFBQ0FQeFVBQUlBX0trOElXaEFCSFFBQXRFSWdBU2dCTUFZNEEwQ0F3dGN2U0FCUUFGZ0FZRnB3QW5nQWdBRUFpQUVBa0FFQW5RRUFBSUFfb0FFQXFBRUFzQUdBcmVJRXVBSF9fX19fX19fX19fOEJ4UUV0c3AwLU1oZ0lxQUVRV0JnQklBRXRBQUFBUHpDb0FUaFlSUUFBZ0Q4JmFtcDtycz1BT2dhNHFuZ3R0dVFZaXpoRTNCalFCb21aNzExWmZGU1p3XCI%2BPGltZyBhbHQ9XCJcIiBjbGFzcz1cImktYW1waHRtbC1maWxsLWNvbnRlbnQgaS1hbXBodG1sLXJlcGxhY2VkLWNvbnRlbnRcIiBkZWNvZGluZz1cImFzeW5jXCIgc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3NpbWdhZC8xODA5NTMwNDg5ODI4NzY2ODI4Ny9kb3duc2l6ZV8yMDBrX3YxP3NxcD00c3FQeVFTVUFVS1JBUWdBRWhRTnpjek1QaFVBQUFCQUhRQUFBQUFsQUFBQUFCZ0FJZ29OQUFDQVB4VUFBSUFfS2s4SVdoQUJIUUFBdEVJZ0FTZ0JNQVk0QTBDQXd0Y3ZTQUJRQUZnQVlGcHdBbmdBZ0FFQWlBRUFrQUVBblFFQUFJQV9vQUVBcUFFQXNBR0FyZUlFdUFIX19fX19fX19fX184QnhRRXRzcDAtTWhnSXFBRVFXQmdCSUFFdEFBQUFQekNvQVRoWVJRQUFnRDgmYW1wO3JzPUFPZ2E0cW5ndHR1UVlpemhFM0JqUUJvbVo3MTFaZkZTWndcIj48L2FtcC1pbWc%2BPC9hPjwvZGl2PjxkaXYgY2xhc3M9XCJjYWxsLXRvLWFjdGlvblwiPjxhIGNsYXNzPVwiY2FsbC10by1hY3Rpb24tbGlua1wiIGhyZWY9XCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9hY2xrP3NhPWwmYW1wO2FpPUNKSG05UzZGOVhfeldJdEhsN2dPTy1LeDR3cDZselYtN3U0ellxQXlQei1pZHN3a1FBU0RSaDlJZ1lQV1Z6b0hnQktBQmxJS0c1UVBJQVFhcEFnaHQ5MW5qUjdJLTRBSUFxQU1CeUFNS3FnU3VBMF9RbDRfQUlEN2RGVDB3aVlNeEw3ODZ1RFV1T1hjVllxN092R3pfTFp6eUdBVWl2TkxsREpfdmd3NGV0dG9pT3JReHBjQlNlMmFGRzJsbjM5cGpNUy1ram9sSE5fd2daaldOdUVsS3BlM0xJbVJ1ZnNUdkZ4UktvU1RJU0JsNW1wU25RWGtFQXJST0NXallfRGpwMUFwdHo0ak1WQTh3Qm9pMDBBNktIaFdJQkU1Z2FRNDFVUW90Q3lOVzdITjFQSDZpV0pGOFhzemh2TlVPTW4xU1dzQXFuTzVsOXVIVERaWEpfelJjT1NjM3gydXkyVzRoNWpydnZENndDcHV6cWF5WUViZkp0NXpnS3F3bmRjQTBYZXFMbFMxQVV4ZUxGQi1EVTEwdnVRZmV1eTk1YTVMMnJkam9pQTc2S3lPR2l6aVZNal9OMzRSM0owVnBlS1l3eTVaMkJfYy1VTlZxSnhIS0VfbTRPc1pkcGZuTXlXbkFVNkVOTGkxVDgybWNkUlRpYUtmV1RxOHpKMC1UbnZXeWRFMHZpYU9JcHVKdTNlY2JTeGZZMnZJbG5FWW9iMGlqU1VCcHAzRVhNZHdjanFTZkhqMlZHZEtkZnZGYzFIRkszTGMySUJrVlIzQXFXdDQ0ckNmQ3BwWFB0YkxJTUZkWmUyLXhFc2o4OVByQmhnLW84cm1zd3NWWTRhMWdtdnIxajQ5MHVXUzhSZEVTR3Q4X0xvQUZiM3VtZklaa3plVkpsN3FtQ0g2VFJvREFCTVRpcGQwZDRBUUJvQVkzZ0FmVV9ma2FxQWVPemh1b0I5WEpHNmdIazlnYnFBZTZCcWdIOE5rYnFBZnkyUnVvQi02V3NRS29CNmEtRzZnSDdOVWJxQWZ6MFJ1b0ItelZHNmdIbHRnYnFBZkMyaHZZQndIU0NBa0lnT0dBUUJBQkdCM3lDQnRoWkhndGMzVmljM2x1TFRjeU5qTTFOek0wTkRZNE1EUXdOeml4Q1phblh2WFMxR2ZDZ0FvRG1Bc0J5QXNCMkJNTWlCUUQmYW1wO2FlPTEmYW1wO251bT0xJmFtcDtjaWQ9Q0FBU1BlUm9CMXFBdGI0YWREdHdpSVY3dzZGcGlvRmk0cXQxSUtyb0dUdTFqLTNkRnNjT0pYYzZpWVBTcVN3dFUzZHpOSnU4TDFvN0czMmdQYk9DZlFnJmFtcDtzaWc9QU9ENjRfMW9mRlVOOU5CUVRLZG8tZGNIbmZsRkVlRlIxZyZhbXA7Y2xpZW50PWNhLXB1Yi05Njg1NzM0NDQ1NDc2ODE0JmFtcDtueD1DTElDS19YJmFtcDtueT1DTElDS19ZJmFtcDtuYj04JmFtcDthZHVybD1odHRwczovL21vbmV5cGFyay5jaC9lbi90aGUtc2ltcGxlc3Qtd2F5L2Zvcm0vJTNGdXRtX3NvdXJjZSUzRGFkd29yZHMlMjZ1dG1fbWVkaXVtJTNEY3BjJTI2dXRtX2NhbXBhaWduJTNERU5fQ0hfQUFfTU9fR0ROX1JNS1QlMjZnY2xpZCUzREVBSWFJUW9iQ2hNSXZLaXRzNnVpN0FJVjBiSjdDaDBPUEFzUEVBRVlBU0FBRWdLcTdmRF9Cd0VcIiBvbj1cInRhcDpleGl0LWFwaS5leGl0KHRhcmdldD0nODMwOTIyMTA2NjIzMDY4OTM2OScsX25iPSc4JylcIiB0YXJnZXQ9XCJfYmxhbmtcIj5PcGVuPC9hPjwvZGl2PjxkaXYgY2xhc3M9XCJ0aXRsZVwiPjxhIGNsYXNzPVwidGl0bGUtbGlua1wiIGhyZWY9XCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9hY2xrP3NhPWwmYW1wO2FpPUNKSG05UzZGOVhfeldJdEhsN2dPTy1LeDR3cDZselYtN3U0ellxQXlQei1pZHN3a1FBU0RSaDlJZ1lQV1Z6b0hnQktBQmxJS0c1UVBJQVFhcEFnaHQ5MW5qUjdJLTRBSUFxQU1CeUFNS3FnU3VBMF9RbDRfQUlEN2RGVDB3aVlNeEw3ODZ1RFV1T1hjVllxN092R3pfTFp6eUdBVWl2TkxsREpfdmd3NGV0dG9pT3JReHBjQlNlMmFGRzJsbjM5cGpNUy1ram9sSE5fd2daaldOdUVsS3BlM0xJbVJ1ZnNUdkZ4UktvU1RJU0JsNW1wU25RWGtFQXJST0NXallfRGpwMUFwdHo0ak1WQTh3Qm9pMDBBNktIaFdJQkU1Z2FRNDFVUW90Q3lOVzdITjFQSDZpV0pGOFhzemh2TlVPTW4xU1dzQXFuTzVsOXVIVERaWEpfelJjT1NjM3gydXkyVzRoNWpydnZENndDcHV6cWF5WUViZkp0NXpnS3F3bmRjQTBYZXFMbFMxQVV4ZUxGQi1EVTEwdnVRZmV1eTk1YTVMMnJkam9pQTc2S3lPR2l6aVZNal9OMzRSM0owVnBlS1l3eTVaMkJfYy1VTlZxSnhIS0VfbTRPc1pkcGZuTXlXbkFVNkVOTGkxVDgybWNkUlRpYUtmV1RxOHpKMC1UbnZXeWRFMHZpYU9JcHVKdTNlY2JTeGZZMnZJbG5FWW9iMGlqU1VCcHAzRVhNZHdjanFTZkhqMlZHZEtkZnZGYzFIRkszTGMySUJrVlIzQXFXdDQ0ckNmQ3BwWFB0YkxJTUZkWmUyLXhFc2o4OVByQmhnLW84cm1zd3NWWTRhMWdtdnIxajQ5MHVXUzhSZEVTR3Q4X0xvQUZiM3VtZklaa3plVkpsN3FtQ0g2VFJvREFCTVRpcGQwZDRBUUJvQVkzZ0FmVV9ma2FxQWVPemh1b0I5WEpHNmdIazlnYnFBZTZCcWdIOE5rYnFBZnkyUnVvQi02V3NRS29CNmEtRzZnSDdOVWJxQWZ6MFJ1b0ItelZHNmdIbHRnYnFBZkMyaHZZQndIU0NBa0lnT0dBUUJBQkdCM3lDQnRoWkhndGMzVmljM2x1TFRjeU5qTTFOek0wTkRZNE1EUXdOeml4Q1phblh2WFMxR2ZDZ0FvRG1Bc0J5QXNCMkJNTWlCUUQmYW1wO2FlPTEmYW1wO251bT0xJmFtcDtjaWQ9Q0FBU1BlUm9CMXFBdGI0YWREdHdpSVY3dzZGcGlvRmk0cXQxSUtyb0dUdTFqLTNkRnNjT0pYYzZpWVBTcVN3dFUzZHpOSnU4TDFvN0czMmdQYk9DZlFnJmFtcDtzaWc9QU9ENjRfMW9mRlVOOU5CUVRLZG8tZGNIbmZsRkVlRlIxZyZhbXA7Y2xpZW50PWNhLXB1Yi05Njg1NzM0NDQ1NDc2ODE0JmFtcDtueD1DTElDS19YJmFtcDtueT1DTElDS19ZJmFtcDtuYj0wJmFtcDthZHVybD1odHRwczovL21vbmV5cGFyay5jaC9lbi90aGUtc2ltcGxlc3Qtd2F5L2Zvcm0vJTNGdXRtX3NvdXJjZSUzRGFkd29yZHMlMjZ1dG1fbWVkaXVtJTNEY3BjJTI2dXRtX2NhbXBhaWduJTNERU5fQ0hfQUFfTU9fR0ROX1JNS1QlMjZnY2xpZCUzREVBSWFJUW9iQ2hNSXZLaXRzNnVpN0FJVjBiSjdDaDBPUEFzUEVBRVlBU0FBRWdLcTdmRF9Cd0VcIiBvbj1cInRhcDpleGl0LWFwaS5leGl0KHRhcmdldD0nODMwOTIyMTA2NjIzMDY4OTM2OScsX25iPScwJylcIiB0YXJnZXQ9XCJfYmxhbmtcIj5Nb3J0Z2FnZSAxMCB5ZWFycyBmcm9tIDAuNjclPC9hPjwvZGl2PjxkaXYgY2xhc3M9XCJsb2dvXCI%2BPGEgY2xhc3M9XCJsb2dvLWxpbmtcIiBocmVmPVwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvYWNsaz9zYT1sJmFtcDthaT1DSkhtOVM2RjlYX3pXSXRIbDdnT08tS3g0d3A2bHpWLTd1NHpZcUF5UHotaWRzd2tRQVNEUmg5SWdZUFdWem9IZ0JLQUJsSUtHNVFQSUFRYXBBZ2h0OTFualI3SS00QUlBcUFNQnlBTUtxZ1N1QTBfUWw0X0FJRDdkRlQwd2lZTXhMNzg2dURVdU9YY1ZZcTdPdkd6X0xaenlHQVVpdk5MbERKX3ZndzRldHRvaU9yUXhwY0JTZTJhRkcybG4zOXBqTVMta2pvbEhOX3dnWmpXTnVFbEtwZTNMSW1SdWZzVHZGeFJLb1NUSVNCbDVtcFNuUVhrRUFyUk9DV2pZX0RqcDFBcHR6NGpNVkE4d0JvaTAwQTZLSGhXSUJFNWdhUTQxVVFvdEN5Tlc3SE4xUEg2aVdKRjhYc3podk5VT01uMVNXc0Fxbk81bDl1SFREWlhKX3pSY09TYzN4MnV5Mlc0aDVqcnZ2RDZ3Q3B1enFheVlFYmZKdDV6Z0txd25kY0EwWGVxTGxTMUFVeGVMRkItRFUxMHZ1UWZldXk5NWE1TDJyZGpvaUE3Nkt5T0dpemlWTWpfTjM0UjNKMFZwZUtZd3k1WjJCX2MtVU5WcUp4SEtFX200T3NaZHBmbk15V25BVTZFTkxpMVQ4Mm1jZFJUaWFLZldUcTh6SjAtVG52V3lkRTB2aWFPSXB1SnUzZWNiU3hmWTJ2SWxuRVlvYjBpalNVQnBwM0VYTWR3Y2pxU2ZIajJWR2RLZGZ2RmMxSEZLM0xjMklCa1ZSM0FxV3Q0NHJDZkNwcFhQdGJMSU1GZFplMi14RXNqODlQckJoZy1vOHJtc3dzVlk0YTFnbXZyMWo0OTB1V1M4UmRFU0d0OF9Mb0FGYjN1bWZJWmt6ZVZKbDdxbUNINlRSb0RBQk1UaXBkMGQ0QVFCb0FZM2dBZlVfZmthcUFlT3podW9COVhKRzZnSGs5Z2JxQWU2QnFnSDhOa2JxQWZ5MlJ1b0ItNldzUUtvQjZhLUc2Z0g3TlVicUFmejBSdW9CLXpWRzZnSGx0Z2JxQWZDMmh2WUJ3SFNDQWtJZ09HQVFCQUJHQjN5Q0J0aFpIZ3RjM1ZpYzNsdUxUY3lOak0xTnpNME5EWTRNRFF3TnppeENaYW5YdlhTMUdmQ2dBb0RtQXNCeUFzQjJCTU1pQlFEJmFtcDthZT0xJmFtcDtudW09MSZhbXA7Y2lkPUNBQVNQZVJvQjFxQXRiNGFkRHR3aUlWN3c2RnBpb0ZpNHF0MUlLcm9HVHUxai0zZEZzY09KWGM2aVlQU3FTd3RVM2R6Tkp1OEwxbzdHMzJnUGJPQ2ZRZyZhbXA7c2lnPUFPRDY0XzFvZkZVTjlOQlFUS2RvLWRjSG5mbEZFZUZSMWcmYW1wO2NsaWVudD1jYS1wdWItOTY4NTczNDQ0NTQ3NjgxNCZhbXA7bng9Q0xJQ0tfWCZhbXA7bnk9Q0xJQ0tfWSZhbXA7bmI9MTkmYW1wO2FkdXJsPWh0dHBzOi8vbW9uZXlwYXJrLmNoL2VuL3RoZS1zaW1wbGVzdC13YXkvZm9ybS8lM0Z1dG1fc291cmNlJTNEYWR3b3JkcyUyNnV0bV9tZWRpdW0lM0RjcGMlMjZ1dG1fY2FtcGFpZ24lM0RFTl9DSF9BQV9NT19HRE5fUk1LVCUyNmdjbGlkJTNERUFJYUlRb2JDaE1JdktpdHM2dWk3QUlWMGJKN0NoME9QQXNQRUFFWUFTQUFFZ0txN2ZEX0J3RVwiIG9uPVwidGFwOmV4aXQtYXBpLmV4aXQodGFyZ2V0PSc4MzA5MjIxMDY2MjMwNjg5MzY5JyxfbmI9JzE5JylcIiB0YXJnZXQ9XCJfYmxhbmtcIj48YW1wLWltZyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQgaS1hbXBodG1sLWVsZW1lbnRcIiBoZWlnaHQ9XCIyM1wiIGktYW1waHRtbC1sYXlvdXQ9XCJmaXhlZFwiIGktYW1waHRtbC1zc3I9XCJcIiBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc2ltZ2FkLzg0NzgxMTA0NTIwNzAwNDk5ODQvZG93bnNpemVfMjAwa192MT9zcXA9NHNxUHlRU0xBVUtJQVFnQUVoUU56Y3pNUGhVQUFBQkFIUUFBQUFBbEFBQUFBQmdBSWdvTkFBQ0FQeFVBQUlBX0trOElXaEFCSFFBQXRFSWdBU2dCTUFZNEEwQ0F3dGN2U0FCUUFGZ0FZRnB3QW5nQWdBRUFpQUVBa0FFQW5RRUFBSUFfb0FFQXFBRUFzQUdBcmVJRXVBSF9fX19fX19fX19fOEJ4UUV0c3AwLU1nOEkyQVFRMkFRWUFTQUJMUUFBQUQ4JmFtcDtycz1BT2dhNHFuYWJoZ09KaklnN3Yzb1AyV0ExLXU1c2c2aDhnXCIgc3R5bGU9XCJ3aWR0aDoyM3B4O2hlaWdodDoyM3B4O1wiIHdpZHRoPVwiMjNcIj48aW1nIGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPVwiYXN5bmNcIiBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc2ltZ2FkLzg0NzgxMTA0NTIwNzAwNDk5ODQvZG93bnNpemVfMjAwa192MT9zcXA9NHNxUHlRU0xBVUtJQVFnQU&i=4-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: ML2zbnLPCyQylE5MOhXwN046Ex5VflT16qdv7FLgV5UfEdFeGFfRBA==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
424 B 58ms
56ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=VoUU56Y3pNUGhVQUFBQkFIUUFBQUFBbEFBQUFBQmdBSWdvTkFBQ0FQeFVBQUlBX0trOElXaEFCSFFBQXRFSWdBU2dCTUFZNEEwQ0F3dGN2U0FCUUFGZ0FZRnB3QW5nQWdBRUFpQUVBa0FFQW5RRUFBSUFfb0FFQXFBRUFzQUdBcmVJRXVBSF9fX19fX19fX19fOEJ4UUV0c3AwLU1nOEkyQVFRMkFRWUFTQUJMUUFBQUQ4JmFtcDtycz1BT2dhNHFuYWJoZ09KaklnN3Yzb1AyV0ExLXU1c2c2aDhnXCI%2BPC9hbXAtaW1nPjwvYT48L2Rpdj48ZGl2IGNsYXNzPVwiYWR2ZXJ0aXNlclwiPjxhIGNsYXNzPVwiYWR2ZXJ0aXNlci1saW5rXCIgaHJlZj1cImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L2FjbGs%2Fc2E9bCZhbXA7YWk9Q0pIbTlTNkY5WF96V0l0SGw3Z09PLUt4NHdwNmx6Vi03dTR6WXFBeVB6LWlkc3drUUFTRFJoOUlnWVBXVnpvSGdCS0FCbElLRzVRUElBUWFwQWdodDkxbmpSN0ktNEFJQXFBTUJ5QU1LcWdTdUEwX1FsNF9BSUQ3ZEZUMHdpWU14TDc4NnVEVXVPWGNWWXE3T3ZHel9MWnp5R0FVaXZOTGxESl92Z3c0ZXR0b2lPclF4cGNCU2UyYUZHMmxuMzlwak1TLWtqb2xITl93Z1pqV051RWxLcGUzTEltUnVmc1R2RnhSS29TVElTQmw1bXBTblFYa0VBclJPQ1dqWV9EanAxQXB0ejRqTVZBOHdCb2kwMEE2S0hoV0lCRTVnYVE0MVVRb3RDeU5XN0hOMVBINmlXSkY4WHN6aHZOVU9NbjFTV3NBcW5PNWw5dUhURFpYSl96UmNPU2MzeDJ1eTJXNGg1anJ2dkQ2d0NwdXpxYXlZRWJmSnQ1emdLcXduZGNBMFhlcUxsUzFBVXhlTEZCLURVMTB2dVFmZXV5OTVhNUwycmRqb2lBNzZLeU9HaXppVk1qX04zNFIzSjBWcGVLWXd5NVoyQl9jLVVOVnFKeEhLRV9tNE9zWmRwZm5NeVduQVU2RU5MaTFUODJtY2RSVGlhS2ZXVHE4ekowLVRudld5ZEUwdmlhT0lwdUp1M2VjYlN4ZlkydklsbkVZb2IwaWpTVUJwcDNFWE1kd2NqcVNmSGoyVkdkS2RmdkZjMUhGSzNMYzJJQmtWUjNBcVd0NDRyQ2ZDcHBYUHRiTElNRmRaZTIteEVzajg5UHJCaGctbzhybXN3c1ZZNGExZ212cjFqNDkwdVdTOFJkRVNHdDhfTG9BRmIzdW1mSVpremVWSmw3cW1DSDZUUm9EQUJNVGlwZDBkNEFRQm9BWTNnQWZVX2ZrYXFBZU96aHVvQjlYSkc2Z0hrOWdicUFlNkJxZ0g4TmticUFmeTJSdW9CLTZXc1FLb0I2YS1HNmdIN05VYnFBZnowUnVvQi16Vkc2Z0hsdGdicUFmQzJodllCd0hTQ0FrSWdPR0FRQkFCR0IzeUNCdGhaSGd0YzNWaWMzbHVMVGN5TmpNMU56TTBORFk0TURRd056aXhDWmFuWHZYUzFHZkNnQW9EbUFzQnlBc0IyQk1NaUJRRCZhbXA7YWU9MSZhbXA7bnVtPTEmYW1wO2NpZD1DQUFTUGVSb0IxcUF0YjRhZER0d2lJVjd3NkZwaW9GaTRxdDFJS3JvR1R1MWotM2RGc2NPSlhjNmlZUFNxU3d0VTNkek5KdThMMW83RzMyZ1BiT0NmUWcmYW1wO3NpZz1BT0Q2NF8xb2ZGVU45TkJRVEtkby1kY0huZmxGRWVGUjFnJmFtcDtjbGllbnQ9Y2EtcHViLTk2ODU3MzQ0NDU0NzY4MTQmYW1wO254PUNMSUNLX1gmYW1wO255PUNMSUNLX1kmYW1wO25iPTEmYW1wO2FkdXJsPWh0dHBzOi8vbW9uZXlwYXJrLmNoL2VuL3RoZS1zaW1wbGVzdC13YXkvZm9ybS8lM0Z1dG1fc291cmNlJTNEYWR3b3JkcyUyNnV0bV9tZWRpdW0lM0RjcGMlMjZ1dG1fY2FtcGFpZ24lM0RFTl9DSF9BQV9NT19HRE5fUk1LVCUyNmdjbGlkJTNERUFJYUlRb2JDaE1JdktpdHM2dWk3QUlWMGJKN0NoME9QQXNQRUFFWUFTQUFFZ0txN2ZEX0J3RVwiIG9uPVwidGFwOmV4aXQtYXBpLmV4aXQodGFyZ2V0PSc4MzA5MjIxMDY2MjMwNjg5MzY5JyxfbmI9JzEnKVwiIHRhcmdldD1cIl9ibGFua1wiPk1vbmV5UGFyayBBRzwvYT48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48YW1wLXBpeGVsIGFsbG93LXNzci1pbWc9XCJcIiBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQgaS1hbXBodG1sLWVsZW1lbnRcIiBpLWFtcGh0bWwtbGF5b3V0PVwiZml4ZWRcIiBpLWFtcGh0bWwtc3NyPVwiXCIgc3JjPVwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2Fkdmlldz9haT1DNDdVVVM2RjlYX3pXSXRIbDdnT08tS3g0d3A2bHpWLTd1NHpZcUF5UHotaWRzd2tRQVNEUmg5SWdZUFdWem9IZ0JLQUJsSUtHNVFQSUFRYXBBZ2h0OTFualI3SS00QUlBcUFNQnlBTUtxZ1NyQTBfUWw0X0FJRDdkRlQwd2lZTXhMNzg2dURVdU9YY1ZZcTdPdkd6X0xaenlHQVVpdk5MbERKX3ZndzRldHRvaU9yUXhwY0JTZTJhRkcybG4zOXBqTVMta2pvbEhOX3dnWmpXTnVFbEtwZTNMSW1SdWZzVHZGeFJLb1NUSVNCbDVtcFNuUVhrRUFyUk9DV2pZX0RqcDFBcHR6NGpNVkE4d0JvaTAwQTZLSGhXSUJFNWdhUTQxVVFvdEN5Tlc3SE4xUEg2aVdKRjhYc3podk5VT01uMVNXc0Fxbk81bDl1SFREWlhKX3pSY09TYzN4MnV5Mlc0aDVqcnZ2RDZ3Q3B1enFheVlFYmZKdDV6Z0txd25kY0EwWGVxTGxTMUFVeGVMRkItRFUxMHZ1UWZldXk5NWE1TDJyZGpvaUE3Nkt5T0dpemlWTWpfTjM0UjNKMFZwZUtZd3k1WjJCX2MtVU5WcUp4SEtFX200T3NaZHBmbk15V25BVTZFTkxpMVQ4Mm1jZFJUaWFLZldUcTh6SjAtVG52V3lkRTB2aWFPSXB1SnUzZWNiU3hmWTJ2SWxuRVlvYjBpalNVQnBwM0VYTWR3Y2pxU2ZIajJWR2RLZGZ2RmMxSEZLM0xjMklCa1ZSM0FxV3Q0NHJDZkNwcFhQdGJMSU1GZFplMi14RXNqODlQckJoZy1vOHJtc3dzVlk0YTFnbXZyMWo0OTB1V1M4UmRFU0d0OF9Mb0JIYlhVMGp5R3AxMXlFcEVOR2ZvM0FCTVRpcGQwZDRBUUJrZ1VFQ0FRWUFaSUZCQWdGR0FTZ0JqZUFCOVQ5LVJxb0I0N09HNmdIMWNrYnFBZVQyQnVvQjdvR3FBZncyUnVvQl9MWkc2Z0g3cGF4QXFnSHByNGJxQWZzMVJ2WUJ3SHlCd1FRcXRvUTBnZ0pDSURoZ0VBUUFSZ2Q4Z2diWVdSNExYTjFZbk41YmkwM01qWXpOVGN6TkRRMk9EQTBNRGM0Z0FvRHlBc0JzZ3dVY0hWaUxUazJPRFUzTXpRME5EVTBOelk0TVRUWUV3eUlGQU0mYW1wO3NpZ2g9WnE1aHRYZ3R6ZEUmYW1wO3RlbXBsYXRlX2lkPTQ5MiZhbXA7dHBkPUFHV2hKbXVCTjZZVm04akJ1V2NoVmU2RkcyQjFfVnc3eUFnWjd0SF9URS16ak9ZMFhBXCIgc3R5bGU9XCJ3aWR0aDoxcHg7aGVpZ2h0OjFweDtcIiBhcmlhLWhpZGRlbj1cInRydWVcIj48aW1nIHNyYz1cImh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9hZHZpZXc%2FYWk9QzQ3VVVTNkY5WF96V0l0SGw3Z09PLUt4NHdwNmx6Vi03dTR6WXFBeVB6LWlkc3drUUFTRFJoOUlnWVBXVnpvSGdCS0FCbElLRzVRUElBUWFwQWdodDkxbmpSN0ktNEFJQXFBTUJ5QU1LcWdTckEwX1FsNF9BSUQ3ZEZUMHdpWU14TDc4NnVEVXVPWGNWWXE3T3ZHel9MWnp5R0FVaXZOTGxESl92Z3c0ZXR0b2lPclF4cGNCU2UyYUZHMmxuMzlwak1TLWtqb2xITl93Z1pqV051RWxLcGUzTEltUnVmc1R2RnhSS29TVElTQmw1bXBTblFYa0VBclJPQ1dqWV9EanAxQXB0ejRqTVZBOHdCb2kwMEE2S0hoV0lCRTVnYVE0MVVRb3RDeU5XN0hOMVBINmlXSkY4WHN6aHZOVU9NbjFTV3NBcW5PNWw5dUhURFpYSl96UmNPU2MzeDJ1eTJXNGg1anJ2dkQ2d0NwdXpxYXlZRWJmSnQ1emdLcXduZGNBMFhlcUxsUzFBVXhlTEZCLURVMTB2dVFmZXV5OTVhNUwycmRqb2lBNzZLeU9HaXppVk1qX04zNFIzSjBWcGVLWXd5NVoyQl9jLVVOVnFKeEhLRV9tNE9zWmRwZm5NeVduQVU2RU5MaTFUODJtY2RSVGlhS2ZXVHE4ekowLVRudld5ZEUwdmlhT0lwdUp1M2VjYlN4ZlkydklsbkVZb2IwaWpTVUJwcDNFWE1kd2NqcVNmSGoyVkdkS2RmdkZjMUhGSzNMYzJJQmtWUjNBcVd0NDRyQ2ZDcHBYUHRiTElNRmRaZTIteEVzajg5UHJCaGctbzhybXN3c1ZZNGExZ212cjFqNDkwdVdTOFJkRVNHdDhfTG9CSGJYVTBqeUdwMTF5RXBFTkdmbzNBQk1UaXBkMGQ0QVFCa2dVRUNBUVlBWklGQkFnRkdBU2dCamVBQjlUOS1ScW9CNDdPRzZnSDFja2JxQWVUMkJ1b0I3b0dxQWZ3MlJ1b0JfTFpHNmdIN3BheEFxZ0hwcjRicUFmczFSdllCd0h5QndRUXF0b1EwZ2dKQ0lEaGdFQVFBUmdkOGdnYllXUjRMWE4xWW5ONWJpMDNNall6TlRjek5EUTJPREEwTURjNGdBb0R5QXNCc2d3VWNIVmlMVGsyT0RVM016UTBORFUwTnpZNE1UVFlFd3lJRkFNJmFtcDtzaWdoPVpxNWh0WGd0emRFJmFtcDt0ZW1wbGF0ZV9pZD00OTImYW1wO3RwZD1BR1doSm11Qk42WVZtOGpCdVdjaFZlNkZHMkIxX1Z3N3lBZ1o3dEhfVEUtempPWTBYQVwiPjwvYW1wLXBpeGVsPjxhbXAtcGl4ZWwgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50XCIgaS1hbXBodG1sLWxheW91dD1cImZpeGVkXCIgcmVmZXJyZXJwb2xpY3k9XCJuby1yZWZlcnJlclwiIHNyYz1cIi8vd3d3Lmdvb2dsZS5jb20vcGFnZWFkL2RydC91aVwiIHN0eWxlPVwid2lkdGg6MXB4O2hlaWdodDoxcHg7XCIgYXJpYS1oaWRkZW49XCJ0cnVlXCI%2BPC9hbXAtcGl4ZWw%2BPGFtcC1hbmFseXRpY3MgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50IGktYW1waHRtbC1ub3RidWlsdCBhbXAtbm90YnVpbHQgYW1wLXVucmVzb2x2ZWQgaS1hbXBodG1sLXVucmVzb2x2ZWRcIiBpLWFtcGh0bWwtbGF5b3V0PVwiZml4ZWRcIiBzdHlsZT1cIndpZHRoOjFweDtoZWlnaHQ6MXB4O1wiIHRyaWdnZXI9XCJpbW1lZGlhdGVcIj48c2NyaXB0IHR5cGU9XCJhcHBsaWNhdGlvbi9qc29uXCI%2Be1widHJhbnNwb3J0XCI6IHtcImJlYWNvblwiOiBmYWxzZSwgXCJ4aHJwb3N0XCI6IGZhbHNlfSxcInJlcXVlc3RzXCI6IHtcInZpc2liaWxpdHkxXCI6IFwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wY3MvYWN0aXZldmlldz94YWk9QUtBT2pzczUyVGlQLUlmaG9yaTQ1WjAtRHFabW13UWJfU2wtcDZXdnBUWlJRYVFtaUFuRkQ5NzhpVnlZbVQ5eWtZRWZBWjhkZWM1SlhubV9Zc0FOVWpyU210TVc5ZUM3c2djQ3ZkNm45bjdCS3pnSUVnN0Zka3Q3OTZCT2tOYktqeDBZcmVJVGdpbi1OdXg1VzZiZ2hId1gzYVEmc2FpPUFNZmwtWVI1RFBOQ1JxR3ZyTksyVjF1OFVfZEZFTUJvQzVpTjVwYXVNdlp1ZjZ6T2NXS21vMWRzbG5pWUpFYm9MR2tua0lQaXNQMWpMcHNHdVF6ZlNWd3BsMWJCOEN3cnM4bm5aQ2tGVjdrYjhrWDN3QjJTY2tyRWxybnI2Y056aTBnTiZzaWc9Q2cwQXJLSlN6TkpFdGFKbmJ4eXZFQUUmY2lkPUNBQVNQZVJvQjFxQXRiNGFkRHR3aUlWN3c2RnBpb0ZpNHF0MUlLcm9HVHUxai0zZEZzY09KWGM2aVlQU3FTd3RVM2R6Tkp1OEwxbzdHMzJnUGJPQ2ZRZyZpZD1hbXBpbSZvPSR7ZWxlbWVudFh9LCR7ZWxlbWVudFl9JmQ9JHtlbGVtZW50V2lkdGh9LCR7ZWxlbWVudEhlaWdodH0mc3M9JHtzY3JlZW5XaWR0aH0sJHtzY3JlZW5IZWlnaHR9JmJzPSR7dmlld3BvcnRXaWR0aH0sJHt2aWV3cG9ydEhlaWdodH0mbWN2dD0ke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mbXRvcz0wLDAsJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9LCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mdG9zPTAsMCwke3RvdGFsVmlzaWJsZVRpbWV9LDAsMCZ0ZnM9JHtmaXJzdFNlZW5UaW1lfSZ0bHM9JHtsYXN0U2VlblRpbWV9Jmc9JHttaW5WaXNpYmxlUGVyY2VudGFnZX0maD0ke21heFZpc2libGVQZXJjZW50YWdlfSZ0dD0ke3RvdGFsVGltZX0mcj12JmF2bXM9YW1wYSZhZGs9MTAxNTUxOTgwMFwifSxcInRyaWdnZXJzXCI6IHtcImNvbnRpbnVvdXNWaXNpYmxlXCI6IHtcIm9uXCI6IFwidmlzaWJsZVwiLFwicmVxdWVzdFwiOiBbXCJ2aXNpYmlsaXR5MVwiXSxcInBhcmVudFBvc3RNZXNzYWdlXCI6IFwiaW1wcmVzc2lvbi12aWV3YWJsZVwiLFwidmlzaWJpbGl0eVNwZWNcIjoge1wic2VsZWN0b3JcIjogXCI6cm9vdFwiLFwidmlzaWJsZVBlcmNlbnRhZ2VNaW5cIjogNTAsXCJjb250aW51b3VzVGltZU1pblwiOiAxMDAwfX0sXCJ2aXNpYmlsaXR5Q2hhbmdlZFwiOiB7XCJvblwiOiBcInZpc2libGVcIixcInBhcmVudF&i=5-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: 16MtWKEKCtv1cfEsNr84MYcZHNwi11h5n8uPUTQgYbk0osaD2cA2vA==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
427 B 66ms
64ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=Bvc3RNZXNzYWdlXCI6IFwidmlzaWJpbGl0eS1jaGFuZ2VkLSR7aW50ZXJzZWN0aW9uUmF0aW99XCIsXCJ2aXNpYmlsaXR5U3BlY1wiOiB7XCJyZXBlYXRcIjogdHJ1ZSxcInNlbGVjdG9yXCI6IFwiOnJvb3RcIixcInZpc2libGVQZXJjZW50YWdlVGhyZXNob2xkc1wiOiBbWzAsMF0sWzAsNV0sWzUsMTBdLFsxMCwxNV0sWzE1LDIwXSxbMjAsMjVdLFsyNSwzMF0sWzMwLDM1XSxbMzUsNDBdLFs0MCw0NV0sWzQ1LDUwXSxbNTAsNTVdLFs1NSw2MF0sWzYwLDY1XSxbNjUsNzBdLFs3MCw3NV0sWzc1LDgwXSxbODAsODVdLFs4NSw5MF0sWzkwLDk1XSxbOTUsMTAwXSxbMTAwLDEwMF1dfX0sXCJpbmlMb2FkXCI6IHtcIm9uXCI6IFwiaW5pLWxvYWRcIixcInBhcmVudFBvc3RNZXNzYWdlXCI6IFwie1xcXCJjXFxcIjpcXFwic2ZjaGFubmVsMVxcXCIsXFxcInBcXFwiOlxcXCJ7XFxcXFxcXCJ1aWRcXFxcXFxcIjpcXFxcXFxcIjFcXFxcXFxcIixcXFxcXFxcIndpZHRoXFxcXFxcXCI6JHtzY3JvbGxXaWR0aH0sXFxcXFxcXCJoZWlnaHRcXFxcXFxcIjoke3Njcm9sbEhlaWdodH19XFxcIixcXFwic1xcXCI6XFxcImNyZWF0aXZlX2dlb21ldHJ5X3VwZGF0ZVxcXCJ9XFxuXCJ9fX08L3NjcmlwdD48L2FtcC1hbmFseXRpY3M%2BPGFtcC1hbmFseXRpY3MgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50IGktYW1waHRtbC1ub3RidWlsdCBhbXAtbm90YnVpbHQgYW1wLXVucmVzb2x2ZWQgaS1hbXBodG1sLXVucmVzb2x2ZWRcIiBpLWFtcGh0bWwtbGF5b3V0PVwiZml4ZWRcIiBzdHlsZT1cIndpZHRoOjFweDtoZWlnaHQ6MXB4O1wiIHRyaWdnZXI9XCJpbW1lZGlhdGVcIj48c2NyaXB0IHR5cGU9XCJhcHBsaWNhdGlvbi9qc29uXCI%2Be1widHJhbnNwb3J0XCI6IHtcImJlYWNvblwiOiB0cnVlLCBcInhocnBvc3RcIjogZmFsc2V9LFwicmVxdWVzdHNcIjoge1wiYW1wZW9zXCI6IFwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wY3MvYWN0aXZldmlldz94YWk9QUtBT2pzczUyVGlQLUlmaG9yaTQ1WjAtRHFabW13UWJfU2wtcDZXdnBUWlJRYVFtaUFuRkQ5NzhpVnlZbVQ5eWtZRWZBWjhkZWM1SlhubV9Zc0FOVWpyU210TVc5ZUM3c2djQ3ZkNm45bjdCS3pnSUVnN0Zka3Q3OTZCT2tOYktqeDBZcmVJVGdpbi1OdXg1VzZiZ2hId1gzYVEmc2FpPUFNZmwtWVI1RFBOQ1JxR3ZyTksyVjF1OFVfZEZFTUJvQzVpTjVwYXVNdlp1ZjZ6T2NXS21vMWRzbG5pWUpFYm9MR2tua0lQaXNQMWpMcHNHdVF6ZlNWd3BsMWJCOEN3cnM4bm5aQ2tGVjdrYjhrWDN3QjJTY2tyRWxybnI2Y056aTBnTiZzaWc9Q2cwQXJLSlN6TkpFdGFKbmJ4eXZFQUUmY2lkPUNBQVNQZVJvQjFxQXRiNGFkRHR3aUlWN3c2RnBpb0ZpNHF0MUlLcm9HVHUxai0zZEZzY09KWGM2aVlQU3FTd3RVM2R6Tkp1OEwxbzdHMzJnUGJPQ2ZRZyZpZD1hbXBlb3Mmbz0ke2VsZW1lbnRYfSwke2VsZW1lbnRZfSZkPSR7ZWxlbWVudFdpZHRofSwke2VsZW1lbnRIZWlnaHR9JnNzPSR7c2NyZWVuV2lkdGh9LCR7c2NyZWVuSGVpZ2h0fSZicz0ke3ZpZXdwb3J0V2lkdGh9LCR7dmlld3BvcnRIZWlnaHR9Jm1jdnQ9JHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9Jm10b3M9MCwwLCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0sJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9JnRvcz0wLDAsJHt0b3RhbFZpc2libGVUaW1lfSwwLDAmdGZzPSR7Zmlyc3RTZWVuVGltZX0mdGxzPSR7bGFzdFNlZW5UaW1lfSZnPSR7bWluVmlzaWJsZVBlcmNlbnRhZ2V9Jmg9JHttYXhWaXNpYmxlUGVyY2VudGFnZX0mcHQ9JHtwYWdlTG9hZFRpbWV9JnR0PSR7dG90YWxUaW1lfSZycHQ9JHtuYXZUaW1pbmcobmF2aWdhdGlvblN0YXJ0LGxvYWRFdmVudFN0YXJ0KX0mcnN0PSR7bmF2VGltaW5nKG5hdmlnYXRpb25TdGFydCl9JnI9ZGUmaXNkPSR7aW5pdGlhbFNjcm9sbERlcHRofSZtc2Q9JHttYXhTY3JvbGxEZXB0aH0mYXZtcz1hbXBhXCJ9LFwidHJpZ2dlcnNcIjoge1wiZW5kT2ZTZXNzaW9uXCI6IHtcIm9uXCI6IFwidmlzaWJsZVwiLFwicmVxdWVzdFwiOiBcImFtcGVvc1wiLFwidmlzaWJpbGl0eVNwZWNcIjoge1wicmVwb3J0V2hlblwiOiBcImRvY3VtZW50RXhpdFwiLFwic2VsZWN0b3JcIjogXCI6cm9vdFwiLFwidmlzaWJsZVBlcmNlbnRhZ2VNaW5cIjogNTB9fX19PC9zY3JpcHQ%2BPC9hbXAtYW5hbHl0aWNzPjxhbXAtcGl4ZWwgYWxsb3ctc3NyLWltZz1cIlwiIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZCBpLWFtcGh0bWwtZWxlbWVudFwiIGktYW1waHRtbC1sYXlvdXQ9XCJmaXhlZFwiIGktYW1waHRtbC1zc3I9XCJcIiBzcmM9XCIvL3d3dy5nb29nbGUuY29tL2Fkcy9tZWFzdXJlbWVudC9sP2ViY2lkPUFMaDdDYVNiWFY4VjNYS0dDODdKbDlyb3U0aWdVd2dCYUtCTkdtX19JWV85RUQyWmt2Tnc2RGhmWUN2al9ueFNkTXhEMlZ4QmN3dWlcIiBzdHlsZT1cIndpZHRoOjFweDtoZWlnaHQ6MXB4O1wiIGFyaWEtaGlkZGVuPVwidHJ1ZVwiPjxpbWcgc3JjPVwiLy93d3cuZ29vZ2xlLmNvbS9hZHMvbWVhc3VyZW1lbnQvbD9lYmNpZD1BTGg3Q2FTYlhWOFYzWEtHQzg3Smw5cm91NGlnVXdnQmFLQk5HbV9fSVlfOUVEMlprdk53NkRoZllDdmpfbnhTZE14RDJWeEJjd3VpXCI%2BPC9hbXAtcGl4ZWw%2BPGRpdiBzdHlsZT1cImJvdHRvbTowO3JpZ2h0OjA7d2lkdGg6NzI4cHg7aGVpZ2h0OjkwcHg7YmFja2dyb3VuZDppbml0aWFsO3Bvc2l0aW9uOmFic29sdXRlO21heC13aWR0aDoxMDAlO21heC1oZWlnaHQ6MTAwJTtwb2ludGVyLWV2ZW50czpub25lO2ltYWdlLXJlbmRlcmluZzpwaXhlbGF0ZWQ7ei1pbmRleDoyMTQ3NDgzNjQ3O2JhY2tncm91bmQtaW1hZ2U6dXJsKCdkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUNzQUFBQVdCQU1BQUFDcmwzaUFBQUFBQmxCTVZFVUFBQUQrQWNpV21aeldBQUFBQW5SU1RsTUFBcGlkckJRQUFBQ0JTVVJCVkJqVGJaRUJFb1F3Q0FQREQvTC8xOTRWa2hRZE93cGxUR0ViZ2U5VnMvNmI4NlFDK3l0Qm5xMnJWcUJ1N2pnNkM1bHFxZHdkejk1Y2xXZW52MGk4cm5hNG16aHZZY1RtYVBKaGFSTGZkTEtPUnpjSFI2dnVMWkV4Q2lISmlKUERYYjZmU0V6TmpSOFgxRmxENGhtTmpPM2dUWGc3eUluN1h3cEd2djhBWE1BRjZCbG9DVkVBQUFBQVNVVk9SSzVDWUlJPScpO1wiPjwvZGl2PjxkaXYgYXJpYS1oaWRkZW49XCJ0cnVlXCIgY2xhc3M9XCJhYmdjIGFiZ2YgcGVuXCIgZGlyPVwibHRyXCIgaWQ9XCJhYmdjXCI%2BPGRpdiBjbGFzcz1cImFiZ2NwIHBlYVwiIGlkPVwiYWJnY3BcIj48ZGl2IGNsYXNzPVwiYWJnc1wiIGlkPVwiYWJnc1wiPjxhIGNsYXNzPVwiYWJnbFwiIGhyZWY9XCJodHRwczovL2Fkc3NldHRpbmdzLmdvb2dsZS5jb20vd2h5dGhpc2FkP3JlYXNvbnM9QUIzYWZHRUFBQVlhVzF0YlcyNTFiR3dzV3pJc09WMWRMRnR1ZFd4c0xDSm9kSFJ3Y3pvdkwyZHZiMmRzWldGa2N5NW5MbVJ2ZFdKc1pXTnNhV05yTG01bGRDOXdZV2RsWVdRdlkyOXVkbVZ5YzJsdmJpOF9ZV2s5UTBwSWJUbFROa1k1V0Y5NlYwbDBTR3czWjA5UExVdDROSGR3Tm14NlZpMDNkVFI2V1hGQmVWQjZMV2xrYzNkclVVRlRSRkpvT1VsbldWQlhWbnB2U0dkQ1MwRkNiRWxMUnpWUlVFbEJVV0Z3UVdkb2REa3hibXBTTjBrdE5FRkpRWEZCVFVKNVFVMUxjV2RUZFVFd1gxRnNORjlCU1VRM1pFWlVNSGRwV1UxNFREYzROblZFVlhWUFdHTldXWEUzVDNaSGVsOU1XbnA1UjBGVmFYWk9UR3hFU2w5MlozYzBaWFIwYjJsUGNsRjRjR05DVTJVeVlVWkhNbXh1TXpsd2FrMVRMV3RxYjJ4SVRsOTNaMXBxVjA1MVJXeExjR1V6VEVsdFVuVm1jMVIyUm5oU1MyOVRWRWxUUW13MWJYQlRibEZZYTBWQmNsSlBRMWRxV1Y5RWFuQXhRWEIwZWpScVRWWkJPSGRDYjJrd01FRTJTMGhvVjBsQ1JUVm5ZVkUwTVZWUmIzUkRlVTVYTjBoT01WQklObWxYU2tZNFdITjZhSFpPVlU5TmJqRlRWM05CY1c1UE5XdzVkVWhVUkZwWVNsOTZVbU5QVTJNemVESjFlVEpYTkdnMWFuSjJka1EyZDBOd2RYcHhZWGxaUldKbVNuUTFlbWRMY1hkdVpHTkJNRmhsY1V4c1V6RkJWWGhsVEVaQ0xVUlZNVEIyZFZGbVpYVjVPVFZoTlV3eWNtUnFiMmxCTnpaTGVVOUhhWHBwVmsxcVgwNHpORkl6U2pCV2NHVkxXWGQ1TlZveVFsOWpMVlZPVm5GS2VFaExSVjl0TkU5eldtUndabTVOZVZkdVFWVTJSVTVNYVRGVU9ESnRZMlJTVkdsaFMyWlhWSEU0ZWtvd0xWUnVkbGQ1WkVVd2RtbGhUMGx3ZFVwMU0yVmpZbE40WmxreWRrbHNia1ZaYjJJd2FXcFRWVUp3Y0RORldFMWtkMk5xY1ZObVNHb3lWa2RrUzJSbWRrWmpNVWhHU3pOTVl6SkpRbXRXVWpOQmNWZDBORFJ5UTJaRGNIQllVSFJpVEVsTlJtUmFaVEl0ZUVWemFqZzVVSEpDYUdjdGJ6aHliWE4zYzFaWk5HRXhaMjEyY2pGcU5Ea3dkVmRUT0ZKa1JWTkhkRGhmVEc5QlJtSXpkVzFtU1ZwcmVtVldTbXczY1cxRFNEWlVVbTlFUVVKTlZHbHdaREJrTkVGUlFtOUJXVE5uUVdaVlgyWnJZWEZCWlU5NmFIVnZRamxZU2tjMlowaHJPV2RpY1VGbE5rSnhaMGc0VG10aWNVRm1lVEpTZFc5Q0xUWlhjMUZMYjBJMllTMUhObWRJTjA1VlluRkJabm93VW5WdlFpMTZWa2MyWjBoc2RHZGljVUZtUXpKb2RsbENkMGhUUTBGclNXZFBSMEZSUWtGQ1IwSXplVU5DZEdoYVNHZDBZek5XYVdNemJIVk1WR041VG1wTk1VNTZUVEJPUkZrMFRVUlJkMDU2YVhoRFdtRnVXSFpZVXpGSFprTm5RVzlFYlVGelFubEJjMEl5UWsxTmFVSlJSRngxTURBeU5uTnBaMmc5UWpKcU9UaGpXbFJaY0RCY2RUQXdNalpqYVdROVEwRlJVMUIzUTA1SmNreE5UVGxXTURSNlR6QXdVVFZ1ZDJKa01UUktWa0ZWVFZKeGRrRnJUbWRWY1hFMmQzQXlNRU5rVTFkQlMyTmpTR0pKZURSSGNuVmxSamRZU0djeExVZGlNbVZDU2kxZmVUUjJkVnBaV25KQklpeGJiblZzYkN4dWRXeHNMRzUxYkd3c0ltaDBkSEJ6T2k4dlpHbHpjR3hoZVdGa2N5MW1iM0p0WVhSekxtZHZiMmRzWlhWelpYSmpiMjUwWlc1MExtTnZiUzloWkhNdmNISmxkbWxsZHk5amIyNTBaVzUwTG1welAyTnNhV1Z1ZEQxM2RHRmNkVEF3TWpadlltWjFjMk5oZEdWa1EzVnpkRzl0WlhKSlpEMHpOVGcyT0RNeE16QXdYSFV3TURJMlkzSmxZWFJwZG1WSlpEMDBOVFExTkRZeU1EUXlOakJjZFRBd01qWjJaWEp6YVc5dVNXUTlNMXgxTURBeU5tRmtSM0p2ZFhCRGNtVmhkR2wyWlVsa1BUUXlNekl6T1RBek1qSTFNVngxTURBeU5taDBiV3hRWVhKbGJuUkpaRDF3Y21WMkxUQmNkVEF3TWpab1pXbG5hSFE5T1RCY2RUQXdNalozYVdSMGFEMDNNamhjZFRBd01qWnphV2M5UVVOcFZrSmZlbTF5TVhwQ2N6VmlkRWQzV1hWME9EVktaR2hVUVdGSGNYaGFkeUpkTEc1MWJHd3NiblZzYkN3eExDSkJNMmhZZWtsalJXcE9PRWwxTjNWTk1rdG5UVVZQVkZadlZWVlpOVXBtYmtkNVNVMWlWemwxV2xoc2QxbFlTbkpNYlU1dlRXZGpTVUpTVFZrMlJITlZVV2hrYWxsVE1YZGtWMGwwVDFSWk5FNVVZM3BPUkZFd1RsUlJNMDVxWjNoT1JXZEtWMFJrWnpkQlRuZEJVU0lzSWpFME5USTFOVEUwTUNKZFhWMHNXekVzTVN3eFhWMTNxOFM0TXpPVHBXclFfdnA1YVAtT1NFX2xqN0k5SktBc1c2SVgtVXdkLTFMWEItLXp2SEMtZHQzUEs0VFNwOUZ5czVEQlkxOHFQdV9mU01Wdnl3OFRadHBzRFNaeXhRZ2lpc2RndkFQdWlEZ0M0TUdZY0p6bGkxR1F4djRvLUFzLTBGWUJFdXUwc1dLZnVOM05YNXNKblY0cUlEOUhENWxDeWQ4Mlh1c2VRN2l4ZDRvbDZpb3A2QWRmcXAtbmtGck9BbGkyN0QyS2FmVWM5aERfTkwta0xMRUlaMHI5TThTYkNfR051QjV4aFNLa3h5U0doZmtsdW1RREUxeGtabkRSRmtSZWZxaERSMldRLTlibU5qdzBkbnNuMXlFVWV3UlpVelFaTW5kRlppbTVlT0JqLW9LTmtvYnVEalNNLXdFSnUtb0RmWTYtMjJabUFFakhlLUpOLF9ZYXBMUEVsamJWSll6WFN2eG1BbFEmYW1wO3NvdXJjZT1kaXNwbGF5XCIgaWQ9XCJhYmdsXCIgdGFyZ2V0PVwiX2&i=6-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: W5PEGGmZNeKxf7Fcyk15DAJCzGpt5BxfY1CSGXC3uss19bIxKUJfNw==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
427 B 70ms
68ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=JsYW5rXCI%2BPGFtcC1pbWcgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50XCIgaGVpZ2h0PVwiMTVcIiBpLWFtcGh0bWwtbGF5b3V0PVwiZml4ZWRcIiBpLWFtcGh0bWwtc3NyPVwiXCIgc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2VuLnBuZ1wiIHN0eWxlPVwid2lkdGg6NzVweDtoZWlnaHQ6MTVweDtcIiB3aWR0aD1cIjc1XCI%2BPGltZyBjbGFzcz1cImktYW1waHRtbC1maWxsLWNvbnRlbnQgaS1hbXBodG1sLXJlcGxhY2VkLWNvbnRlbnRcIiBkZWNvZGluZz1cImFzeW5jXCIgc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2VuLnBuZ1wiPjwvYW1wLWltZz48L2E%2BPC9kaXY%2BPGRpdiBjbGFzcz1cImFiZ2JcIiBpZD1cImFiZ2JcIj48YSBocmVmPVwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tL3doeXRoaXNhZD9yZWFzb25zPUFCM2FmR0VBQUFZYVcxdGJXMjUxYkd3c1d6SXNPVjFkTEZ0dWRXeHNMQ0pvZEhSd2N6b3ZMMmR2YjJkc1pXRmtjeTVuTG1SdmRXSnNaV05zYVdOckxtNWxkQzl3WVdkbFlXUXZZMjl1ZG1WeWMybHZiaThfWVdrOVEwcEliVGxUTmtZNVdGOTZWMGwwU0d3M1owOVBMVXQ0Tkhkd05teDZWaTAzZFRSNldYRkJlVkI2TFdsa2MzZHJVVUZUUkZKb09VbG5XVkJYVm5wdlNHZENTMEZDYkVsTFJ6VlJVRWxCVVdGd1FXZG9kRGt4Ym1wU04wa3RORUZKUVhGQlRVSjVRVTFMY1dkVGRVRXdYMUZzTkY5QlNVUTNaRVpVTUhkcFdVMTRURGM0Tm5WRVZYVlBXR05XV1hFM1QzWkhlbDlNV25wNVIwRlZhWFpPVEd4RVNsOTJaM2MwWlhSMGIybFBjbEY0Y0dOQ1UyVXlZVVpITW14dU16bHdhazFUTFd0cWIyeElUbDkzWjFwcVYwNTFSV3hMY0dVelRFbHRVblZtYzFSMlJuaFNTMjlUVkVsVFFtdzFiWEJUYmxGWWEwVkJjbEpQUTFkcVdWOUVhbkF4UVhCMGVqUnFUVlpCT0hkQ2Iya3dNRUUyUzBob1YwbENSVFZuWVZFME1WVlJiM1JEZVU1WE4waE9NVkJJTm1sWFNrWTRXSE42YUhaT1ZVOU5iakZUVjNOQmNXNVBOV3c1ZFVoVVJGcFlTbDk2VW1OUFUyTXplREoxZVRKWE5HZzFhbkoyZGtRMmQwTndkWHB4WVhsWlJXSm1TblExZW1kTGNYZHVaR05CTUZobGNVeHNVekZCVlhobFRFWkNMVVJWTVRCMmRWRm1aWFY1T1RWaE5Vd3ljbVJxYjJsQk56WkxlVTlIYVhwcFZrMXFYMDR6TkZJelNqQldjR1ZMV1hkNU5Wb3lRbDlqTFZWT1ZuRktlRWhMUlY5dE5FOXpXbVJ3Wm01TmVWZHVRVlUyUlU1TWFURlVPREp0WTJSU1ZHbGhTMlpYVkhFNGVrb3dMVlJ1ZGxkNVpFVXdkbWxoVDBsd2RVcDFNMlZqWWxONFpsa3lka2xzYmtWWmIySXdhV3BUVlVKd2NETkZXRTFrZDJOcWNWTm1TR295Vmtka1MyUm1ka1pqTVVoR1N6Tk1ZekpKUW10V1VqTkJjVmQwTkRSeVEyWkRjSEJZVUhSaVRFbE5SbVJhWlRJdGVFVnphamc1VUhKQ2FHY3Riemh5YlhOM2MxWlpOR0V4WjIxMmNqRnFORGt3ZFZkVE9GSmtSVk5IZERoZlRHOUJSbUl6ZFcxbVNWcHJlbVZXU213M2NXMURTRFpVVW05RVFVSk5WR2x3WkRCa05FRlJRbTlCV1ROblFXWlZYMlpyWVhGQlpVOTZhSFZ2UWpsWVNrYzJaMGhyT1dkaWNVRmxOa0p4WjBnNFRtdGljVUZtZVRKU2RXOUNMVFpYYzFGTGIwSTJZUzFITm1kSU4wNVZZbkZCWm5vd1VuVnZRaTE2VmtjMlowaHNkR2RpY1VGbVF6Sm9kbGxDZDBoVFEwRnJTV2RQUjBGUlFrRkNSMEl6ZVVOQ2RHaGFTR2QwWXpOV2FXTXpiSFZNVkdONVRtcE5NVTU2VFRCT1JGazBUVVJSZDA1NmFYaERXbUZ1V0haWVV6Rkhaa05uUVc5RWJVRnpRbmxCYzBJeVFrMU5hVUpSUkZ4MU1EQXlObk5wWjJnOVFqSnFPVGhqV2xSWmNEQmNkVEF3TWpaamFXUTlRMEZSVTFCM1EwNUpja3hOVFRsV01EUjZUekF3VVRWdWQySmtNVFJLVmtGVlRWSnhka0ZyVG1kVmNYRTJkM0F5TUVOa1UxZEJTMk5qU0dKSmVEUkhjblZsUmpkWVNHY3hMVWRpTW1WQ1NpMWZlVFIyZFZwWlduSkJJaXhiYm5Wc2JDeHVkV3hzTEc1MWJHd3NJbWgwZEhCek9pOHZaR2x6Y0d4aGVXRmtjeTFtYjNKdFlYUnpMbWR2YjJkc1pYVnpaWEpqYjI1MFpXNTBMbU52YlM5aFpITXZjSEpsZG1sbGR5OWpiMjUwWlc1MExtcHpQMk5zYVdWdWREMTNkR0ZjZFRBd01qWnZZbVoxYzJOaGRHVmtRM1Z6ZEc5dFpYSkpaRDB6TlRnMk9ETXhNekF3WEhVd01ESTJZM0psWVhScGRtVkpaRDAwTlRRMU5EWXlNRFF5TmpCY2RUQXdNaloyWlhKemFXOXVTV1E5TTF4MU1EQXlObUZrUjNKdmRYQkRjbVZoZEdsMlpVbGtQVFF5TXpJek9UQXpNakkxTVZ4MU1EQXlObWgwYld4UVlYSmxiblJKWkQxd2NtVjJMVEJjZFRBd01qWm9aV2xuYUhROU9UQmNkVEF3TWpaM2FXUjBhRDAzTWpoY2RUQXdNalp6YVdjOVFVTnBWa0pmZW0xeU1YcENjelZpZEVkM1dYVjBPRFZLWkdoVVFXRkhjWGhhZHlKZExHNTFiR3dzYm5Wc2JDd3hMQ0pCTTJoWWVrbGpSV3BPT0VsMU4zVk5Na3RuVFVWUFZGWnZWVlZaTlVwbWJrZDVTVTFpVnpsMVdsaHNkMWxZU25KTWJVNXZUV2RqU1VKU1RWazJSSE5WVVdoa2FsbFRNWGRrVjBsMFQxUlpORTVVWTNwT1JGRXdUbFJSTTA1cVozaE9SV2RLVjBSa1p6ZEJUbmRCVVNJc0lqRTBOVEkxTlRFME1DSmRYVjBzV3pFc01Td3hYVjEzcThTNE16T1RwV3JRX3ZwNWFQLU9TRV9sajdJOUpLQXNXNklYLVV3ZC0xTFhCLS16dkhDLWR0M1BLNFRTcDlGeXM1REJZMThxUHVfZlNNVnZ5dzhUWnRwc0RTWnl4UWdpaXNkZ3ZBUHVpRGdDNE1HWWNKemxpMUdReHY0by1Bcy0wRllCRXV1MHNXS2Z1TjNOWDVzSm5WNHFJRDlIRDVsQ3lkODJYdXNlUTdpeGQ0b2w2aW9wNkFkZnFwLW5rRnJPQWxpMjdEMkthZlVjOWhEX05MLWtMTEVJWjByOU04U2JDX0dOdUI1eGhTS2t4eVNHaGZrbHVtUURFMXhrWm5EUkZrUmVmcWhEUjJXUS05Ym1OancwZG5zbjF5RVVld1JaVXpRWk1uZEZaaW01ZU9Cai1vS05rb2J1RGpTTS13RUp1LW9EZlk2LTIyWm1BRWpIZS1KTixfWWFwTFBFbGpiVkpZelhTdnhtQWxRJmFtcDtzb3VyY2U9ZGlzcGxheVwiIHRhcmdldD1cIl9ibGFua1wiPjxhbXAtaW1nIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZCBpLWFtcGh0bWwtZWxlbWVudFwiIGhlaWdodD1cIjE1XCIgaS1hbXBodG1sLWxheW91dD1cImZpeGVkXCIgaS1hbXBodG1sLXNzcj1cIlwiIHNyYz1cImh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvaW1hZ2VzL2FkY2hvaWNlcy9pY29uLnBuZ1wiIHN0eWxlPVwid2lkdGg6MTVweDtoZWlnaHQ6MTVweDtcIiB3aWR0aD1cIjE1XCI%2BPGltZyBjbGFzcz1cImktYW1waHRtbC1maWxsLWNvbnRlbnQgaS1hbXBodG1sLXJlcGxhY2VkLWNvbnRlbnRcIiBkZWNvZGluZz1cImFzeW5jXCIgc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2ljb24ucG5nXCI%2BPC9hbXAtaW1nPjwvYT48L2Rpdj48L2Rpdj48YW1wLWFuYWx5dGljcyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQgaS1hbXBodG1sLWVsZW1lbnQgaS1hbXBodG1sLW5vdGJ1aWx0IGFtcC1ub3RidWlsdCBhbXAtdW5yZXNvbHZlZCBpLWFtcGh0bWwtdW5yZXNvbHZlZFwiIGktYW1waHRtbC1sYXlvdXQ9XCJmaXhlZFwiIHN0eWxlPVwid2lkdGg6MXB4O2hlaWdodDoxcHg7XCIgdHJpZ2dlcj1cImltbWVkaWF0ZVwiPjxzY3JpcHQgdHlwZT1cImFwcGxpY2F0aW9uL2pzb25cIj57XCJyZXF1ZXN0c1wiOiB7XCJyZXBvcnROb0xhYmVsSW5zdGFuY2VcIjogXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvY29udmVyc2lvbi8%2FYWk9Q0pIbTlTNkY5WF96V0l0SGw3Z09PLUt4NHdwNmx6Vi03dTR6WXFBeVB6LWlkc3drUUFTRFJoOUlnWVBXVnpvSGdCS0FCbElLRzVRUElBUWFwQWdodDkxbmpSN0ktNEFJQXFBTUJ5QU1LcWdTdUEwX1FsNF9BSUQ3ZEZUMHdpWU14TDc4NnVEVXVPWGNWWXE3T3ZHel9MWnp5R0FVaXZOTGxESl92Z3c0ZXR0b2lPclF4cGNCU2UyYUZHMmxuMzlwak1TLWtqb2xITl93Z1pqV051RWxLcGUzTEltUnVmc1R2RnhSS29TVElTQmw1bXBTblFYa0VBclJPQ1dqWV9EanAxQXB0ejRqTVZBOHdCb2kwMEE2S0hoV0lCRTVnYVE0MVVRb3RDeU5XN0hOMVBINmlXSkY4WHN6aHZOVU9NbjFTV3NBcW5PNWw5dUhURFpYSl96UmNPU2MzeDJ1eTJXNGg1anJ2dkQ2d0NwdXpxYXlZRWJmSnQ1emdLcXduZGNBMFhlcUxsUzFBVXhlTEZCLURVMTB2dVFmZXV5OTVhNUwycmRqb2lBNzZLeU9HaXppVk1qX04zNFIzSjBWcGVLWXd5NVoyQl9jLVVOVnFKeEhLRV9tNE9zWmRwZm5NeVduQVU2RU5MaTFUODJtY2RSVGlhS2ZXVHE4ekowLVRudld5ZEUwdmlhT0lwdUp1M2VjYlN4ZlkydklsbkVZb2IwaWpTVUJwcDNFWE1kd2NqcVNmSGoyVkdkS2RmdkZjMUhGSzNMYzJJQmtWUjNBcVd0NDRyQ2ZDcHBYUHRiTElNRmRaZTIteEVzajg5UHJCaGctbzhybXN3c1ZZNGExZ212cjFqNDkwdVdTOFJkRVNHdDhfTG9BRmIzdW1mSVpremVWSmw3cW1DSDZUUm9EQUJNVGlwZDBkNEFRQm9BWTNnQWZVX2ZrYXFBZU96aHVvQjlYSkc2Z0hrOWdicUFlNkJxZ0g4TmticUFmeTJSdW9CLTZXc1FLb0I2YS1HNmdIN05VYnFBZnowUnVvQi16Vkc2Z0hsdGdicUFmQzJodllCd0hTQ0FrSWdPR0FRQkFCR0IzeUNCdGhaSGd0YzNWaWMzbHVMVGN5TmpNMU56TTBORFk0TURRd056aXhDWmFuWHZYUzFHZkNnQW9EbUFzQnlBc0IyQk1NaUJRRCZzaWdoPUIyajk4Y1pUWXAwJmNpZD1DQVFTUHdDTklyTE1NOVYwNHpPMDBRNW53YmQxNEpWQVVNUnF2QWtOZ1VxcTZ3cDIwQ2RTV0FLY2NIYkl4NEdydWVGN1hIZzEtR2IyZUJKLV95NHZ1WllackEmY2lkPUNBUVNQd0NOSXJMTU05VjA0ek8wMFE1bndiZDE0SlZBVU1ScXZBa05nVXFxNndwMjBDZFNXQUtjY0hiSXg0R3J1ZUY3WEhnMS1HYjJlQkotX3k0dnVaWVpyQSZsYWJlbD0ke2xhYmVsfVwiLFwicmVwb3J0TGFiZWxJbnN0YW5jZVwiOiBcImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9jb252ZXJzaW9uLz9haT1DSkhtOVM2RjlYX3pXSXRIbDdnT08tS3g0d3A2bHpWLTd1NHpZcUF5UHotaWRzd2tRQVNEUmg5SWdZUFdWem9IZ0JLQUJsSUtHNVFQSUFRYXBBZ2h0OTFualI3SS00QUlBcUFNQnlBTUtxZ1N1QTBfUWw0X0FJRDdkRlQwd2lZTXhMNzg2dURVdU9YY1ZZcTdPdkd6X0xaenlHQVVpdk5MbERKX3ZndzRldHRvaU9yUXhwY0JTZTJhRkcybG4zOXBqTVMta2pvbEhOX3dnWmpXTnVFbEtwZTNMSW1SdWZzVHZGeFJLb1NUSVNCbDVtcFNuUVhrRUFyUk9DV2pZX0RqcDFBcHR6NGpNVkE4d0JvaTAwQTZLSGhXSUJFNWdhUTQxVVFvdEN5Tlc3SE4xUEg2aVdKRjhYc3podk5VT01uMVNXc0Fxbk81bDl1SFREWlhKX3pSY09TYzN4MnV5Mlc0aDVqcnZ2RDZ3Q3B1enFheVlFYmZKdDV6Z0txd25kY0EwWGVxTGxTMUFVeGVMRkItRFUxMHZ1UWZldXk5NWE1TDJyZGpvaUE3Nkt5T0dpemlWTWpfTjM0UjNKMFZwZUtZd3k1WjJCX2MtVU5WcUp4SEtFX200T3NaZHBmbk15V25BVTZFTkxpMVQ4Mm1jZFJUaWFLZldUcTh6SjAtVG52V3lkRTB2aWFPSXB1SnUzZWNiU3hmWTJ2SWxuRVlvYjBpalNVQnBwM0VYTWR3Y2pxU2ZIajJWR2RLZGZ2RmMxSEZLM0xjMklCa1ZSM0FxV3Q0NHJDZkNwcFhQdGJMSU1GZFplMi14RXNqODlQckJoZy1vOHJtc3dzVlk0YTFnbXZyMWo0OTB1V1M4UmRFU0d0OF9Mb0FGYjN1bWZJWmt6ZVZKbDdxbUNINlRSb0RBQk1UaXBkMGQ0QVFCb0FZM2dBZlVfZmthcUFlT3podW9COVhKRzZnSGs5Z2JxQWU2QnFnSDhOa2JxQWZ5MlJ1b0ItNldzUUtvQjZhLUc2Z0g3TlVicUFmejBSdW9CLXpWRzZnSGx0Z2JxQWZDMmh2WUJ3SFNDQWtJZ09HQVFCQUJHQjN5Q0J0aFpIZ3RjM1ZpYzNsdUxUY3lOak0xTnpNME5EWTRNRFF3TnppeENaYW5YdlhTMUdmQ2dBb0RtQXNCeUFzQjJCTU1pQlFEJnNpZ2g9QjJqOThjWlRZcDAm&i=7-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: WBClHPfSiIVwAzyZVP1xzWWaUC9geyMxmGowfVoYWVyTt795ED2ypA==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
426 B 75ms
74ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=Y2lkPUNBUVNQd0NOSXJMTU05VjA0ek8wMFE1bndiZDE0SlZBVU1ScXZBa05nVXFxNndwMjBDZFNXQUtjY0hiSXg0R3J1ZUY3WEhnMS1HYjJlQkotX3k0dnVaWVpyQSZjaWQ9Q0FRU1B3Q05JckxNTTlWMDR6TzAwUTVud2JkMTRKVkFVTVJxdkFrTmdVcXE2d3AyMENkU1dBS2NjSGJJeDRHcnVlRjdYSGcxLUdiMmVCSi1feTR2dVpZWnJBJmxhYmVsPSR7bGFiZWx9JmxhYmVsX2luc3RhbmNlPSR7bGFiZWxJbnN0YW5jZX0mY2J0PUEzaFh6SWNFak44SXU3dU0yS2dNRU9UVm9VVVk1SmZuR3lJTWJXOXVaWGx3WVhKckxtTm9NZ2NJQlJNWTZEc1VRaGRqWVMxd2RXSXRPVFk0TlRjek5EUTBOVFEzTmpneE5FZ0pXRGRnN0FOd0FRXCJ9LFwidHJhbnNwb3J0XCI6IHtcImJlYWNvblwiOiBmYWxzZSxcInhocnBvc3RcIjogZmFsc2UsXCJpbWFnZVwiOiB0cnVlfSxcInRyaWdnZXJzXCI6IHtcInRyYWNrTXV0ZVwiOiB7XCJvblwiOiBcImNsaWNrXCIsXCJzZWxlY3RvclwiOiBcImxhYmVsW2Zvcj0nc3ByMSddXCIsXCJyZXF1ZXN0XCI6IFwicmVwb3J0Tm9MYWJlbEluc3RhbmNlXCJ9LFwidHJhY2tSZXBvcnRBZFwiOiB7XCJvblwiOiBcImNsaWNrXCIsXCJzZWxlY3RvclwiOiBcImxhYmVsW2Zvcj0nc3ByMiddXCIsXCJyZXF1ZXN0XCI6IFwicmVwb3J0TGFiZWxJbnN0YW5jZVwifSxcInRyYWNrU3VydmV5UmVzcG9uc2VcIjoge1wib25cIjogXCJjbGlja1wiLFwic2VsZWN0b3JcIjogXCJsYWJlbFtmb3I9J3NwcjMnXVwiLFwicmVxdWVzdFwiOiBcInJlcG9ydExhYmVsSW5zdGFuY2VcIn0sXCJ0cmFja1doeVRoaXNBZFwiOiB7XCJvblwiOiBcImNsaWNrXCIsXCJzZWxlY3RvclwiOiBcIiNzYnRuXCIsXCJyZXF1ZXN0XCI6IFwicmVwb3J0TGFiZWxJbnN0YW5jZVwifX19PC9zY3JpcHQ%2BPC9hbXAtYW5hbHl0aWNzPjxmb3JtIGFjdGlvbj1cIi8vZy5jb1wiIGNsYXNzPVwic2ggc3Mgam0gYW1wLWFuaW1hdGUgYWJnZiBwZW5cIiBpZD1cIm10YVwiIHRhcmdldD1cIl9ibGFua1wiPjxpbnB1dCBpZD1cInNwcjBcIiBuYW1lPVwiYVwiIHR5cGU9XCJyYWRpb1wiPjxpbnB1dCBpZD1cInNwcjFcIiBuYW1lPVwiYVwiIHR5cGU9XCJyYWRpb1wiPjxpbnB1dCBpZD1cInNwcjJcIiBuYW1lPVwiYVwiIHR5cGU9XCJyYWRpb1wiPjxpbnB1dCBpZD1cInNwcjNcIiBuYW1lPVwiYVwiIHR5cGU9XCJyYWRpb1wiPjxsYWJlbCBjbGFzcz1cImNiYiBwZWFcIiBkYXRhLXZhcnMtbGFiZWw9XCJ1c2VyX2ZlZWRiYWNrX21lbnVfaW50ZXJhY3Rpb25cIiBmb3I9XCJzcHIxXCIgaWQ9XCJjYmJcIj48c3ZnIGhlaWdodD1cIjE1XCIgd2lkdGg9XCIxNVwiIHhtbG5zPVwiLy93d3cudzMub3JnLzIwMDAvc3ZnXCI%2BPHBhdGggZD1cIk0wLDBsMTUsMGwwLDE1bC0xNSwwWlwiIGZpbGw9XCIjY2RjY2NjXCI%2BPC9wYXRoPjxwYXRoIGQ9XCJNMy4yNSwzLjI1bDguNSw4LjVNMTEuNzUsMy4yNWwtOC41LDguNVwiIHN0cm9rZT1cIiMwMGFlY2RcIiBzdHJva2Utd2lkdGg9XCIxLjI1XCI%2BPC9wYXRoPjwvc3ZnPjwvbGFiZWw%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1cInNwdjFcIj48YW1wLWZpdC10ZXh0IGNsYXNzPVwiZmwgaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50IGktYW1waHRtbC1ub3RidWlsdCBhbXAtbm90YnVpbHQgYW1wLXVucmVzb2x2ZWQgaS1hbXBodG1sLXVucmVzb2x2ZWRcIiBoZWlnaHQ9XCI5MFwiIGktYW1waHRtbC1sYXlvdXQ9XCJyZXNwb25zaXZlXCIgbGF5b3V0PVwicmVzcG9uc2l2ZVwiIG1heC1mb250LXNpemU9XCIyMFwiIG1pbi1mb250LXNpemU9XCI4XCIgd2lkdGg9XCI3MjhcIj48aS1hbXBodG1sLXNpemVyIHN0eWxlPVwiZGlzcGxheTpibG9jaztwYWRkaW5nLXRvcDoxMi4zNjI2JTtcIiBzbG90PVwiaS1hbXBodG1sLXN2Y1wiPjwvaS1hbXBodG1sLXNpemVyPjxkaXYgY2xhc3M9XCJjbG9zZVwiIGlkPVwibWVudS1kaXNtaXNzXCI%2BPGxhYmVsIGZvcj1cInNwcjBcIj48c3ZnIHZpZXdCb3g9XCIwIDAgMjQgMjRcIj48cGF0aCBjbGFzcz1cIm5hdGl2ZS1hcnJvd1wiIGQ9XCJNMjAgMTFINy44M2w1LjU5LTUuNTlMMTIgNGwtOCA4IDggOCAxLjQxLTEuNDFMNy44MyAxM0gyMHYtMnpcIj48L3BhdGg%2BPC9zdmc%2BPC9sYWJlbD48L2Rpdj48ZGl2IGlkPVwidGlcIj48c3BhbiBjbGFzcz1cImN0XCI%2BQWRzIGJ5IDxzdmcgZmlsbD1cIiMwMDAwMDBcIiB2aWV3Qm94PVwiMCAwIDYwIDI0XCIgeG1sbnM9XCJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2Z1wiPjxwYXRoIGQ9XCJNNy41IDE2LjI5Yy00LjA3IDAtNy40OS0zLjMxLTcuNDktNy4zOFMzLjQzIDEuNTMgNy41IDEuNTNjMi4yNSAwIDMuODUuODggNS4wNiAyLjAzbC0xLjQyIDEuNDJjLS44Ny0uODEtMi4wNC0xLjQ0LTMuNjQtMS40NC0yLjk3IDAtNS4yOSAyLjQtNS4yOSA1LjM3czIuMzIgNS4zNyA1LjI5IDUuMzdjMS45MyAwIDMuMDMtLjc3IDMuNzMtMS40OC41OC0uNTguOTUtMS40IDEuMS0yLjU0SDcuNVY4LjI0aDYuNzljLjA3LjM2LjExLjc5LjExIDEuMjYgMCAxLjUxLS40MSAzLjM5LTEuNzUgNC43Mi0xLjMgMS4zNS0yLjk1IDIuMDctNS4xNSAyLjA3em0xNy43NS00Ljc2YzAgMi43NC0yLjEzIDQuNzUtNC43NSA0Ljc1cy00Ljc1LTIuMDItNC43NS00Ljc1YzAtMi43NSAyLjEzLTQuNzUgNC43NS00Ljc1czQuNzUgMiA0Ljc1IDQuNzV6bS0yLjA4IDBjMC0xLjcxLTEuMjQtMi44OC0yLjY3LTIuODhzLTIuNjcgMS4xNy0yLjY3IDIuODhjMCAxLjY5IDEuMjQgMi44OCAyLjY3IDIuODhzMi42Ny0xLjE4IDIuNjctMi44OHptMTMuMDggMGMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEyLjU4LTQuNDZ2OC41M2MwIDMuNTEtMi4wNyA0Ljk1LTQuNTIgNC45NS0yLjMgMC0zLjY5LTEuNTUtNC4yMS0yLjgxbDEuODItLjc2Yy4zMi43NyAxLjEyIDEuNjkgMi4zOSAxLjY5IDEuNTcgMCAyLjU0LS45NyAyLjU0LTIuNzl2LS42OGgtLjA3Yy0uNDcuNTgtMS4zNyAxLjA4LTIuNSAxLjA4LTIuMzggMC00LjU2LTIuMDctNC41Ni00Ljc0IDAtMi42OCAyLjE4LTQuNzcgNC41Ni00Ljc3IDEuMTMgMCAyLjAzLjUgMi41IDEuMDZoLjA3di0uNzZoMS45OHptLTEuODQgNC40OGMwLTEuNjctMS4xMi0yLjktMi41NC0yLjktMS40NCAwLTIuNjUgMS4yMi0yLjY1IDIuOSAwIDEuNjYgMS4yMSAyLjg2IDIuNjUgMi44NiAxLjQzLjAxIDIuNTQtMS4yIDIuNTQtMi44NnptNS44OS05LjUyVjE2aC0yLjA5VjIuMDNoMi4wOXptOC40OSAxMS4wN2wxLjYyIDEuMDhjLS41Mi43Ny0xLjc4IDIuMTEtMy45NiAyLjExLTIuNyAwLTQuNzItMi4wOS00LjcyLTQuNzUgMC0yLjgzIDIuMDMtNC43NSA0LjQ4LTQuNzUgMi40NyAwIDMuNjcgMS45NiA0LjA3IDMuMDJsLjIyLjU0LTYuMzYgMi42M2MuNDkuOTUgMS4yNCAxLjQ0IDIuMyAxLjQ0IDEuMDcgMCAxLjgxLS41MyAyLjM1LTEuMzJ6bS00Ljk5LTEuNzFsNC4yNS0xLjc2Yy0uMjMtLjU5LS45NC0xLjAxLTEuNzYtMS4wMS0xLjA2IDAtMi41NC45My0yLjQ5IDIuNzd6XCI%2BPC9wYXRoPjxwYXRoIGQ9XCJNMCAwaDYydjI0SDB6XCIgZmlsbD1cIm5vbmVcIj48L3BhdGg%2BPC9zdmc%2BPC9zcGFuPjwvZGl2PjxkaXYgaWQ9XCJidG5zXCI%2BPGxhYmVsIGRhdGEtdmFycy1sYWJlbD1cInVzZXJfZmVlZGJhY2tfbWVudV9vcHRpb25cIiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9XCIxXCIgZm9yPVwic3ByMlwiPjxhIGNsYXNzPVwiYnRuXCIgaWQ9XCJyYnRuXCI%2BPHNwYW4%2BU2VuZCBmZWVkYmFjazwvc3Bhbj48L2E%2BPC9sYWJlbD48bGFiZWw%2BPGEgY2xhc3M9XCJidG5cIiBkYXRhLXZhcnMtbGFiZWw9XCJjbG9zZWJ1dHRvbl93aHl0aGlzYWRfY2xpY2tcIiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9XCIxXCIgaHJlZj1cImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbS93aHl0aGlzYWQ%2FcmVhc29ucz1BQjNhZkdFQUFBWWFXMXRiVzI1MWJHd3NXeklzT1YxZExGdHVkV3hzTENKb2RIUndjem92TDJkdmIyZHNaV0ZrY3k1bkxtUnZkV0pzWldOc2FXTnJMbTVsZEM5d1lXZGxZV1F2WTI5dWRtVnljMmx2Ymk4X1lXazlRMHBJYlRsVE5rWTVXRjk2VjBsMFNHdzNaMDlQTFV0NE5IZHdObXg2VmkwM2RUUjZXWEZCZVZCNkxXbGtjM2RyVVVGVFJGSm9PVWxuV1ZCWFZucHZTR2RDUzBGQ2JFbExSelZSVUVsQlVXRndRV2RvZERreGJtcFNOMGt0TkVGSlFYRkJUVUo1UVUxTGNXZFRkVUV3WDFGc05GOUJTVVEzWkVaVU1IZHBXVTE0VERjNE5uVkVWWFZQV0dOV1dYRTNUM1pIZWw5TVducDVSMEZWYVhaT1RHeEVTbDkyWjNjMFpYUjBiMmxQY2xGNGNHTkNVMlV5WVVaSE1teHVNemx3YWsxVExXdHFiMnhJVGw5M1oxcHFWMDUxUld4TGNHVXpURWx0VW5WbWMxUjJSbmhTUzI5VFZFbFRRbXcxYlhCVGJsRllhMFZCY2xKUFExZHFXVjlFYW5BeFFYQjBlalJxVFZaQk9IZENiMmt3TUVFMlMwaG9WMGxDUlRWbllWRTBNVlZSYjNSRGVVNVhOMGhPTVZCSU5tbFhTa1k0V0hONmFIWk9WVTlOYmpGVFYzTkJjVzVQTld3NWRVaFVSRnBZU2w5NlVtTlBVMk16ZURKMWVUSlhOR2cxYW5KMmRrUTJkME53ZFhweFlYbFpSV0ptU25RMWVtZExjWGR1WkdOQk1GaGxjVXhzVXpGQlZYaGxURVpDTFVSVk1UQjJkVkZtWlhWNU9UVmhOVXd5Y21ScWIybEJOelpMZVU5SGFYcHBWazFxWDA0ek5GSXpTakJXY0dWTFdYZDVOVm95UWw5akxWVk9WbkZLZUVoTFJWOXRORTl6V21Sd1ptNU5lVmR1UVZVMlJVNU1hVEZVT0RKdFkyUlNWR2xoUzJaWFZIRTRla293TFZSdWRsZDVaRVV3ZG1saFQwbHdkVXAxTTJWallsTjRabGt5ZGtsc2JrVlpiMkl3YVdwVFZVSndjRE5GV0Uxa2QyTnFjVk5tU0dveVZrZGtTMlJtZGtaak1VaEdTek5NWXpKSlFtdFdVak5CY1ZkME5EUnlRMlpEY0hCWVVIUmlURWxOUm1SYVpUSXRlRVZ6YWpnNVVISkNhR2N0YnpoeWJYTjNjMVpaTkdFeFoyMTJjakZxTkRrd2RWZFRPRkprUlZOSGREaGZURzlCUm1JemRXMW1TVnByZW1WV1NtdzNjVzFEU0RaVVVtOUVRVUpOVkdsd1pEQmtORUZSUW05QldUTm5RV1pWWDJacllYRkJaVTk2YUhWdlFqbFlTa2MyWjBock9XZGljVUZsTmtKeFowZzRUbXRpY1VGbWVUSlNkVzlDTFRaWGMxRkxiMEkyWVMxSE5tZElOMDVWWW5GQlpub3dVblZ2UWkxNlZrYzJaMGhzZEdkaWNVRm1RekpvZGxsQ2QwaFRRMEZyU1dkUFIwRlJRa0ZDUjBJemVVTkNkR2hhU0dkMFl6TldhV016YkhWTVZHTjVUbXBOTVU1NlRUQk9SRmswVFVSUmQwNTZhWGhEV21GdVdIWllVekZIWmtOblFXOUViVUZ6UW5sQmMwSXlRazFOYVVKUlJGeDFNREF5Tm5OcFoyZzlRakpxT1RoaldsUlpjREJjZFRBd01qWmphV1E5UTBGUlUxQjNRMDVKY2t4TlRUbFdNRFI2VHpBd1VUVnVkMkprTVRSS1ZrRlZUVkp4ZGtGclRtZFZjWEUyZDNBeU1FTmtVMWRCUzJOalNHSkplRFJIY25WbFJqZFlTR2N4TFVkaU1tVkNTaTFmZVRSMmRWcFpXbkpCSWl4YmJuVnNiQ3h1ZFd4c0xHNTFiR3dzSW1oMGRIQnpPaTh2WkdsemNHeGhlV0ZrY3kxbWIzSnRZWFJ6TG1kdmIyZHNaWFZ6WlhKamIyNTBaVzUwTG1OdmJTOWhaSE12Y0hKbGRtbGxkeTlqYjI1MFpXNTBMbXB6UDJOc2FXVnVkRDEzZEdGY2RUQXdNalp2WW1aMWMyTmhkR1ZrUTNWemRHOXRaWEpKWkQwek5UZzJPRE14TXpBd1hIVXdNREkyWTNKbFlYUnBkbVZKWkQwME5UUTFORFl5TURReU5qQmNkVEF3TWpaMlpYSnphVzl1U1dROU0xeDFNREF5Tm1Ga1IzSnZkWEJEY21WaGRHbDJaVWxrUFRReU16SXpPVEF6TWpJMU1WeDFNREF5Tm1oMGJXeFFZWEpsYm5SSlpEMXdjbVYyTFRCY2RUQXdNalpvWldsbmFIUTlPVEJjZFRBd01qWjNhV1IwYUQwM01qaGNkVEF3TWpaemFXYzlRVU5wVmtKZmVtMXlNWHBD&i=8-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: sA_b7TDXm6bfngnMnOvW7-dcGQQE1OLFHs2IeJXsH_4_-CkcJ35ZEA==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
426 B 75ms
74ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=Y3pWaWRFZDNXWFYwT0RWS1pHaFVRV0ZIY1hoYWR5SmRMRzUxYkd3c2JuVnNiQ3d4TENKQk0yaFlla2xqUldwT09FbDFOM1ZOTWt0blRVVlBWRlp2VlZWWk5VcG1ia2Q1U1UxaVZ6bDFXbGhzZDFsWVNuSk1iVTV2VFdkalNVSlNUVmsyUkhOVlVXaGthbGxUTVhka1YwbDBUMVJaTkU1VVkzcE9SRkV3VGxSUk0wNXFaM2hPUldkS1YwUmtaemRCVG5kQlVTSXNJakUwTlRJMU5URTBNQ0pkWFYwc1d6RXNNU3d4WFYxM3E4UzRNek9UcFdyUV92cDVhUC1PU0VfbGo3STlKS0FzVzZJWC1Vd2QtMUxYQi0tenZIQy1kdDNQSzRUU3A5RnlzNURCWTE4cVB1X2ZTTVZ2eXc4VFp0cHNEU1p5eFFnaWlzZGd2QVB1aURnQzRNR1ljSnpsaTFHUXh2NG8tQXMtMEZZQkV1dTBzV0tmdU4zTlg1c0puVjRxSUQ5SEQ1bEN5ZDgyWHVzZVE3aXhkNG9sNmlvcDZBZGZxcC1ua0ZyT0FsaTI3RDJLYWZVYzloRF9OTC1rTExFSVowcjlNOFNiQ19HTnVCNXhoU0treHlTR2hma2x1bVFERTF4a1puRFJGa1JlZnFoRFIyV1EtOWJtTmp3MGRuc24xeUVVZXdSWlV6UVpNbmRGWmltNWVPQmotb0tOa29idURqU00td0VKdS1vRGZZNi0yMlptQUVqSGUtSk4sX1lhcExQRWxqYlZKWXpYU3Z4bUFsUSZhbXA7c291cmNlPWRpc3BsYXlcIiBpZD1cInNidG5cIiB0YXJnZXQ9XCJfYmxhbmtcIj48c3Bhbj5XaHkgdGhpcyBhZD8mbmJzcDs8c3ZnIGZpbGw9XCIjMDAwMDAwXCIgaWQ9XCJzaVwiIHZpZXdCb3g9XCIwIDAgMTYgMTZcIiB4bWxucz1cIi8vd3d3LnczLm9yZy8yMDAwL3N2Z1wiPjxjaXJjbGUgY3g9XCI2XCIgY3k9XCI2XCIgcj1cIjAuNjdcIj48L2NpcmNsZT48cGF0aCBkPVwiTTQuMiwxMS4zUTMuMywxMS44LDMuMywxMC43NUwzLjMsNC4xUTMuMywzLjEsNC4zLDMuNUwxMC40LDcuMFExMi4wLDcuNSwxMC40LDguMEw2LjY1LDEwLjBMNi42NSw3Ljc1YTAuNjUsMC42NSwwLDEsMCwtMS4zLDBMNS4zNSwxMC43NWEwLjksMC45LDAsMCwwLDEuMywwLjhMMTIuNyw4LjJRMTMuNyw3LjUsMTIuNyw2LjdMMy4zLDEuNlEyLjIsMS4zLDEuOCwyLjVMMS44LDEyLjVRMi4yLDEzLjksMy4zLDEzLjNMNC44LDEyLjVBMC4zLDAuMywwLDEsMCw0LjIsMTEuM1pcIj48L3BhdGg%2BPC9zdmc%2BPC9zcGFuPjwvYT48L2xhYmVsPjwvZGl2PjwvYW1wLWZpdC10ZXh0PjwvZGl2PjxkaXYgY2xhc3M9XCJwbiBhYmdmXCIgaWQ9XCJzcHYyXCI%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9XCJtdXRlX3N1cnZleV9vcHRpb25cIiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9XCI4XCIgZm9yPVwic3ByM1wiPjxkaXY%2BPHNwYW4%2BQWQgd2FzIGluYXBwcm9wcmlhdGU8L3NwYW4%2BPC9kaXY%2BPC9sYWJlbD48bGFiZWwgY2xhc3M9XCJzYiBzb1wiIGRhdGEtdmFycy1sYWJlbD1cIm11dGVfc3VydmV5X29wdGlvblwiIGRhdGEtdmFycy1sYWJlbC1pbnN0YW5jZT1cIjNcIiBmb3I9XCJzcHIzXCI%2BPGRpdj48c3Bhbj5BZCBjb3ZlcmVkIGNvbnRlbnQ8L3NwYW4%2BPC9kaXY%2BPC9sYWJlbD48bGFiZWwgY2xhc3M9XCJzYiBzb1wiIGRhdGEtdmFycy1sYWJlbD1cIm11dGVfc3VydmV5X29wdGlvblwiIGRhdGEtdmFycy1sYWJlbC1pbnN0YW5jZT1cIjdcIiBmb3I9XCJzcHIzXCI%2BPGRpdj48c3Bhbj5Ob3QgaW50ZXJlc3RlZCBpbiB0aGlzIGFkPC9zcGFuPjwvZGl2PjwvbGFiZWw%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9XCJtdXRlX3N1cnZleV9vcHRpb25cIiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9XCIyXCIgZm9yPVwic3ByM1wiPjxkaXY%2BPHNwYW4%2BU2VlbiB0aGlzIGFkIG11bHRpcGxlIHRpbWVzPC9zcGFuPjwvZGl2PjwvbGFiZWw%2BPC9kaXY%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1cInNwdjNcIj48YW1wLWZpdC10ZXh0IGNsYXNzPVwiZmwgaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50IGktYW1waHRtbC1ub3RidWlsdCBhbXAtbm90YnVpbHQgYW1wLXVucmVzb2x2ZWQgaS1hbXBodG1sLXVucmVzb2x2ZWRcIiBoZWlnaHQ9XCI5MFwiIGktYW1waHRtbC1sYXlvdXQ9XCJyZXNwb25zaXZlXCIgbGF5b3V0PVwicmVzcG9uc2l2ZVwiIG1heC1mb250LXNpemU9XCIxN1wiIG1pbi1mb250LXNpemU9XCI4XCIgd2lkdGg9XCI3MjhcIj48aS1hbXBodG1sLXNpemVyIHN0eWxlPVwiZGlzcGxheTpibG9jaztwYWRkaW5nLXRvcDoxMi4zNjI2JTtcIiBzbG90PVwiaS1hbXBodG1sLXN2Y1wiPjwvaS1hbXBodG1sLXNpemVyPjxzcGFuIGlkPVwicGN0XCI%2BVGhhbmtzLiBGZWVkYmFjayBpbXByb3ZlcyBHb29nbGUgYWRzPC9zcGFuPjwvYW1wLWZpdC10ZXh0PjwvZGl2PjxkaXYgY2xhc3M9XCJwbiBhYmdmXCIgaWQ9XCJzcHY0XCI%2BPGFtcC1maXQtdGV4dCBjbGFzcz1cImZsIGktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZCBpLWFtcGh0bWwtZWxlbWVudCBpLWFtcGh0bWwtbm90YnVpbHQgYW1wLW5vdGJ1aWx0IGFtcC11bnJlc29sdmVkIGktYW1waHRtbC11bnJlc29sdmVkXCIgaGVpZ2h0PVwiOTBcIiBpLWFtcGh0bWwtbGF5b3V0PVwicmVzcG9uc2l2ZVwiIGxheW91dD1cInJlc3BvbnNpdmVcIiBtYXgtZm9udC1zaXplPVwiMjBcIiBtaW4tZm9udC1zaXplPVwiOFwiIHdpZHRoPVwiNzI4XCI%2BPGktYW1waHRtbC1zaXplciBzdHlsZT1cImRpc3BsYXk6YmxvY2s7cGFkZGluZy10b3A6MTIuMzYyNiU7XCIgc2xvdD1cImktYW1waHRtbC1zdmNcIj48L2ktYW1waHRtbC1zaXplcj48c3BhbiBjbGFzcz1cImN0IGZjdFwiPkFkIGNsb3NlZCBieSA8c3ZnIGZpbGw9XCIjMDAwMDAwXCIgdmlld0JveD1cIjAgMCA2MCAyNFwiIHhtbG5zPVwiaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmdcIj48cGF0aCBkPVwiTTcuNSAxNi4yOWMtNC4wNyAwLTcuNDktMy4zMS03LjQ5LTcuMzhTMy40MyAxLjUzIDcuNSAxLjUzYzIuMjUgMCAzLjg1Ljg4IDUuMDYgMi4wM2wtMS40MiAxLjQyYy0uODctLjgxLTIuMDQtMS40NC0zLjY0LTEuNDQtMi45NyAwLTUuMjkgMi40LTUuMjkgNS4zN3MyLjMyIDUuMzcgNS4yOSA1LjM3YzEuOTMgMCAzLjAzLS43NyAzLjczLTEuNDguNTgtLjU4Ljk1LTEuNCAxLjEtMi41NEg3LjVWOC4yNGg2Ljc5Yy4wNy4zNi4xMS43OS4xMSAxLjI2IDAgMS41MS0uNDEgMy4zOS0xLjc1IDQuNzItMS4zIDEuMzUtMi45NSAyLjA3LTUuMTUgMi4wN3ptMTcuNzUtNC43NmMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEzLjA4IDBjMCAyLjc0LTIuMTMgNC43NS00Ljc1IDQuNzVzLTQuNzUtMi4wMi00Ljc1LTQuNzVjMC0yLjc1IDIuMTMtNC43NSA0Ljc1LTQuNzVzNC43NSAyIDQuNzUgNC43NXptLTIuMDggMGMwLTEuNzEtMS4yNC0yLjg4LTIuNjctMi44OHMtMi42NyAxLjE3LTIuNjcgMi44OGMwIDEuNjkgMS4yNCAyLjg4IDIuNjcgMi44OHMyLjY3LTEuMTggMi42Ny0yLjg4em0xMi41OC00LjQ2djguNTNjMCAzLjUxLTIuMDcgNC45NS00LjUyIDQuOTUtMi4zIDAtMy42OS0xLjU1LTQuMjEtMi44MWwxLjgyLS43NmMuMzIuNzcgMS4xMiAxLjY5IDIuMzkgMS42OSAxLjU3IDAgMi41NC0uOTcgMi41NC0yLjc5di0uNjhoLS4wN2MtLjQ3LjU4LTEuMzcgMS4wOC0yLjUgMS4wOC0yLjM4IDAtNC41Ni0yLjA3LTQuNTYtNC43NCAwLTIuNjggMi4xOC00Ljc3IDQuNTYtNC43NyAxLjEzIDAgMi4wMy41IDIuNSAxLjA2aC4wN3YtLjc2aDEuOTh6bS0xLjg0IDQuNDhjMC0xLjY3LTEuMTItMi45LTIuNTQtMi45LTEuNDQgMC0yLjY1IDEuMjItMi42NSAyLjkgMCAxLjY2IDEuMjEgMi44NiAyLjY1IDIuODYgMS40My4wMSAyLjU0LTEuMiAyLjU0LTIuODZ6bTUuODktOS41MlYxNmgtMi4wOVYyLjAzaDIuMDl6bTguNDkgMTEuMDdsMS42MiAxLjA4Yy0uNTIuNzctMS43OCAyLjExLTMuOTYgMi4xMS0yLjcgMC00LjcyLTIuMDktNC43Mi00Ljc1IDAtMi44MyAyLjAzLTQuNzUgNC40OC00Ljc1IDIuNDcgMCAzLjY3IDEuOTYgNC4wNyAzLjAybC4yMi41NC02LjM2IDIuNjNjLjQ5Ljk1IDEuMjQgMS40NCAyLjMgMS40NCAxLjA3IDAgMS44MS0uNTMgMi4zNS0xLjMyem0tNC45OS0xLjcxbDQuMjUtMS43NmMtLjIzLS41OS0uOTQtMS4wMS0xLjc2LTEuMDEtMS4wNiAwLTIuNTQuOTMtMi40OSAyLjc3elwiPjwvcGF0aD48cGF0aCBkPVwiTTAgMGg2MnYyNEgwelwiIGZpbGw9XCJub25lXCI%2BPC9wYXRoPjwvc3ZnPjwvc3Bhbj48L2FtcC1maXQtdGV4dD48L2Rpdj48L2Zvcm0%2BPC9kaXY%2BPGFtcC1hZC1leGl0IGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1jb250YWluZXIgaS1hbXBodG1sLWVsZW1lbnQgaS1hbXBodG1sLW5vdGJ1aWx0IGFtcC1ub3RidWlsdCBhbXAtdW5yZXNvbHZlZCBpLWFtcGh0bWwtdW5yZXNvbHZlZFwiIGktYW1waHRtbC1sYXlvdXQ9XCJjb250YWluZXJcIiBpZD1cImV4aXQtYXBpXCI%2BPHNjcmlwdCB0eXBlPVwiYXBwbGljYXRpb24vanNvblwiPntcImZpbHRlcnNcIjp7fSxcIm9wdGlvbnNcIjp7XCJzdGFydFRpbWluZ0V2ZW50XCI6XCJuYXZpZ2F0aW9uU3RhcnRcIn0sXCJ0YXJnZXRzXCI6e1wiODMwOTIyMTA2NjIzMDY4OTM2OVwiOntcImZpbHRlcnNcIjpbXSxcImZpbmFsVXJsXCI6XCJodHRwczovL21vbmV5cGFyay5jaC9lbi90aGUtc2ltcGxlc3Qtd2F5L2Zvcm0vP3V0bV9zb3VyY2U9YWR3b3Jkc1xcdTAwMjZ1dG1fbWVkaXVtPWNwY1xcdTAwMjZ1dG1fY2FtcGFpZ249RU5fQ0hfQUFfTU9fR0ROX1JNS1RcXHUwMDI2Z2NsaWQ9RUFJYUlRb2JDaE1JdktpdHM2dWk3QUlWMGJKN0NoME9QQXNQRUFFWUFTQUFFZ0txN2ZEX0J3RVwiLFwidHJhY2tpbmdVcmxzXCI6W1wiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvYWNsaz9zYT1sXFx1MDAyNmFpPUNKSG05UzZGOVhfeldJdEhsN2dPTy1LeDR3cDZselYtN3U0ellxQXlQei1pZHN3a1FBU0RSaDlJZ1lQV1Z6b0hnQktBQmxJS0c1UVBJQVFhcEFnaHQ5MW5qUjdJLTRBSUFxQU1CeUFNS3FnU3VBMF9RbDRfQUlEN2RGVDB3aVlNeEw3ODZ1RFV1T1hjVllxN092R3pfTFp6eUdBVWl2TkxsREpfdmd3NGV0dG9pT3JReHBjQlNlMmFGRzJsbjM5cGpNUy1ram9sSE5fd2daaldOdUVsS3BlM0xJbVJ1ZnNUdkZ4UktvU1RJU0JsNW1wU25RWGtFQXJST0NXallfRGpwMUFwdHo0ak1WQTh3Qm9pMDBBNktIaFdJQkU1Z2FRNDFVUW90Q3lOVzdITjFQSDZpV0pGOFhzemh2TlVPTW4xU1dzQXFuTzVsOXVIVERaWEpfelJjT1NjM3gydXkyVzRoNWpydnZENndDcHV6cWF5WUViZkp0NXpnS3F3bmRjQTBYZXFMbFMxQVV4ZUxGQi1EVTEwdnVRZmV1eTk1YTVMMnJkam9pQTc2S3lPR2l6aVZNal9OMzRSM0owVnBlS1l3eTVaMkJfYy1VTlZxSnhIS0VfbTRPc1pkcGZuTXlXbkFVNkVOTGkxVDgybWNkUlRpYUtmV1RxOHpKMC1UbnZXeWRFMHZpYU9JcHVKdTNlY2JTeGZZMnZJbG5FWW9iMGlqU1VCcHAzRVhNZHdjanFTZkhqMlZHZEtkZnZGYzFIRkszTGMySUJrVlIzQXFXdDQ0ckNmQ3BwWFB0YkxJTUZkWmUyLXhFc2o4OVByQmhnLW84cm1zd3NWWTRhMWdtdnIxajQ5MHVXUzhSZEVTR3Q4X0xvQUZiM3VtZklaa3plVkpsN3FtQ0g2VFJvREFCTVRpcGQwZDRBUUJvQVkzZ0FmVV9ma2FxQWVPemh1b0I5WEpHNmdIazlnYnFBZTZCcWdIOE5rYnFBZnkyUnVvQi02V3NRS29CNmEtRzZnSDdOVWJxQWZ6MFJ1b0ItelZHNmdIbHRnYnFBZkMyaHZZQndIU0NBa0lnT0dBUUJBQkdCM3lDQnRoWkhndGMzVmljM2x1TFRjeU5qTTFOek0wTkRZNE1EUXdOeml4Q1phblh2WFMxR2ZDZ0FvRG1Bc0J5QXNCMkJNTWlCUURcXHUwMDI2YWU9MVxcdTAwMjZudW09MVxcdTAwMjZjaWQ9Q0FBU1BlUm9CMX&i=9-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: OIdWRk5ZW6GfxnffSf4IhT_AnTQUCIjoGa0YRS4BmngAtB52ty-vYA==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame 9CD0 0
425 B 76ms
75ms Other
text/plain 13.224.193.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=FBdGI0YWREdHdpSVY3dzZGcGlvRmk0cXQxSUtyb0dUdTFqLTNkRnNjT0pYYzZpWVBTcVN3dFUzZHpOSnU4TDFvN0czMmdQYk9DZlFnXFx1MDAyNnNpZz1BT0Q2NF8xb2ZGVU45TkJRVEtkby1kY0huZmxGRWVGUjFnXFx1MDAyNmNsaWVudD1jYS1wdWItOTY4NTczNDQ0NTQ3NjgxNFxcdTAwMjZuYj1fbmJcXHUwMDI2bng9Q0xJQ0tfWFxcdTAwMjZueT1DTElDS19ZXFx1MDAyNmFjdD0xXFx1MDAyNnJpPTFcXHUwMDI2YWR1cmw9aHR0cHM6Ly9tb25leXBhcmsuY2gvZW4vdGhlLXNpbXBsZXN0LXdheS9mb3JtLyUzRnV0bV9zb3VyY2UlM0RhZHdvcmRzJTI2dXRtX21lZGl1bSUzRGNwYyUyNnV0bV9jYW1wYWlnbiUzREVOX0NIX0FBX01PX0dETl9STUtUJTI2Z2NsaWQlM0RFQUlhSVFvYkNoTUl2S2l0czZ1aTdBSVYwYko3Q2gwT1BBc1BFQUVZQVNBQUVnS3E3ZkRfQndFXCJdLFwidmFyc1wiOntcIl9uYlwiOntcImRlZmF1bHRWYWx1ZVwiOlwiXCIsXCJpZnJhbWVUcmFuc3BvcnRTaWduYWxcIjpcIlwifX19fX08L3NjcmlwdD48L2FtcC1hZC1leGl0PjwvYm9keT48L2h0bWw%2BPCEtLSBJRlJBTUUgSU5ORVIgQ09OVEVOVCAtLT4iLCJtZXRhIjp7InBsUmF0aW8iOjAuMDF9fQ%3D%3D&i=10-10&t=adltag_kfzaemrv_t69ZRX2kXT8&r=d3f684cb178f30fa010acb1b978252a&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.112 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 25299
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Wed, 07 Oct 2020 04:05:14 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: 0dLiF_T6tdF8hK2JjT6UmnmOhdpVPnhSrNIRu4CgslrcDcDLpctQLA==

GET
H3-Q050

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 9CD0
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

43ms
42ms

Image
text/html

2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Wed, 07 Oct 2020 11:06:52 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/217/ Frame 0BE9 0
0 6ms
6ms Document
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/217/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/217/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4867
date: Wed, 07 Oct 2020 10:13:39 GMT
expires: Thu, 07 Oct 2021 10:13:39 GMT
last-modified: Mon, 21 Sep 2020 23:28:38 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3193
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-Q050 204 csi
csi.gstatic.com/ Frame 3ABB 0
326 B 72ms
32ms Other
image/gif 2a00:1450:4007:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kfzaemiz&c=1585622224713&slotId=792811112356.5&eee=missing-element&bi=missing-id
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4007:808::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:52 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 9DB4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

43ms
42ms

Image
text/html

2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Wed, 07 Oct 2020 11:06:52 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-Q050

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 7C43
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

43ms
43ms

Image
text/html

2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Wed, 07 Oct 2020 11:06:52 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18095304898287668287/ Frame 9CD0 6 KB
6 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e0dfdc9511d1bc5302b207c68d81ecd9a4ef11cb1f45f6d5821506d31c1658d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 05:43:32 GMT
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2019 15:23:35 GMT
server: sffe
age: 19400
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6130
x-xss-protection: 0
expires: Thu, 07 Oct 2021 05:43:32 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/8478110452070049984/ Frame 9CD0 21 KB
21 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35a32d460faa84b73cd644d1fc250fd7cbdf3d3724382980fa00a26df7670735

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:46:51 GMT
x-content-type-options: nosniff
last-modified: Mon, 16 Sep 2019 23:58:20 GMT
server: sffe
age: 69601
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21153
x-xss-protection: 0
expires: Wed, 06 Oct 2021 15:46:51 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9CD0 2 KB
3 KB 6ms
6ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 23:34:19 GMT
x-content-type-options: nosniff
server: cafe
age: 41553
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 23:34:19 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9CD0 295 B
319 B 6ms
6ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 47611
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 07 Oct 2020 21:53:21 GMT

GET
H/1.1

206
Partial Content

videoplayback
r2---sn-4g5ednle.googlevideo.com/
Redirect Chain

https://r2---sn-1gi7znes.googlevideo.com/videoplayback?expire=1602097612&ei=TKF9X6P7Ac2H8gPvqayADA&ip=185.156.175.107&id=6ae7a7fcab967ba5&itag=22&source=youtube&requiressl=yes&mh=br&mm=31&mn=sn-1gi...
https://r2---sn-4g5ednle.googlevideo.com/videoplayback?expire=1602097612&ei=TKF9X6P7Ac2H8gPvqayADA&ip=185.156.175.107&id=6ae7a7fcab967ba5&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&cti...

3 MB
3 MB

20ms
6ms

Media
video/mp4

2a00:1450:4001:57::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5ednle.googlevideo.com/videoplayback?expire=1602097612&ei=TKF9X6P7Ac2H8gPvqayADA&ip=185.156.175.107&id=6ae7a7fcab967ba5&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&ctier=L&mime=video/mp4&dur=29.605&lmt=1591682903286921&txp=5535432&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,dur,lmt&sig=AOq0QJ8wRgIhAKCdXE0xoQcvQ7oAUvWdvCLkgdwVSZoo-h3OGXSxHO7JAiEArdqUoybpvgFlxC0npz98VlpJgizbrUKmZeMomoVMxmA=&cpn=t71nK0SuO8VD9b75&redirect_counter=1&rm=sn-1giez7l&req_id=494ff35414d036e2&cms_redirect=yes&ipbypass=yes&mh=br&mip=2a01:4f8:192:5414::2&mm=31&mn=sn-4g5ednle&ms=au&mt=1602068688&mv=m&mvi=2&pl=40&lsparams=ipbypass,mh,mip,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRgIhAPl8AQk8KneTkZ7buseStqSDP0zUY19bIKx93d6Cwx8LAiEAqSAEG4DaQrlbmCMHHtNsWOOW-VycKoKH62Cisut6TIo%3D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:57::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

2db8fe679bd08f51e963e7f55420dd27030c555c7d2fa3f75af7ace27b42a104

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 11:06:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 09 Jun 2020 06:08:23 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-3524558/3524559
Cache-Control: private, max-age=28500
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 3524559
Expires: Wed, 07 Oct 2020 11:06:52 GMT

Redirect headers

Date: Wed, 07 Oct 2020 11:06:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 02 May 2007 10:26:10 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: text/html
Location: https://r2---sn-4g5ednle.googlevideo.com/videoplayback?expire=1602097612&ei=TKF9X6P7Ac2H8gPvqayADA&ip=185.156.175.107&id=6ae7a7fcab967ba5&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&ctier=L&mime=video/mp4&dur=29.605&lmt=1591682903286921&txp=5535432&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,dur,lmt&sig=AOq0QJ8wRgIhAKCdXE0xoQcvQ7oAUvWdvCLkgdwVSZoo-h3OGXSxHO7JAiEArdqUoybpvgFlxC0npz98VlpJgizbrUKmZeMomoVMxmA=&cpn=t71nK0SuO8VD9b75&redirect_counter=1&rm=sn-1giez7l&req_id=494ff35414d036e2&cms_redirect=yes&ipbypass=yes&mh=br&mip=2a01:4f8:192:5414::2&mm=31&mn=sn-4g5ednle&ms=au&mt=1602068688&mv=m&mvi=2&pl=40&lsparams=ipbypass,mh,mip,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRgIhAPl8AQk8KneTkZ7buseStqSDP0zUY19bIKx93d6Cwx8LAiEAqSAEG4DaQrlbmCMHHtNsWOOW-VycKoKH62Cisut6TIo%3D
Cache-Control: private, max-age=900
Connection: close
Content-Length: 0
Expires: Wed, 07 Oct 2020 11:06:52 GMT

GET
H3-Q050 200 9218822267371636908
tpc.googlesyndication.com/simgad/ Frame 9DB4 33 KB
33 KB 6ms
6ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9218822267371636908?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkTcHHEVVwGrZM4X6M3S4BuxiqH7g

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bdc060cb39aca616d2973647b7d55b2c5e7a8cfc41ca8b81370a68bfa4461b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 19:24:37 GMT
x-content-type-options: nosniff
last-modified: Thu, 01 Oct 2020 09:05:11 GMT
server: sffe
age: 56535
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34074
x-xss-protection: 0
expires: Wed, 06 Oct 2021 19:24:37 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9DB4 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 23:34:19 GMT
x-content-type-options: nosniff
server: cafe
age: 41553
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 23:34:19 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9DB4 295 B
319 B 6ms
6ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 47611
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 07 Oct 2020 21:53:21 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/10254325216188902687/ Frame 7C43 16 KB
16 KB 10ms
10ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ce7cfe7e2321139641863f7800584777bc76f66b58b52245c36ba4551168f29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 08 May 2020 09:08:31 GMT
server: sffe
age: 0
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16118
x-xss-protection: 0
expires: Thu, 07 Oct 2021 11:06:52 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5430776376497345576/ Frame 7C43 16 KB
16 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46f23e01311f1209f618ed0b6e79960ed2a26f6931c5edcdf7f0509e7f8a2e4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 09:49:58 GMT
x-content-type-options: nosniff
last-modified: Thu, 23 Aug 2018 15:35:20 GMT
server: sffe
age: 177414
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16849
x-xss-protection: 0
expires: Tue, 05 Oct 2021 09:49:58 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7C43 2 KB
2 KB 8ms
8ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 23:34:19 GMT
x-content-type-options: nosniff
server: cafe
age: 41553
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 23:34:19 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7C43 295 B
319 B 8ms
8ms Image
image/png 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 47611
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 07 Oct 2020 21:53:21 GMT

GET
H/1.1

200
OK

Cookie set iu3
aax-eu.amazon-adsystem.com/s/ Frame 771B
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t

0
0

218ms
217ms

Document
text/html

52.95.123.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.123.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash

Request headers

Host: aax-eu.amazon-adsystem.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ad-id=Aznpmhqg-EAgs37w-JsVi6c|t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

Server: Server
Date: Wed, 07 Oct 2020 11:06:53 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 193
Connection: keep-alive
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Set-Cookie: ad-id=Aznpmhqg-EAgs37w-JsVi6c; Domain=.amazon-adsystem.com; Expires=Thu, 01-Jul-2021 11:06:52 GMT; Path=/; Secure; HttpOnly; SameSite=None ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Thu, 01-Jan-2026 11:06:53 GMT; Path=/; Secure; HttpOnly; SameSite=None
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip

Redirect headers

Server: Server
Date: Wed, 07 Oct 2020 11:06:52 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t
Set-Cookie: ad-id=Aznpmhqg-EAgs37w-JsVi6c|t; Domain=.amazon-adsystem.com; Expires=Thu, 01-Jul-2021 11:06:52 GMT; Path=/; Secure; HttpOnly; SameSite=None
Vary: User-Agent

POST
H/1.1 200
OK ai Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 133ms
133ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ai?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:52 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ 2 KB
2 KB 38ms
37ms Image
image/webp 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by: Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:52 GMT
via: 1.1 varnish, 1.1 varnish
age: 1080227
x-cache: HIT, HIT
fastly-io-info: ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=2098 odim=400x225 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 2066
x-served-by: cache-dca17725-DCA, cache-hhn4057-HHN
x-timer: S1602068813.938006,VS0,VE0
etag: "iDhG33Z1a+GgxtfhSqjNbZ1Iz0hjRhSMeN4Q5WPVjm0"
vary: Accept
x-amz-request-id: 9718C29D2B1AEC8D
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1, 20

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
22 B 48ms
48ms Image
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=217&t=2&li=gpt_2020100501&jk=503200782921396&bg=!sbKlsqpYjUo85DC1XDICAAAAhFIAAAAOCgHLTaKF_k4O88ovKNC_4mf68oB4OWAvYudmagPvKT-CVpqKaI4QD-OMIp9zJ7ji382OQTHWREb1WO0SU2tOsQdq4WljqRkoynfvhEHAbX8XTXaQsCtEVn_pw9vzGICzBYpPU5yCJ_i5E-9ZAtwykSQfTkSJFFtq8XeBC1jKRncozt9T4JTDcSmCE_wXxf7Et_68jTz6BX3HqaoBvrju5SWcv6tNKgJd-hMMNxiBcKiQ42Eay9UQhOtj0xK6A3LjhSbwdKhzepxR1fHzQz48TbGQFmOGpKzvcImYWCvZe8SsLQG4COs64Qo_pjLHXjhtxbRWmMm5ESZM9UUjlHohutbQ2qr98NKSKpAwFwmAoG93MI5DMmcR0OZ5UPqgtAqI_qoCmE00KhTgROModsy7w5R0PSOQdl-KYYdjMQXxm6zl6K7wiIJ-WdVmabHtAFRDuXlgXwWzTbt-ETXbXjl2ZmhuqVxzNXFU2eMD1F_dgLh-LyOEHK7zZWrIsnTOryZJry8BP1vYC1_atAUJbJY2W53znvSA-NH-_Xapn8KBviK9OIkYdadgkR38nI6Pp47-GhiDYONRHdXUv3YE8mfBwkFxs94yYwEcr5jLVauTmQHCha7RMJOnPYBi-fJtEjm2kHXRz-M9niPW8pvny9Z2eWuRd2Isqa3s-F4uFRHy3_9KOuSKWDkQ8twG2Drq9BvAfiW861JwhHuZUc10mUcjl4NW9d6awZYeEIpDHfWtuIr1EHmaByNR03RJA5Z-GLvjvxLIqbMWD2jEdjbTp47dZMTbZEGEOhaijXD-SJD8U1yuRmfZJxRKAgC-FI953NEwbUCOaGX5XV4K3npiHS-rJOayqTT8jvOZUvWafUdHRgEputQYka4QlCAnql8cYW6_InJdbprXtnygNdW_Cpo0sKZyiZ3bYoDduiPgy1s5cQkaALgYTaYMU16GhUVsL4s4--f66jTKeqXsgwSAe3cs7qhH-MDvzDUgALD069MJjdueGz3YqcXF1-NhvoYuXfK7EdUnheyzrcj-7b0gTdz-jW-OJrGVl4ZHTOeeLKpdOBL3bwt2ZRYU6kWb5IKavNNV2Dwi9lpmd2yzPfkazyW4h18jqLF4uXTiIV88Ot8neBJhGHT-Hm01A4Nb1uxRwz76mWyHSnVlAz9rjLSdA8S6dEX4zeOk9oHkIjMiEg8vOOAh8tzsSgWVSqGBqxaf5ca3hO4d

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK sv Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 133ms
133ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sv?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:53 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 sync.html
public.servenobid.com/ Frame 9080 0
0 103ms
79ms Document
text/html 2620:1ec:bdf::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: public.servenobid.com
:scheme: https
:path: /sync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

status: 200
cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Mon, 05 Oct 2020 19:24:14 GMT
accept-ranges: bytes
etag: "4c283e1c2f7ded16fbd2588b41b9c3e3"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: OVC9hrS46Cqy0iqVztWanYdgiDomXvHCuU//DZ7HskwdfLqhZxCd0RZYStuj6MCT4YOOelNHji8=
x-amz-request-id: 8JDY7SDW5S2W1V6W
x-azure-ref-originshield: 09px8XwAAAAAkidamn1B4SbSiSLoZxERfTE9OMjFFREdFMTUxOQA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 0TaF9XwAAAAD6CLdCQC5ZSp7ZceyF3nS9RlJBRURHRTEwMjAAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
date: Wed, 07 Oct 2020 11:06:53 GMT

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 0191 0
0 314ms
82ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Wed, 07 Oct 2020 11:06:54 GMT
Content-Length: 1136
Connection: keep-alive

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 4B47 0
0 314ms
84ms Document
text/html 23.210.249.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-83.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: "5e7a2cb3-cefd"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 17037
Cache-Control: max-age=86402
Expires: Thu, 08 Oct 2020 11:06:56 GMT
Date: Wed, 07 Oct 2020 11:06:54 GMT
Connection: keep-alive

GET
H2

200

sync
eb2.3lift.com/ Frame 5712
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

64ms
61ms

Document
text/html

18.158.113.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.158.113.203 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=17469021213901115215
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

status: 200
date: Wed, 07 Oct 2020 11:06:54 GMT
content-type: text/html; charset=utf-8
content-length: 467
set-cookie: sync=CgoIgQIQoLL4ldAuCgoIoQEQoLL4ldAuCgoI4gEQoLL4ldAuCgoI5gEQoLL4ldAuCgoI1gEQoLL4ldAuCgoIhwIQoLL4ldAuCgkIOhCgsviV0C4KCQgLEKCy-JXQLgoJCF8QoLL4ldAuCgkIHxCgsviV0C4=; Max-Age=7776000; Expires=Tue, 05 Jan 2021 11:06:54 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=17469021213901115215; Max-Age=7776000; Expires=Tue, 05 Jan 2021 11:06:54 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

status: 302
date: Wed, 07 Oct 2020 11:06:54 GMT
content-length: 0
set-cookie: tluid=17469021213901115215; Max-Age=7776000; Expires=Tue, 05 Jan 2021 11:06:54 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame 8D19 0
0 105ms
100ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=6d8ca0bf-aa87-42ef-9c8e-5b334b5c892e|1602068810
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=6d8ca0bf-aa87-42ef-9c8e-5b334b5c892e|1602068810; Version=1; Expires=Thu, 07-Oct-2021 11:06:53 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1602068813|gekin0vNiygu; Version=1; Expires=Thu, 22-Oct-2020 11:06:53 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.194.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 07 Oct 2020 11:06:53 GMT
content-type: text/html
content-length: 419
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 487E 0
0 315ms
90ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=150526
Expires: Fri, 09 Oct 2020 04:55:40 GMT
Date: Wed, 07 Oct 2020 11:06:54 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 6274 0
0 310ms
88ms Document
text/html 104.111.230.142
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rsid=1|AIfsdBUH+v3fWCPuzNowDE/csJlhKa2tmCxRUZWfOglwroGWUmLiQsHya9WQi+HKKRWt2j6qYTD2eRvLWSDhFgX3ng06hUEE9RUpasHbexgjvGivYKlBNamTT8+Kbwv/ANSf; ses15=; vis15=300372^1; ses2=; vis2=300372^1; khaos=KFZAELGP-V-IQ7A; audit=1|hLZGFuTafB0gTfQArWZXpnp4/TMPY9XwKF5hhfT1XC85/NbXpPhFRkD3pCcW8TpHcpj76PKZXj8oT2OqK/B16qwRNgFmLHdP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Thu, 24 Sep 2020 16:43:28 GMT
Content-Encoding: gzip
Content-Length: 9446
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=16581
Expires: Wed, 07 Oct 2020 15:43:15 GMT
Date: Wed, 07 Oct 2020 11:06:54 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 1F66
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

386ms
93ms

Document
text/html

205.185.216.42
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04

Response headers

Date: Wed, 07 Oct 2020 11:06:54 GMT
Connection: Keep-Alive
Cache-Control: max-age=24351
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx0000000000000019426e3-005f7caeed-3ee9a51-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1602068814.dop029.pa1.t,1602068814.cds212.pa1.shn,1602068814.dop029.pa1.t,1602068814.cds204.pa1.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H2

204

sync
pixel.advertising.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=pInJtvDeyrC83M_j9YzTtKHezba82puz9dZQaCUz

0
124 B

299ms
81ms

Image
text/plain

3.126.63.176
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=pInJtvDeyrC83M_j9YzTtKHezba82puz9dZQaCUz

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.126.63.176 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-63-176.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 07 Oct 2020 11:06:54 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:53 GMT
status: 302
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=pInJtvDeyrC83M_j9YzTtKHezba82puz9dZQaCUz
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

204

sync
pixel.advertising.com/ups/55946/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUEzMmY5ZGY0NC0wODhkLTExZWItYjEyMy0xMjZmMWYxZWUyNWU%3D&gdpr=1&gdpr_consent=&_origin=0
https://pixel.advertising.com/ups/55946/sync?uid=CAESEKciDMAC8g5mUgG7ycLe0L4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

0
124 B

77ms
72ms

Image
text/plain

3.126.63.176
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55946/sync?uid=CAESEKciDMAC8g5mUgG7ycLe0L4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.126.63.176 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-63-176.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 07 Oct 2020 11:06:54 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:54 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.advertising.com/ups/55946/sync?uid=CAESEKciDMAC8g5mUgG7ycLe0L4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 334
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 sync
pixel.advertising.com/ups/56465/ 0
125 B 315ms
80ms Image
text/plain 3.126.63.176
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.126.63.176 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-63-176.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 07 Oct 2020 11:06:54 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D980603e9-e7f5-4dde-ad0c-a89329a7515e%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=index_rtb&uid=X32hSlVbL24AACJ7oacAAADE%26663

0
193 B

201ms
190ms

Image
text/plain

34.237.157.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=index_rtb&uid=X32hSlVbL24AACJ7oacAAADE%26663
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.157.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 07 Oct 2020 11:06:54 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:54 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=index_rtb&uid=X32hSlVbL24AACJ7oacAAADE%26663
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 320
Expires: Wed, 07 Oct 2020 11:06:54 GMT

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D980603e9-e7f5-4dde-ad0c-a89329a7515e%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D980603e9-e7f5-4dde-ad0c-a89329a7515e%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=appnexus&uid=5866401317439406104

0
193 B

202ms
193ms

Image
text/plain

34.237.157.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=appnexus&uid=5866401317439406104
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.157.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 07 Oct 2020 11:06:54 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Pragma: no-cache
Date: Wed, 07 Oct 2020 11:06:54 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 733.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.149:80
AN-X-Request-Uuid: be5c5c10-c39b-4cf8-8643-52cdce1e835f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=appnexus&uid=5866401317439406104
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 403 /
c1.adform.net/serving/cookie/match/ 0
188 B 317ms
0ms Image
text/plain 37.157.6.247
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?CC=1&party=15&gdpr=1&gdpr_consent=&curl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55944%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3d1%26gdpr_consent%3d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.247 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:54 GMT
server: nginx
status: 403
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D980603e9-e7f5-4dde-ad0c-a89329a7515e%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=sovrn&uid=f142e46104197fea70a436b6

0
193 B

378ms
170ms

Image
text/plain

34.237.157.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=sovrn&uid=f142e46104197fea70a436b6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.157.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 07 Oct 2020 11:06:54 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Date: Wed, 07 Oct 2020 11:06:53 GMT
Server: nginx
Location: https://prebid.a-mo.net/setuid?A=980603e9-e7f5-4dde-ad0c-a89329a7515e&D=&bidder=sovrn&uid=f142e46104197fea70a436b6
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
265 B 319ms
0ms Image
image/gif 34.249.135.160
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.135.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-135-160.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:54 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 306ms
75ms Image
text/plain 2a02:fa8:8806:12::1370
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A32f9df44-088d-11eb-b123-126f1f1ee25e&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1370 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Wed, 07 Oct 2020 11:06:53 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 9CD0 42 B
65 B 192ms
191ms Image
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss52TiP-Ifhori45Z0-DqZmmwQb_Sl-p6WvpTZRQaQmiAnFD978iVyYmT9ykYEfAZ8dec5JXnm_YsANUjrSmtMW9eC7sgcCvd6n9n7BKzgIEg7Fdkt796BOkNbKjx0YreITgin-Nux5W6bghHwX3aQ&sai=AMfl-YR5DPNCRqGvrNK2V1u8U_dFEMBoC5iN5pauMvZuf6zOcWKmo1dslniYJEboLGknkIPisP1jLpsGuQzfSVwpl1bB8Cwrs8nnZCkFV7kb8kX3wB2SckrElrnr6cNzi0gN&sig=Cg0ArKJSzNJEtaJnbxyvEAE&cid=CAASPeRoB1qAtb4adDtwiIV7w6FpioFi4qt1IKroGTu1j-3dFscOJXc6iYPSqSwtU3dzNJu8L1o7G32gPbOCfQg&id=ampim&o=436,10&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1013&mtos=0,0,1013,1013,1013&tos=0,0,1013,0,0&tfs=293&tls=1306&g=100&h=100&tt=1306&r=v&avms=ampa&adk=1015519800

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 9DB4 42 B
65 B 110ms
108ms Image
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss0FIHfgLGKY7sHLfeTaG5lAVvVg43bnFw6819GTzQSdjfbjPpKS1Hk-1_vgPkiNUB6YyZiACYAGhJnyu1p3Fx-1UZiUjLRuiVvYpQspT_19s99DqJ-pVTuleVLww&sai=AMfl-YToTij_CeHLEjl8zGXY7AH1dK_GMAFrzZoz4WiybHPS-j6VR5M1FzODf305IQENUVew6xwVvsh4wb1j7uh4dvgNQ9nOL76pehUyopFc5KqTkeWaDIa6zk13B2ELJ_Gt&sig=Cg0ArKJSzKnUshZBa0CWEAE&cid=CAASPeRoCNsOEZm4aqtL6pN6XcYLU_QfVl2QSm6sJh8pYtP6o393mN4Wg95ZM9tAsrxtDYYNJZMUcw4-lXB-qRQ&id=ampim&o=1082,257&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1006&mtos=0,0,1006,1006,1006&tos=0,0,1006,0,0&tfs=221&tls=1227&g=100&h=100&tt=1227&r=v&avms=ampa&adk=654286612

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame D7AA 0
0 74ms
71ms Document
text/html 23.210.249.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-83.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: uuid2=5866401317439406104
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: "5e7a2cb3-cefd"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 17037
Cache-Control: max-age=86402
Expires: Thu, 08 Oct 2020 11:06:56 GMT
Date: Wed, 07 Oct 2020 11:06:54 GMT
Connection: keep-alive

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame F1E1 0
0 99ms
92ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=156858:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=150526
Expires: Fri, 09 Oct 2020 04:55:40 GMT
Date: Wed, 07 Oct 2020 11:06:54 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame DD69 0
0 94ms
89ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Wed, 07 Oct 2020 11:06:54 GMT
Content-Length: 1136
Connection: keep-alive

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame FC8B 0
0 93ms
90ms Document
text/html 23.210.249.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-83.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: uuid2=5866401317439406104
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: "5e7a2cb3-cefd"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 17037
Cache-Control: max-age=86402
Expires: Thu, 08 Oct 2020 11:06:56 GMT
Date: Wed, 07 Oct 2020 11:06:54 GMT
Connection: keep-alive

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 807D 0
0 191ms
79ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=156858:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=150526
Expires: Fri, 09 Oct 2020 04:55:40 GMT
Date: Wed, 07 Oct 2020 11:06:54 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 6C85 0
0 185ms
79ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Wed, 07 Oct 2020 11:06:54 GMT
Content-Length: 1136
Connection: keep-alive

GET
H2 200 pd
u.openx.net/w/1.0/ Frame 8105 0
0 95ms
93ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=6d8ca0bf-aa87-42ef-9c8e-5b334b5c892e|1602068810; pd=v2|1602068813|gekin0vNiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=6d8ca0bf-aa87-42ef-9c8e-5b334b5c892e|1602068810; Version=1; Expires=Thu, 07-Oct-2021 11:06:54 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1602068813.1|kiiygevNgun0.mWgqsLommOns; Version=1; Expires=Thu, 22-Oct-2020 11:06:54 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.194.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 07 Oct 2020 11:06:54 GMT
content-type: text/html
content-length: 315
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 200 pd
u.openx.net/w/1.0/ Frame F41C 0
0 175ms
78ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=6d8ca0bf-aa87-42ef-9c8e-5b334b5c892e|1602068810; pd=v2|1602068813|gekin0vNiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=6d8ca0bf-aa87-42ef-9c8e-5b334b5c892e|1602068810; Version=1; Expires=Thu, 07-Oct-2021 11:06:54 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1602068813.1|kiiygevNgun0.mWgqsLommOns; Version=1; Expires=Thu, 22-Oct-2020 11:06:54 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.194.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 07 Oct 2020 11:06:54 GMT
content-type: text/html
content-length: 315
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame 3ABB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEOIz00SmxJ1hfFf1WBEgfyc&google_cver=1
https://pixel.advertising.com/ups/57304/sync?uid=CAESEOIz00SmxJ1hfFf1WBEgfyc&google_cver=1&verify=true
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEOIz00SmxJ1hfFf1WBEgfyc&google_cver=1&apid=UP35819ea5-088d-11eb-8739-02bdf99ce582

0
963 B

483ms
70ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEOIz00SmxJ1hfFf1WBEgfyc&google_cver=1&apid=UP35819ea5-088d-11eb-8739-02bdf99ce582

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 11:06:55 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Wed, 07 Oct 2020 11:06:54 GMT
location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEOIz00SmxJ1hfFf1WBEgfyc&google_cver=1&apid=UP35819ea5-088d-11eb-8739-02bdf99ce582
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame 3ABB 43 B
839 B 191ms
76ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 07 Oct 2020 11:06:54 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55986/ Frame 3ABB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
https://pixel.advertising.com/ups/55986/sync?uid=X32hTgAAAEn_Uik1&_origin=0&gdpr=0&gdpr_consent=&_test=X32hTgAAAEn_Uik1
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X32hTgAAAEn_Uik1&_origin=0&gdpr=0&gdpr_consent=&_test=X32hTgAAAEn_Uik1&apid=UP35819ea5-088d-11eb-8739-02bdf99ce582

0
963 B

179ms
38ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55986/sync?uid=X32hTgAAAEn_Uik1&_origin=0&gdpr=0&gdpr_consent=&_test=X32hTgAAAEn_Uik1&apid=UP35819ea5-088d-11eb-8739-02bdf99ce582

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 11:06:55 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Wed, 07 Oct 2020 11:06:54 GMT
location: https://ups.analytics.yahoo.com/ups/55986/sync?uid=X32hTgAAAEn_Uik1&_origin=0&gdpr=0&gdpr_consent=&_test=X32hTgAAAEn_Uik1&apid=UP35819ea5-088d-11eb-8739-02bdf99ce582
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

generic
match.adsrvr.org/track/cmb/ Frame 3ABB
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1

70 B
370 B

104ms
89ms

Image
image/gif

34.249.135.160
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.135.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-135-160.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:54 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

Redirect headers

pragma: no-cache
date: Wed, 07 Oct 2020 11:06:54 GMT
x-aspnet-version: 4.0.30319
status: 302
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 165

POST
H/1.1 200
OK av Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 233ms
133ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/av?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:55 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 141ms
140ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:56 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 133ms
133ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:06:57 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK aq Show response
capi.connatix.com/tr/ Frame 3ABB 0
323 B 133ms
133ms XHR
multipart/form-data 3.128.209.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/aq?v=64536
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.128.209.198 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 07 Oct 2020 11:07:01 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

Verdicts & Comments Add Verdict or Comment

295 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.threatpost.com/	1970-01-19 22:25:37	Name: __qca Value: P0-908932403-1602068811191
.threatpost.com/	1970-01-19 13:01:08	Name: _gat_UA-35676203-21 Value: 1
threatpost.com/	1970-01-19 21:46:44	Name: usprivacy Value: 1---
.threatpost.com/	1970-01-19 13:02:35	Name: _gid Value: GA1.2.643618841.1602068810
.threatpost.com/	1970-01-20 06:32:20	Name: _ga Value: GA1.2.223366644.1602068810

49 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://info.silobreaker.com/e2t/tc/MWCkWQ1yDYhW3qLLPB7njBKNW5DT7xy4gV3pTN4FBQLV2-HvSV1-WJV7CgXzCW7HLnTN3KqtG1VGgRPh4Cd3hYW6r2WVP8b5vTmW51J0z160sXRcW62SxV81WWNVVW94q2Rc4b4fk6VbzmpD11jwQlW14S8y81Xh-nwW4tRqpn1hjJ4zW43p49h98jxrJW50qpfR2NWCwFW7JbQYk3X6vqjW15NGzH5vYXgVW8nRkhQ171nspW5SWnxh7NJy6rW3XhYzd89VH-nW5C3LhV84YrQZW47kzxz4rbF-tW11NK583xsJ1-N9fdFQCmctQMVZK6vt7k8N_bN6D27MbXGyrg34w31(Line 13) Message: toS
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 372) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Startup v238
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: uspapi_init() - v0.105
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: USP: Locale=en-us gdpr= false
console-api	warning	URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: final pbjs config
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Initial Ad Load
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch begin
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: checking non TCF vendor cookie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing non-TCF consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch(): addEventListener:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: GDPR does not apply
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch(): addEventListener:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs bids returned
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gPBJSTimeoutTimer cleared
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	warning	URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: geo IP found region Basel-Landschaft
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: USP does not apply to Basel-Landschaft
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: Setting not applicable signal
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Amazon bids returned, count=4
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): amazonBidsBack
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getBidResponses:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gThisRefreshSlots=
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: console.groupEnd
console-api	info	URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2009282107000 https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
console-api	info	URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2009282107000 https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
console-api	info	URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2009282107000 https://threatpost.com/covid-19-clinical-trials-ransomware/159877/?_hsmi=88974744&_hsenc=p2ANqtz-_rDycyIw4IbkRVxNbMepOraIlpQFamuRUs5XFxOLhdKspMXFrSC7BBW05Tgi73Q2LNiCBd8FYVohbuwHoTK28zH-SmFsTW_YVOoBZru_Xe_RVpB04
console-api	log	(Line 7) Message: CNX-ad-imp

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-eu.amazon-adsystem.com
acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
aol-match.dotomi.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
c1.adform.net
capi.connatix.com
cd.connatix.com
cdn.ampproject.org
cds.connatix.com
cm.g.doubleclick.net
csi.gstatic.com
e.serverbid.com
eb2.3lift.com
ec20b48d4567d77ce3b9d37ea692291e.safeframe.googlesyndication.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
geo.ipify.org
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
ib.adnxs.com
imasdk.googleapis.com
img.connatix.com
info.silobreaker.com
js-sec.indexww.com
kasperskycontenthub.com
match.adsrvr.org
math-aids-threatpost-tagan.adlightning.com
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
r2---sn-1gi7znes.googlevideo.com
r2---sn-4g5ednle.googlevideo.com
rules.quantcount.com
s0.2mdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
ssum.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
vid.connatix.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
104.111.215.135
104.111.230.142
104.244.42.133
104.244.42.3
13.224.193.112
151.101.112.157
151.101.114.137
151.101.114.49
151.101.14.137
151.101.194.137
165.227.252.242
167.172.1.14
172.217.18.98
172.217.23.130
18.156.0.31
18.158.113.203
185.33.221.11
185.64.189.112
199.232.53.140
205.185.216.42
23.210.249.164
23.210.249.83
23.210.249.92
2600:9000:203c:6000:6:44e3:f8c0:93a1
2600:9000:20eb:3e00:0:5c46:4f40:93a1
2600:9000:2156:b200:2:9275:3d40:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700::6811:7bb4
2606:4700:e6::ac40:c31a
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:21::14
2620:1ec:bdf::10
2a00:1288:110:c305::8000
2a00:1450:4001:57::8
2a00:1450:4001:800::200a
2a00:1450:4001:806::2003
2a00:1450:4001:808::2003
2a00:1450:4001:809::2006
2a00:1450:4001:814::2002
2a00:1450:4001:815::2001
2a00:1450:4001:815::2003
2a00:1450:4001:816::2008
2a00:1450:4001:818::2001
2a00:1450:4001:81b::2001
2a00:1450:4001:81b::200a
2a00:1450:4001:81c::2002
2a00:1450:4001:81c::200a
2a00:1450:4001:81d::2004
2a00:1450:4001:81f::200e
2a00:1450:4001:825::2002
2a00:1450:4007:808::2003
2a00:1450:400a:9::7
2a00:1450:400c:c06::9a
2a02:fa8:8806:12::1370
2a03:2880:f01c:800e:face:b00c:0:2
3.126.63.176
3.128.209.198
34.237.157.170
34.241.71.237
34.249.135.160
35.156.107.113
35.173.160.135
35.244.159.8
37.157.6.247
52.58.71.47
52.84.112.113
52.84.113.143
52.95.123.167
64.140.160.2
69.173.144.143
72.251.249.13
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
0065bb71138a0636731ddfa21587233b21d0706ce5dcba223e00a9c1ad98f19a
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
01c3a4ce829c1fbf0971eb258b96314724a64d2c5e50b8c088f60328c4f35df1
03649218aa84e7a154d4f4bbd90ee1c29ec4bc7457e0c302a86d1b37fc3f8867
039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
0556999beeb2bafc5f0ebcf90d9642f7e2b3c0e10c0e1d87ce035545328b224d
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
072ab2e24f8ac0a6f43c0c0214b33e72c1f80b4cdea9503a416483a3d4cee21f
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0ce7cfe7e2321139641863f7800584777bc76f66b58b52245c36ba4551168f29
116e5aa02b653ec7db7a5f7f7054c164f75feb9ceb7814d9f6affe326cd5f81a
14f61c0a45e00c687f4f0801fd4111430eda8e18275cf81d2d62f46ef9c6fa54
15e9840f31982980328598c38e5c60434072901f2c902713ef9c4d4900e05307
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
185d5ff3cb0b3a389078f0bef7eb09cbb75c7e50a4047dceb2339424ba239429
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
239733db63c823ff0f27720321732ff16ae6591fd0a41b6793ee665e9226b42f
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9
2a342ab6bee2e8546163f7798ea3978ce275888e65c62f01e57eb000d22dd5d0
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2bdc060cb39aca616d2973647b7d55b2c5e7a8cfc41ca8b81370a68bfa4461b1
2db8fe679bd08f51e963e7f55420dd27030c555c7d2fa3f75af7ace27b42a104
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2ffe521369b76cf33cc43c0bf1c7d0364b994ae528adb8b6b23aea7e1f485b03
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
33901d23b88c104fc2e9d2d029542d2c89eb30dff24f698f339a175d3a4267fa
34163ada8ec5c994e662bd733588938b4bcf7d709e8f27fce5d817c42526a439
3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5
35a32d460faa84b73cd644d1fc250fd7cbdf3d3724382980fa00a26df7670735
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36ea03bb3518394f6f6559784b58b800653eb18b629eebc7dfe09f42ca43a47f
3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3bf5e5a5381944084f99c7a3bb3e2dd4771902f6aa5cbc412f412c4711fc80f7
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
46f23e01311f1209f618ed0b6e79960ed2a26f6931c5edcdf7f0509e7f8a2e4b
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
499c5a9228a8f4eb18a0d0f6d1ff3f02245776d3d26e90070ef3e5199af085d1
4dfa3a43d01512ef5180464359b4272bf14570f2fcfd26904a400b0664d7fd71
4ecfa64a701a71b3e640b8806d0a0f43753d7c53a1fafd8e773dc2c8620bca38
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
538b0b758da92e30e5faa05193488c5c3f93538eed46494649783cdfccc3068d
5876f68bf30a82eb99d9ec29e561f5c925ea347243c3e022021dd87823c65813
591d09bb8a2193a0324896b819b64a80c043e51071fea910995d42f688249965
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
60f4bee6c11ccdbfdc12e297a909d4b22b043a5ed5be0450960f4a1e7181b1b6
6211a4606fe7072356e3224f9fa7385ccaab22889c201db12a759ccdd4305e01
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
6ad38a3b2980c56582422f7982441150b4cb9b6d946979c5bd14457ade184cf1
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57
6e0dfdc9511d1bc5302b207c68d81ecd9a4ef11cb1f45f6d5821506d31c1658d
71773ad95c85f98348e623cf8ca320b7834511ab5dd8f2f110d73808eecc9173
7379335cd9f3d277bedb32028c3126359baa1ce7b6d43c8e19698e8d4b3782b7
791135f98b21bbd99c1cbcd56e2827cab155856c144602a8749a57acaa5aa813
7d0a56533a6883357182ea8c20b0649f2e1bf359c732246d1780f375c5fa4daf
7e12e8c837766da5daa890c579163a37d2bc1c8b4e956d5ded9ea37d3c3f2c90
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
82f60467c442f1292050ac1673c3074047283bfd9ff9be7480a65fddf6a24969
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
87adcd951526f566dd8a1eb655a8c4736a3bad8167f6e09a255e54650aeeb655
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e3b65c9ba7bc049f2d690aa5bf77e27921d07e4119826ca54726081584157d2
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d
91f1a6b77eca7c8f180f3b0f52308bd754a2c03db65594381365323c99a3c54f
93ee1cf33c2f89ea4b40725a3fa6e12ef339841146b9725bab9d7607afd25f39
95a588b736d6341c1040f51b4491b20d8a215544160c70128fb56643a81a6cf4
95e9d32cd4913300b99a678b253eb36962f32e02ff06fc56176c54d5967a8588
98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08
9ef0cc99ae155124895f712a9b68285f7b0a8c3f3c151e86107a25b61cf22085
9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
aa90c2d77583dd25e7fbdc1411c8d718f29d9665ab48f985ffe6f3a38b34b6a7
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552
ac4ef908129db8daeddac032d978d5c8944f6dbb6eea49ead9ed216ddbf16f10
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b0c671ac97d882d197521eaa9f2ef51b4ce6899520ec43471e04e25fa40f782a
b2b66d94581872c3528b84fdf93298b3dc91dc7fd97ef1012740a3a7389ced5e
b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef
c2fc358dbbf2a7c80b1f45be493848dc05b65a71a063ec4a8c620c65c0622bad
c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc
c6879bf69ca14159cb61c4420c496946a303da8a9a37f6e0b4f4e12e79cbbf06
c718e2c8d750801ee84db85084f6d862318ad1711d0a80523ea247a42ed2ca64
c79988700fbb1c66daba344650a7a0679ba4f34ec6f52d5cdffef16dd8748796
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cc609056631b36cdd26ce90db1eb9ac8628d155d5f1dabd522be1db5772a7a4d
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
ce9fc9f45a3f5d71caa5b1cb264f152f8d1a1aad40d91fe4247c083521340ff5
d00e1ffbde89afc301abf43ed68bc52d7d7bae9f81d0bd93638394f4e287b12f
d3838febe02ee1538a1336ac01f452a6fe7682106cd21b46cda9c40092c8e3aa
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d89d98593ac65c9f002b856f3e22a1479f3aea866f7fd15c85903c0a6d66f0e3
d8aa22200ab4c8fa70aa53ff832f12b9064acafc1db78c8f3d2ba5cce688e620
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e065984f0b5379a6b11ab4dc497fe57f7b56efd8326952d59ae1d57566e9fe4e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3
e8fb48dbf4c0d6ee5c317fa722351493db6756e0603c32af7c21e6211e8c6d97
ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1368681d37c38bbbded5fb55ed12b9fcf6bf44329b19251c3fba5f2afac24cd
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f34e56bbdec33105361cc35f3805704b6d3df415b0bf044ef2a6f11764bd8a20
f45068d9955109994e74e581521de618f9f6aea2414383c1aa8096eabc780ee4
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
fc7fd2b763c01bb2e44e93a500790491d8f950a5631e81f606373e68593ba308
ff192cb613e7624adcb95906971aaf4f746bf22d5bdb0316e00d0fe319d2df10

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

259 Requests

100 %HTTPS

45 %IPv6

46 Domains

79 Subdomains

68 IPs

8 Countries

7364 kBTransfer

12327 kBSize

5 Cookies

14 Outgoing links

Page URL History

Redirected requests

259 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

259
Requests

100 %
HTTPS

45 %
IPv6

46
Domains

79
Subdomains

68
IPs

8
Countries

7364 kB
Transfer

12327 kB
Size

5
Cookies

259 HTTP transactions
4 data transactions