blog.confiant.com Open in urlscan Pro
52.6.3.192 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
Effective URL:
https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
Submission: On September 30 via api (September 30th 2019, 4:15:16 pm UTC) from US

Summary HTTP 70 Redirects Links 30 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 9 domains to perform 70 HTTP transactions. The main IP is 52.6.3.192, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is blog.confiant.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 29th 2019. Valid for: a year.

This is the only time blog.confiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 8	52.6.3.192 52.6.3.192	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	2606:4700::68... 2606:4700::6810:797f	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
44	2606:4700::68... 2606:4700::6810:7691	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2606:4700::68... 2606:4700::6810:7791	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a02:26f0:6c0... 2a02:26f0:6c00:196::13b8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	143.204.208.228 143.204.208.228	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	143.204.214.105 143.204.214.105	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	52.70.55.238 52.70.55.238	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2600:9000:214... 2600:9000:214f:2000:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2600:9000:214... 2600:9000:214f:2800:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	54.164.26.255 54.164.26.255	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	3.215.56.5 3.215.56.5	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
70	13

8 52.6.3.192 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-6-3-192.compute-1.amazonaws.com

blog.confiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:797f (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

44 2606:4700::6810:7691 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7791 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:196::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.208.228 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-208-228.fra53.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.214.105 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-214-105.fra53.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.70.55.238 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-70-55-238.compute-1.amazonaws.com

srv-2019-09-30-16.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:2000:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:214f:2800:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.164.26.255 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-164-26-255.compute-1.amazonaws.com

collector-medium.lightstep.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.215.56.5 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-215-56-5.compute-1.amazonaws.com

errors.client.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
48	medium.com 1 redirects medium.com glyph.medium.com miro.medium.com cdn-client.medium.com	812 KB
8	confiant.com 2 redirects blog.confiant.com	27 KB
5	lightstep.com collector-medium.lightstep.com	2 KB
4	branch.io cdn.branch.io api2.branch.io	23 KB
2	parsely.com srv-2019-09-30-16.pixel.parsely.com	765 B
2	optimizely.com cdn.optimizely.com errors.client.optimizely.com	83 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	app.link app.link	729 B
1	cloudfront.net d1z2jf7jlzjs58.cloudfront.net	17 KB
70	9

	Domain	Requested by
33	miro.medium.com	blog.confiant.com
10	cdn-client.medium.com	blog.confiant.com cdn-client.medium.com
8	blog.confiant.com	2 redirects cdn-client.medium.com
5	collector-medium.lightstep.com	cdn-client.medium.com
4	glyph.medium.com	blog.confiant.com www.google-analytics.com
3	api2.branch.io	cdn-client.medium.com
2	srv-2019-09-30-16.pixel.parsely.com	d1z2jf7jlzjs58.cloudfront.net
2	www.google-analytics.com	blog.confiant.com
1	errors.client.optimizely.com	cdn-client.medium.com
1	app.link	cdn.branch.io
1	cdn.branch.io	blog.confiant.com
1	d1z2jf7jlzjs58.cloudfront.net	cdn-client.medium.com
1	cdn.optimizely.com	cdn-client.medium.com
1	medium.com	1 redirects
70	14

This site contains links to these domains. Also see Links.

Domain
medium.com
www.virustotal.com
help.medium.com

Subject Issuer	Validity	Valid
blog.confiant.com Sectigo RSA Domain Validation Secure Server CA	`2019-08-29` - `2020-08-28`	a year	crt.sh
*.medium.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-09-09`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
cdn.optimizely.com DigiCert ECC Secure Server CA	`2018-11-24` - `2020-02-23`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.branch.io DigiCert SHA2 Secure Server CA	`2018-12-05` - `2020-12-08`	2 years	crt.sh
*.pixel.parsely.com Amazon	`2019-02-27` - `2020-03-27`	a year	crt.sh
appipv4.link Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
*.lightstep.com Let's Encrypt Authority X3	`2019-07-15` - `2019-10-13`	3 months	crt.sh
errors.client.optimizely.com DigiCert SHA2 High Assurance Server CA	`2018-09-24` - `2020-09-28`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
Frame ID: 749B7BAB0687865232254E32902CBCAE
Requests: 74 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd HTTP 301
https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fmalvertising... HTTP 302
https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

70
Requests

100 %
HTTPS

54 %
IPv6

9
Domains

14
Subdomains

13
IPs

3
Countries

1009 kB
Transfer

2626 kB
Size

0
Cookies

30 Outgoing links

These are links going to different origins than the main page.

URL: https://medium.com/?source=post_page-----9d0218fe02cd----------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_page-----9d0218fe02cd---------------------nav_reg-
Title: Sign in

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_page-----9d0218fe02cd---------------------nav_reg-
Title: Get started

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_page-b695b22b2d84----9d0218fe02cd----------------------
Title: Follow

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/#/url/b5e1a4a04037a5dba111987f927e37df7b6861593e40f647239ba82dbee4b1de/detection
Title: https://www.virustotal.com/#/url/b5e1a4a04037a5dba111987f927e37df7b6861593e40f647239ba82dbee4b1de/detection

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/#/url/46832020f01bc0bf996b74aaec278447f01fe3f92e41ab10d6a7370a3b703671/detection
Title: https://www.virustotal.com/#/url/46832020f01bc0bf996b74aaec278447f01fe3f92e41ab10d6a7370a3b703671/detection

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_sidebar--------------------------follow_sidebar-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_sidebar-----9d0218fe02cd---------------------clap_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_actions_footer-----9d0218fe02cd---------------------clap_footer-

Search URL Search Domain Scan URL

URL: https://medium.com/p/9d0218fe02cd/share/twitter?source=follow_footer--------------------------follow_footer-

Search URL Search Domain Scan URL

URL: https://medium.com/p/9d0218fe02cd/share/facebook?source=follow_footer--------------------------follow_footer-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_actions_footer--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=follow_footer-b695b22b2d84-------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=follow_footer--------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/9d0218fe02cd/responses/show?source=follow_footer--------------------------follow_footer-
Title: Write the first response

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_recirc-----cd31e885c202----0-----------------clap_preview-

Search URL Search Domain Scan URL

URL: https://medium.com/netflix-techblog/growth-engineering-at-netflix-accelerating-innovation-90eb8e70ce59?source=post_recirc---------1------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_recirc-----90eb8e70ce59----1-----------------clap_preview-

Search URL Search Domain Scan URL

URL: https://medium.com/netflix-techblog/streaming-video-experimentation-at-netflix-visualizing-practical-and-statistical-significance-7117420f4e9a?source=post_recirc---------2------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&source=post_recirc-----7117420f4e9a----2-----------------clap_preview-

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----9d0218fe02cd----------------------
Title: Discover Medium

Search URL Search Domain Scan URL

URL: https://medium.com/topics?source=post_page-----9d0218fe02cd----------------------
Title: Make Medium yours

Search URL Search Domain Scan URL

URL: https://medium.com/membership?source=post_page-----9d0218fe02cd----------------------
Title: Become a member

Search URL Search Domain Scan URL

URL: https://help.medium.com/?source=post_page-----9d0218fe02cd----------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://medium.com/policy/9db0094a1e0f?source=post_page-----9d0218fe02cd----------------------
Title: Legal

Search URL Search Domain Scan URL

URL: https://medium.com/policy/f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd HTTP 301
https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd HTTP 302
https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

70 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd Show response
blog.confiant.com/
Redirect Chain

http://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

117 KB
24 KB

1863ms
1863ms

Document
text/html

52.6.3.192
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-6-3-192.compute-1.amazonaws.com

Software

nginx /

Resource Hash

c94c22c6e66c1b86f0bcb32c29ec785d9cdb5635e29a346904629a4508567197

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

:method: GET
:authority: blog.confiant.com
:scheme: https
:path: /malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
server: nginx
date: Mon, 30 Sep 2019 16:14:56 GMT
content-type: text/html; charset=utf-8
set-cookie: uid=lo_hc8EWmE21QC4; path=/; expires=Tue, 29 Sep 2020 16:14:55 GMT; secure; httponly sid=1:wKF3MD+GBoMdcNTGLI0By+1ltgnuIiRX/5bYm7dpcUfZKFuahAREh+a77oTCxp3k; path=/; expires=Tue, 29 Sep 2020 16:14:55 GMT; secure; httponly
sepia-upstream: production
x-frame-options: allow-from medium.com
medium-fulfilled-by: lite/master-20190927-212403-dd93056394, rito/master-20190927-215453-adbdf1bca5, tutu/38726-0dfe868
etag: W/"1d259-L6/64d1hK/+pLGpEBjryTs9tRUs"
vary: Accept-Encoding
content-encoding: gzip
x-envoy-upstream-service-time: 1725

Redirect headers

status: 302
date: Mon, 30 Sep 2019 16:14:54 GMT
content-type: application/octet-stream
set-cookie: __cfduid=d4087179c2530449d033c5599a67a48401569860094; expires=Tue, 29-Sep-20 16:14:54 GMT; path=/; domain=.medium.com; HttpOnly uid=lo_hc8EWmE21QC4; Expires=Tue, 29-Sep-20 16:14:54 GMT; Domain=.medium.com; Path=/; Secure; HttpOnly sid=1:4KtWicf3l05Rn+uiX0WrzcrDeSAYEpi/VSXo22Ysg/B+Je9njU1ukLTk3uzpDDiA; path=/; expires=Tue, 29 Sep 2020 16:14:54 GMT; domain=.medium.com; secure; httponly __cfruid=347630082b7da19c52450c92afb924fa3d68c9b7-1569860094; path=/; domain=.medium.com; HttpOnly
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1569860094803:25fab3809a6b
x-obvious-info: 38734-db833d1,db833d18037
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
location: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
strict-transport-security: max-age=15552000; includeSubDomains; preload
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 51e77e1798475964-VIE

GET
H2 200 m2.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 44 KB
29 KB 38ms
34ms Stylesheet
text/css 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 323
status: 200
access-control-max-age: 86400
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 51e77e258d555a06-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Mon, 30 Sep 2019 20:14:56 GMT

GET
H2 200 1*lwwdz5iU5bY2ZzaF5qP-Hw.png
miro.medium.com/max/174/ 8 KB
8 KB 39ms
34ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/174/1*lwwdz5iU5bY2ZzaF5qP-Hw.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

7b291bac4cab78306a75e1a45638905656722c05eea8ddf56f41048bbd7588a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7038
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3204-f09a946
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 7844
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e258d565a06-VIE
expires: Wed, 30 Oct 2019 16:14:56 GMT

GET
H2 200 1*3Y-jP5U2-HsjZsjmVjy8PA.png
miro.medium.com/fit/c/96/96/ 2 KB
2 KB 170ms
165ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/96/96/1*3Y-jP5U2-HsjZsjmVjy8PA.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

e658be4f48eb6f0e9edd2ca9d90c43e3035a6d970dc901689feaa2bd0dc22b63

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 1618
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e258d595a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 GMT

GET
H2 200 0*3B-oksHZPtkHsfih
miro.medium.com/max/60/ 8 KB
8 KB 186ms
185ms Image
image/gif 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*3B-oksHZPtkHsfih?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

7cbd2debba636d6de6bdc4c597118c083c934c49c5a8a5444c84c3bcd73d0a1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 7812
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/gif
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e25dd7d5a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80b::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 6538
date: Mon, 30 Sep 2019 14:25:58 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Mon, 30 Sep 2019 16:25:58 GMT

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.confiant.com

Response headers

Content-Type: font/opentype

GET
H2 200 fell-400-normal.woff
glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 14 KB
14 KB 70ms
70ms Font
application/font-woff 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7039
status: 200
access-control-max-age: 86400
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 51e77e260cc3cbc4-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.confiant.com

Response headers

Content-Type: font/opentype

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.confiant.com

Response headers

Content-Type: font/opentype

GET
H2 200 marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 14 KB
15 KB 33ms
32ms Font
application/font-woff 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 55973
status: 200
access-control-max-age: 86400
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 51e77e262d65cbc4-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 0*NiwC8ta85zxy2O7m
miro.medium.com/max/34/ 3 KB
3 KB 220ms
218ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/34/0*NiwC8ta85zxy2O7m?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

7ae8eda2c07f5838b8371cb4201171613fe9a52aeb04bb8efe97ff01bc462d2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 2698
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e263de75a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*mC8UWALzPIhRncUl
miro.medium.com/max/34/ 2 KB
3 KB 352ms
350ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/34/0*mC8UWALzPIhRncUl?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

eba4c89e4442ca5e503a274c281841632953833beb37a05835758fd1c0fc59e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 2558
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e263de95a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*nO26JyvvgSYVfMOV
miro.medium.com/max/34/ 2 KB
2 KB 444ms
442ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/34/0*nO26JyvvgSYVfMOV?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

c6576db616c5497d13204eddb011b38fbd15f94249887afbafed9f77eaf95f4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 2232
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e263dea5a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*Wd89cuS_uOLyMK_i
miro.medium.com/max/60/ 2 KB
2 KB 192ms
191ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*Wd89cuS_uOLyMK_i?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

8320163c0d005d17448757260965ce18cbef6c82c2ca320a42cb790a5783d92d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 2300
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e264deb5a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*yawrfdMaklt7hjvg
miro.medium.com/max/34/ 2 KB
2 KB 360ms
359ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/34/0*yawrfdMaklt7hjvg?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

74cc3d3fa2f0e9d87e92f07e8382e1ecc522716bdcadb54597f44c02e419e936

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 1735
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e26ae3f5a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*pCW8G84pgbecSv1y
miro.medium.com/max/60/ 1 KB
1 KB 185ms
185ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*pCW8G84pgbecSv1y?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

4665b35d29422d7ac8cc098831967548548333a4e3ac29c64e1aaf4b1a588812

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 1424
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e275ef95a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*ZNWU4GOqd_10mFwi
miro.medium.com/max/60/ 1 KB
1 KB 203ms
203ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*ZNWU4GOqd_10mFwi?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

6b3ad759afacddbdad073984f6432f9ed9b978b5be8f76c9ba19ca0ad51fe276

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 1443
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e277f0b5a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*KIiEnR4XYjgCVO6Y
miro.medium.com/max/60/ 900 B
964 B 168ms
168ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*KIiEnR4XYjgCVO6Y?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

88263aceb0ae5d452ba0388704e9681e8a45ee77a66b7f1f37b3137c24deef10

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 900
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e279f305a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 1*3Y-jP5U2-HsjZsjmVjy8PA.png
miro.medium.com/fit/c/160/160/ 3 KB
3 KB 137ms
136ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*3Y-jP5U2-HsjZsjmVjy8PA.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

1669b5143789ac63a25e82a7adf595e11583d7e5c4acd386d5fef99ac90f7e7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 2628
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2878005a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 GMT

GET
H2 200 1*Gzx_yxzR1l1GX0h8J75gfQ.png
miro.medium.com/fit/c/160/160/ 9 KB
9 KB 33ms
33ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*Gzx_yxzR1l1GX0h8J75gfQ.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

f25e38427a40e8d86aee0f6077a7dc2e8d2178a3e93d18b9e11abe025f2809cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7039
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 8946
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e28880b5a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 GMT

GET
DATA 200
OK truncated
/ 156 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173

Request headers

Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 charter-700-normal.woff
glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
10 KB 40ms
40ms Font
application/font-woff 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-700-normal.woff

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 55973
status: 200
access-control-max-age: 86400
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 51e77e265e52cbc4-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 15ms
14ms Image
image/gif 2a00:1450:4001:80b::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1749306806&t=pageview&_s=1&dl=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd%3Fgi%3D506784937b05&ul=en-us&de=UTF-8&dt=Malvertising%20Attack%20Hijacks%20300%20Million%20Sessions%20Over%2048%20Hours&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1843167227&gjid=2138817525&cid=1173955143.1569860097&tid=UA-24232453-2&_gid=1983840441.1569860097&_r=1&z=730074410

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 manifest.e45d1a10.js Show response
cdn-client.medium.com/lite/static/js/ 4 KB
2 KB 71ms
55ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.e45d1a10.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e90ebb4d1748bb5f43a9115cd9d1e3954e356a05f1999480f85217bfbe5f8c2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 239439
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: 6064F9443D7CFC5D
x-amz-id-2: ec9MzFN+5/o55vou0CTmMH3ax9wFVs8xb6JdrVHrM/TL34d4O2l/wA0GUjAUibYl0+bmJKp85MI=
last-modified: Fri, 27 Sep 2019 21:29:25 GMT
server: cloudflare
etag: W/"f143ee44ea6bfd99baba3a9f81d9635d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: 8r_2MqqCmeispr9OAGSv.nzOCUbDZIEB
cache-control: public, max-age=31536000
cf-ray: 51e77e26ae405a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 vendors~main.6c359878.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 805 KB
210 KB 50ms
35ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1efcb853b6b57bc7a5bdab79db545ba82ced696c4ba78922b8b167193fa3a9b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 584979
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: 44BFAC7B220D7927
x-amz-id-2: IlTGik5f3sG54hZT0JoKuUwSgAoWyZUIaZuJUdXkXLbbWE77IxyCcdRfEo/eFAEMe+EOQTHOBDY=
last-modified: Mon, 23 Sep 2019 21:38:25 GMT
server: cloudflare
etag: W/"57558955712d9fcaa50399ca3c5e8591"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: 9CPxTfYjU5ucVpDTB.K2kmegsoViMI0d
cache-control: public, max-age=31536000
cf-ray: 51e77e26ae415a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 main.25abfa29.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 381 KB
88 KB 60ms
45ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.25abfa29.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3725b8f8cb263fbec66226366e9889f4d76a51d113d07f817ba15c581b3df7fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 239439
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: 6918464710317370
x-amz-id-2: qj9QeoYE9ib19egOzApreKh8440g+Y/0qCOeX7D7JZ9eMKiffVGetjfpAFkKQAXK841BWRPk8vo=
last-modified: Fri, 27 Sep 2019 21:29:23 GMT
server: cloudflare
etag: W/"f2c0e4f4d1e8de311e27b8a1d6e6e331"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: GbvHu_v_fJ7yw8ZC5xNwTK0xodW9vHSE
cache-control: public, max-age=31536000
cf-ray: 51e77e26ae465a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 vendors~screen.landingpages.trumpland~screen.post~screen.post.amp~screen.post.series~screen.profile~~b319665e.f2be28a6.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 34 KB
15 KB 63ms
48ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~screen.landingpages.trumpland~screen.post~screen.post.amp~screen.post.series~screen.profile~~b319665e.f2be28a6.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

81ab67a50a01c52c9cffc2a0fd8579dd4cbdcd41bb6fe4a7754d2bac02cfad65

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 429073
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: 66729C246ADAF873
x-amz-id-2: QR20wLfdrPvkotdvTeClYzQKVF2SuikIFSvcm/wOtabQ8bmRszh8HTJ/HIarSDjHTu3oztGeX60=
last-modified: Wed, 17 Jul 2019 16:46:30 GMT
server: cloudflare
etag: W/"23e34e999de903dca6d0f87ef9d52146"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: tpvIBvcLxTFWEWeNwKS73HBJUi32agUY
cache-control: public, max-age=31536000
cf-ray: 51e77e26ae425a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 screen.post~screen.post.amp~screen.post.series~screen.profile~screen.sequence.library~screen.sequenc~036c6b37.45e1bd03.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 49 KB
15 KB 45ms
30ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post~screen.post.amp~screen.post.series~screen.profile~screen.sequence.library~screen.sequenc~036c6b37.45e1bd03.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c8e5300a1d28e2de399a374c50e30ddc0a9e2bb8f555788ba382d42e8769c1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 239439
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: 66E6CD91E4C3FC1E
x-amz-id-2: yFPVSjVoT/2jiVv9/0Q5d95c+GT1qU5wLT6f2qpyDczMf/5mTzY0Z07itX3mNTSXd/52Lud87RI=
last-modified: Fri, 27 Sep 2019 21:29:28 GMT
server: cloudflare
etag: W/"36b8eaa6eb329dcd9eb6367c6b3a0b3d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: Q7i6W29wYSU59r_YhEqBlGLSgqoyZ3CB
cache-control: public, max-age=31536000
cf-ray: 51e77e26ae455a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 screen.landingpages.trumpland~screen.post~screen.post.amp~screen.post.series~screen.profile~screen.s~5e114ebe.6cf74f92.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 123 KB
32 KB 33ms
27ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.landingpages.trumpland~screen.post~screen.post.amp~screen.post.series~screen.profile~screen.s~5e114ebe.6cf74f92.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6d85ab20ffe300e23d8361f0942f724329bd69656c46ba5e744725739b74dd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 239439
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: AC75EFA405D545DE
x-amz-id-2: vbVHVpgY/ky39NS7aiY+6OCp+0/SzxL0TPh8uC0oDJb9paxnlYPBACZGQA7rp4k6HwpLiVHXt+E=
last-modified: Fri, 27 Sep 2019 21:29:26 GMT
server: cloudflare
etag: W/"724982f39860c3ab2a2b8608f691a5ba"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: V5.37JXkPzO.FnBSW7tQa51Tp_hDG5s9
cache-control: public, max-age=31536000
cf-ray: 51e77e26ae445a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 screen.post~screen.post.amp~screen.sequence.post.0b7787a1.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 130 KB
32 KB 31ms
31ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post~screen.post.amp~screen.sequence.post.0b7787a1.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac1bf36aed26fae169ac70fec5be5871b9aa7e003e3f83f82ac145c5e0070c2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 239439
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: 9D0B66D9144BA975
x-amz-id-2: Bl7LpJE0D7TlVpG0hcuS9B5XAB0ZNShmvmOS1Dz7B9tC44Nkw+mnogEIvr1Gg7KyfA1PAgXk/iY=
last-modified: Fri, 27 Sep 2019 21:29:28 GMT
server: cloudflare
etag: W/"0362f65cc561e320c5865167a1759e02"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: P7I00db1mXVuzUZ3W3f2F6G7FYft5GSY
cache-control: public, max-age=31536000
cf-ray: 51e77e26de815a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 screen.post.2ed90372.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 55 KB
16 KB 26ms
25ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post.2ed90372.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b5f2f22901c77a8cc18e0676f0623d4f7b760a462d10f5133f056933822355c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 239439
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: 829757FDB1FFD9FF
x-amz-id-2: OJOHROi1khLVIOH8tgVbTc8fUBYwtmZQgULcNWeyxpbrMDKLcml/i9bwkrsxDUOGXPGb/fSu9mY=
last-modified: Fri, 27 Sep 2019 21:29:26 GMT
server: cloudflare
etag: W/"a2e89467d92edcdefbfece1a4b608a36"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: IfraPI4b6092DKJ5VYqL3mvf5IPgQevV
cache-control: public, max-age=31536000
cf-ray: 51e77e26de865a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

POST
H2 200 client-ready Show response
blog.confiant.com/_/lite/performance/ 2 B
244 B 99ms
99ms Fetch
text/plain 52.6.3.192
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/lite/performance/client-ready

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.25abfa29.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-6-3-192.compute-1.amazonaws.com

Software

nginx /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
medium-fulfilled-by: lite/master-20190927-212403-dd93056394
x-envoy-upstream-service-time: 1
content-length: 2

GET
H2 200 vendors~tracing.9f9c73c5.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 62 KB
16 KB 25ms
24ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~tracing.9f9c73c5.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.e45d1a10.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd09be184b9062495023bb42ce6a19f99465b0b9169cd065894ca7726dc43908

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 847115
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: 8223ADB44D032B13
x-amz-id-2: 750Ertrfng0uSNAHZ9wVz+K1Rs3bjbs/UomEVnpALS2iNl1YRzMMavK/mha46wjgWY9Mtb9wcVs=
last-modified: Fri, 23 Aug 2019 20:54:41 GMT
server: cloudflare
etag: W/"8c190a054ed94053dfb9a683572b9ea0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: wzPJT5SuVLzwDg6o3gTQtBiXRBvwF9YS
cache-control: public, max-age=31536000
cf-ray: 51e77e28d83a5a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 tracing.edc14c55.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 2 KB
1 KB 25ms
25ms Script
application/javascript 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/tracing.edc14c55.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.e45d1a10.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8e471d7ce340e300f33e2141469310b31b09f410e082601350c22dcd0fbf22b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 353337
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
x-amz-request-id: F83F4091682C2F9F
x-amz-id-2: eSyo96JkuATFEJzUwf0ARonxXIknet2VGOif04iprkOzP8/F6boTf01vrDhij3H7nqcPrbpUfA0=
last-modified: Mon, 16 Sep 2019 05:57:52 GMT
server: cloudflare
etag: W/"ff774a2723b27a2edd0f88e86387bb45"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: 9pbRbDsgUJtQparYmC480ix_NS57K3AY
cache-control: public, max-age=31536000
cf-ray: 51e77e28d83b5a06-VIE
expires: Tue, 29 Sep 2020 16:14:57 GMT

GET
H2 200 16180790160.js Show response
cdn.optimizely.com/js/ 270 KB
83 KB 33ms
18ms Script
text/javascript 2a02:26f0:6c00:196::13b8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/16180790160.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.25abfa29.chunk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:196::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

fcf141e0d500bdf35aa15bac2ae6a9354b4bb3b2edc6d39015e4a4d2f2d8a8c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: vc0Z4lolvHR.7hPGRMyEd4_fsGM97.Gq
content-encoding: gzip
etag: "50d1374278a66471b335ca031a7566a6"
x-amz-request-id: 405068C0134A8983
status: 200
x-amz-replication-status: PENDING
access-control-allow-methods: GET, HEAD
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="4";dur=0,cdnip;desc="2a02:26f0:6c00:196::13b8";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
vary: Accept-Encoding
content-length: 84330
x-amz-id-2: 1Scs+sTqk2pFSDKYbww/HMcT5e0OZ0ryhSKZSLG4zzrhiP317u9JAPbxoPEqw6n1w0jF4UBc8bk=
last-modified: Fri, 27 Sep 2019 19:16:16 GMT
server: AmazonS3
date: Mon, 30 Sep 2019 16:14:57 GMT
access-control-max-age: 86400
strict-transport-security: max-age=15768000
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
x-amz-meta-revision: 243
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

POST
H2 200 graphql Show response
blog.confiant.com/_/ 94 B
315 B 259ms
259ms Fetch
application/json 52.6.3.192
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.confiant.com/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-6-3-192.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1b8fb049087ec33ea497a90554ef4e037d5c0f6c181a536cc4d0bf1c1512adbf

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Graphql-Operation: InteractivePostBodyQuery
content-type: application/json
accept: */*
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
Medium-Frontend-App: lite/master-20190927-212403-dd93056394
apollographql-client-version: master-20190927-212403-dd93056394
Sec-Fetch-Mode: cors

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
sepia-upstream: production
server: nginx
status: 200
content-type: application/json
access-control-allow-origin: *
medium-fulfilled-by: rito/master-20190927-215453-adbdf1bca5, tutu/38726-0dfe868
x-envoy-upstream-service-time: 160
content-length: 94
x-request-received-at: 1569860097686

POST
H2 200 graphql Show response
blog.confiant.com/_/ 4 KB
2 KB 632ms
631ms Fetch
application/json 52.6.3.192
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.confiant.com/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-6-3-192.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 8516a3d6bbc87aa41198c0b35592094b482257dd7f722c73905de1b1da1ec7ab

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Graphql-Operation: PostRecircQuery
content-type: application/json
accept: */*
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
Medium-Frontend-App: lite/master-20190927-212403-dd93056394
apollographql-client-version: master-20190927-212403-dd93056394
Sec-Fetch-Mode: cors

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
content-encoding: gzip
sepia-upstream: production
server: nginx
status: 200
content-type: application/json
access-control-allow-origin: *
medium-fulfilled-by: rito/master-20190927-215453-adbdf1bca5, tutu/38726-0dfe868
x-envoy-upstream-service-time: 530
x-request-received-at: 1569860097700

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/ 41 KB
17 KB 20ms
7ms Script
application/x-javascript 143.204.208.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.25abfa29.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.208.228 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-208-228.fra53.r.cloudfront.net
Software: nginx /
Resource Hash: 2ec3f1be2d2113c8735e56370fd02cd5171467e03711eb3aa73685991657a8c0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Sep 2019 00:36:35 GMT
Content-Encoding: gzip
Age: 56212
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Sat, 08 Jun 2019 00:02:21 GMT
Server: nginx
ETag: "5cfafb0d-a4fb"
Content-Type: application/x-javascript
Via: 1.1 7549433a09d06354ea864d169b689e51.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: FRA53-C1
X-Amz-Cf-Id: ewxI3RrmjOlb2KrRJfikSrGvuvuhmCCCyes-M_6nBArGYiAbLcQ7GA==
Expires: Thu, 19 Sep 2019 00:36:35 GMT

GET
H2 200 1*lwwdz5iU5bY2ZzaF5qP-Hw.png
miro.medium.com/max/87/ 3 KB
3 KB 30ms
29ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/87/1*lwwdz5iU5bY2ZzaF5qP-Hw.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d6aecc3e017162f65188ea2b29fb05b279905deee5ab8d4ce3615a32bfe2c6ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7038
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3197-fb89d63
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 2717
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2ab9c15a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 GMT

GET
H2 200 1*3Y-jP5U2-HsjZsjmVjy8PA.png
miro.medium.com/fit/c/48/48/ 936 B
1003 B 141ms
139ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/48/48/1*3Y-jP5U2-HsjZsjmVjy8PA.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

bb4736cddb69197136237f1f5f2ebd358e83efe98a0d4e869652c1eb60453fdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 936
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2ab9c25a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 GMT

GET
H2 200 0*3B-oksHZPtkHsfih
miro.medium.com/max/30/ 3 KB
3 KB 189ms
187ms Image
image/gif 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/0*3B-oksHZPtkHsfih?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d3ebd26857ac44dd4d19a76025282ad1b0fdf534e557ef90064ebe3566980415

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 2902
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/gif
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2ab9c35a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*NiwC8ta85zxy2O7m
miro.medium.com/max/17/ 973 B
1 KB 202ms
201ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/17/0*NiwC8ta85zxy2O7m?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

1b7042aac05cb964f5010f6b80e4c9b8fa019f719d6ad938a440f8ecccbcdda0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 973
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2ab9c55a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*mC8UWALzPIhRncUl
miro.medium.com/max/17/ 952 B
1 KB 218ms
217ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/17/0*mC8UWALzPIhRncUl?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

ca9d128784b0994e0cbb00ea655dc2fedd9ce4cf90998fa1291a245197cfbaf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 952
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2ab9c65a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*nO26JyvvgSYVfMOV
miro.medium.com/max/17/ 778 B
843 B 501ms
500ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/17/0*nO26JyvvgSYVfMOV?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

4312500749d49c79145cff6e0f788599753073a9274532491248a7edb496f228

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 778
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2ab9c75a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*Wd89cuS_uOLyMK_i
miro.medium.com/max/30/ 913 B
978 B 170ms
170ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/0*Wd89cuS_uOLyMK_i?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

67647d243664c803c53a387c6a155e31f3de24f036cbda437f496b7029102f64

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:57 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 913
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2ae9e05a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*yawrfdMaklt7hjvg
miro.medium.com/max/17/ 693 B
781 B 197ms
197ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/17/0*yawrfdMaklt7hjvg?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

33e5c235162d355840518c0e351b65aefb1133a539a05c80e1cfeee154398ee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 693
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2b9a505a06-VIE
expires: Wed, 30 Oct 2019 16:14:57 UTC

GET
H2 200 0*pCW8G84pgbecSv1y
miro.medium.com/max/30/ 533 B
621 B 166ms
166ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/0*pCW8G84pgbecSv1y?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

7d2672062d2eb14b4c091e1fa0aacc3640f119ba719c298eb2d86af25d9201d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 533
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2bea7f5a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 UTC

GET
H2 200 0*ZNWU4GOqd_10mFwi
miro.medium.com/max/30/ 661 B
726 B 568ms
568ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/0*ZNWU4GOqd_10mFwi?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

80ab0799dbe7f45f5866dc9967c571ba00b6fac81662834639f7ba50049aaa1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 661
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2bfa875a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 UTC

GET
H2 200 0*KIiEnR4XYjgCVO6Y
miro.medium.com/max/30/ 393 B
594 B 526ms
526ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/0*KIiEnR4XYjgCVO6Y?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

a265418dbb1cfd8b2e2deb427dfa7c0ca02dec94fe0beacc2538e55e8bedc93c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 393
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2bfa895a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 UTC

GET
H2 200 1*3Y-jP5U2-HsjZsjmVjy8PA.png
miro.medium.com/fit/c/80/80/ 1 KB
1 KB 136ms
135ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*3Y-jP5U2-HsjZsjmVjy8PA.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

ef2eb887d17469178bb02f386fb204696b3ac26070369d4724a2a9c16fb60e9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 1287
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2c1a975a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 GMT

GET
H2 200 1*Gzx_yxzR1l1GX0h8J75gfQ.png
miro.medium.com/fit/c/80/80/ 4 KB
4 KB 26ms
26ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*Gzx_yxzR1l1GX0h8J75gfQ.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

7de86495b2cc2bb8cb0114b62861ee7775a0ce3aa22177bf11adf33135933fde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7039
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3197-fb89d63
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 3769
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2cdb0d5a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 GMT

GET
H/1.1 200
OK branch-latest.min.js Show response
cdn.branch.io/ 72 KB
22 KB 20ms
6ms Script
text/javascript 143.204.214.105
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.214.105 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-214-105.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9a7f6085f7574b224a950a25344ed986dbf084b17edcbd242c49b83ec919a35f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: uPhjiqDbOoA_pLf62CesKJEVgSwpyWgu
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Thu, 26 Sep 2019 18:39:04 GMT
Server: AmazonS3
Age: 12
ETag: "161e0ab9281d23aa5a07943fab4f1b5f"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 48391c4ed2c51e95dcabcb70cf613127.cloudfront.net (CloudFront)
Cache-Control: max-age=300
Date: Mon, 30 Sep 2019 16:14:45 GMT
X-Amz-Cf-Pop: FRA53-C1
Content-Length: 21834
X-Amz-Cf-Id: v0uPIObFlB3Ku3YGsYPYk9XN7de6zgbnCxZmNmdLG4iNMlhIbsQndw==

GET
H2 200 0*NiwC8ta85zxy2O7m
miro.medium.com/max/490/ 103 KB
103 KB 187ms
186ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/490/0*NiwC8ta85zxy2O7m

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

e14ce4a00dfd030eb01eeaab7e48e7d8735710b524828690b1178b02d96f0393

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 105236
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2cfb1d5a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 UTC

GET
H2 200 0*3B-oksHZPtkHsfih
miro.medium.com/max/210/ 74 KB
74 KB 202ms
202ms Image
image/gif 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/210/0*3B-oksHZPtkHsfih

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

507b46c0cdd1d84f5f2a3fcb01b1dd4c361dbdfb990c5849518364e7f202c66f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 75753
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/gif
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2cfb1f5a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 UTC

GET
H/1.1 200
OK / Show response
srv-2019-09-30-16.pixel.parsely.com/start/ 77 B
380 B 377ms
94ms Script
application/json 52.70.55.238
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2019-09-30-16.pixel.parsely.com/start/?rand=1569860097750&plid=33433591&idsite=medium.com&url=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22viewerStatus%22%3A%22visitor%22%7D&sid=1&surl=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&sref=&sts=1569860097732&slts=0&title=Malvertising+Attack+Hijacks+300+Million+Sessions+Over+48+Hours&date=Mon+Sep+30+2019+18%3A14%3A57+GMT%2B0200+(Central+European+Summer+Time)&action=pageview&js=1&pvid=73086569&callback=parselyStartCallback
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.70.55.238 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-70-55-238.compute-1.amazonaws.com
Software: nginx /
Resource Hash: babd67449c70dd4bcdbf2839f234e39e1f9422bad80b5045ce78a0000f159f31

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Sep 2019 16:14:47 GMT
Server: nginx
Connection: keep-alive
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Length: 77
Content-Type: application/json

GET
H/1.1 200
OK _r Show response
app.link/ 90 B
729 B 206ms
193ms Script
text/javascript 2600:9000:214f:2000:19:9934:6a80:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.52.0&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:214f:2000:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

openresty/1.13.6.2 / Express

Resource Hash

378632a36f84fb212cef54d97ae551575d917e3f01e749a9a5f57e2debca8fc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Sep 2019 16:14:57 GMT
Via: 1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Server: openresty/1.13.6.2
X-Amz-Cf-Pop: FRA53-C1
X-Powered-By: Express
X-Cache: Miss from cloudfront
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 90
ETag: W/"5a-OJspHK/Aojfg8KWRWN05hN4NbP0"
X-Amz-Cf-Id: 2MJEVqC3ExjV6ECQo8PJBaDxs_XaiNy58NBiV-rnweMQmZ9cDNx2fQ==

POST
H2 200 open Show response
api2.branch.io/v1/ 312 B
600 B 206ms
191ms XHR
application/json 2600:9000:214f:2800:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/open
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:2800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 /
Resource Hash: 9c5f7a946a48510df172029e403e19c33beb8669e3abaffbc9a5253d5688aaff

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
via: 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53-C1
status: 200
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
content-length: 312
x-amz-cf-id: LzDVqvOZyThckin6Ql9iDBWu1TPjanjqXuf9qqroQ7Elpne_Za0RDw==

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
363 B 206ms
206ms XHR
application/json 2600:9000:214f:2800:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:2800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
via: 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: 4z7vLNF7XGgO7ZoENSXOKQXRSzorCq_gR4sad3JtFkObmxBY-N49Hg==

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
362 B 176ms
176ms XHR
application/json 2600:9000:214f:2800:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:2800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
via: 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: 7YRrmeqci-VSwjjwtRBUycwUS4myZQxUliauVM6zxi4Vz3ulLcoEag==

GET
H2 200 1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/fit/c/40/40/ 4 KB
4 KB 26ms
26ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/40/40/1*6g6sWeOzruzLd-7jotXC9A.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

a07ab8752f2e4ea99f15850d17443d509bfc596a3d2d102a30fc6679e4da344c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7037
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 3795
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2e8c3a5a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 GMT

GET
H2 200 1*ty4NvNrGg4ReETxqU2N3Og.png
miro.medium.com/fit/c/40/40/ 1 KB
1 KB 25ms
25ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/40/40/1*ty4NvNrGg4ReETxqU2N3Og.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

0d0aa82fcc1d468279f067d4ce981e5f48d5588cf7590a5cec1affd026604fd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 293517
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 1155
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2e8c3b5a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 GMT

GET
H2 200 1*DimzYIT6p9LkmCFDLkF5og.png
miro.medium.com/max/328/ 24 KB
24 KB 52ms
51ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/328/1*DimzYIT6p9LkmCFDLkF5og.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

6cdbea2d9f793814d6693f028e0f9e23165d84d1ad8b15f88f4400ea3f0081a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 714895
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 24471
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2eac975a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 GMT

GET
H2 200 1*xba3gfyogXPRpHXZ29e1oQ.png
miro.medium.com/max/328/ 30 KB
30 KB 144ms
144ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/328/1*xba3gfyogXPRpHXZ29e1oQ.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d913735d45bb70e8359a5335af0008df83c19497e22c88856945fe929871aae9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-length: 30785
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2eac985a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 GMT

GET
H2 200 0*rJtWiPQzTlz1_NGQ
miro.medium.com/max/328/ 17 KB
17 KB 576ms
576ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/328/0*rJtWiPQzTlz1_NGQ

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

12774de0705505f16961d84ca9179e00bfae29374a3fb90a4806e87fef166ed9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd?gi=506784937b05
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Sep 2019 16:14:58 GMT
x-content-type-options: nosniff
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
content-length: 16981
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 51e77e2f0cc45a06-VIE
expires: Wed, 30 Oct 2019 16:14:58 UTC

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 95ms
94ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: 82216f2342ec0614c6909b2eb7b69db5cfbc540de8e0924dfa7c729c56d4dd9e

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 30 Sep 2019 16:14:59 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H/1.1 204
No Content log Show response
errors.client.optimizely.com/ 0
243 B 95ms
95ms XHR
text/plain 3.215.56.5
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.215.56.5 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-215-56-5.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: https://blog.confiant.com
Access-Control-Expose-Headers
Access-Control-Allow-Credentials: true
Connection: keep-alive
Date: Mon, 30 Sep 2019 16:14:59 GMT
Content-Type: text/plain

POST
H2 200 render Show response
blog.confiant.com/_/lite/performance/ 2 B
244 B 100ms
100ms Fetch
text/plain 52.6.3.192
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/lite/performance/render

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.25abfa29.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-6-3-192.compute-1.amazonaws.com

Software

nginx /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 30 Sep 2019 16:14:59 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
medium-fulfilled-by: lite/master-20190927-212403-dd93056394
x-envoy-upstream-service-time: 3
content-length: 2

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 95ms
94ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: 03db10c31b193d145c1915a0d9485ab2e662b29a9a7c6ebf4adcdeb73afd3091

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 30 Sep 2019 16:14:59 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 95ms
94ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: eadeb47ef5a6f2a99d91feb8c1f3925a1a04f5e16798b40c6b932b48e8097309

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 30 Sep 2019 16:15:00 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 97ms
96ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: 4768743ee402a33b24686c04ff71a4ad7a7696ddd670e1aaa9a0affdb16cc535

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 30 Sep 2019 16:15:00 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H2 409 batch
blog.confiant.com/_/ 10 KB
0 127ms
127ms Fetch
text/html 52.6.3.192
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/batch

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.25abfa29.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-6-3-192.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://blog.confiant.com https://.blog.confiant.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
x-xsrf-token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type: application/json

Response headers

content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://blog.confiant.com https://*.blog.confiant.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 38734-db833d1,db833d18037
status: 409
content-length: 10152
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1569860102705:ec18bb9ff452
server: nginx
date: Mon, 30 Sep 2019 16:15:02 GMT
x-frame-options
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 109ms
108ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.6c359878.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: b32fdba24ef8fc68878f826c926dc0378816ab7323e999c6cd8caae14ebe0b18

Request headers

Sec-Fetch-Mode: cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 30 Sep 2019 16:15:03 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

GET
H/1.1 200
OK /
srv-2019-09-30-16.pixel.parsely.com/event/ 43 B
385 B 95ms
94ms Image
image/gif 52.70.55.238
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2019-09-30-16.pixel.parsely.com/event/?rand=1569860108238&plid=33433591&idsite=medium.com&url=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fblog.confiant.com%2Fmalvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd&sref=&sts=1569860108237&slts=0&date=Mon+Sep+30+2019+18%3A15%3A08+GMT%2B0200+(Central+European+Summer+Time)&action=heartbeat&inc=5&tt=4900&pvid=73086569&u=pid%3D091ad308bd49e85d1bc68dbfe1ef6317
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.70.55.238 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-70-55-238.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blog.confiant.com/malvertising-attack-hijacks-300-million-sessions-over-48-hours-9d0218fe02cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Sep 2019 16:15:08 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Length: 43
Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.25abfa29.chunk.js(Line 1) Message: -+++++= .+++++= .+@@@@@+ #@@@@: .@@@@@= @@@@@ @+@@@@- =#@@@@@ @ +@@@@: :% @@@@@ @ @@@@-%: @@@@@ @ @@@@- @@@@@ -@- #@@+ :@@@@@: -#@@@#- ## =@@@@@@@= ....... .........
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.25abfa29.chunk.js(Line 1) Message: We're hiring! https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	allow-from medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.branch.io
app.link
blog.confiant.com
cdn-client.medium.com
cdn.branch.io
cdn.optimizely.com
collector-medium.lightstep.com
d1z2jf7jlzjs58.cloudfront.net
errors.client.optimizely.com
glyph.medium.com
medium.com
miro.medium.com
srv-2019-09-30-16.pixel.parsely.com
www.google-analytics.com
143.204.208.228
143.204.214.105
2600:9000:214f:2000:19:9934:6a80:93a1
2600:9000:214f:2800:11:f728:3040:93a1
2606:4700::6810:7691
2606:4700::6810:7791
2606:4700::6810:797f
2a00:1450:4001:80b::200e
2a02:26f0:6c00:196::13b8
3.215.56.5
52.6.3.192
52.70.55.238
54.164.26.255
03db10c31b193d145c1915a0d9485ab2e662b29a9a7c6ebf4adcdeb73afd3091
087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6
0d0aa82fcc1d468279f067d4ce981e5f48d5588cf7590a5cec1affd026604fd8
12774de0705505f16961d84ca9179e00bfae29374a3fb90a4806e87fef166ed9
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
1669b5143789ac63a25e82a7adf595e11583d7e5c4acd386d5fef99ac90f7e7d
1b7042aac05cb964f5010f6b80e4c9b8fa019f719d6ad938a440f8ecccbcdda0
1b8fb049087ec33ea497a90554ef4e037d5c0f6c181a536cc4d0bf1c1512adbf
1efcb853b6b57bc7a5bdab79db545ba82ced696c4ba78922b8b167193fa3a9b8
2ec3f1be2d2113c8735e56370fd02cd5171467e03711eb3aa73685991657a8c0
33e5c235162d355840518c0e351b65aefb1133a539a05c80e1cfeee154398ee5
3725b8f8cb263fbec66226366e9889f4d76a51d113d07f817ba15c581b3df7fb
378632a36f84fb212cef54d97ae551575d917e3f01e749a9a5f57e2debca8fc7
41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9
4312500749d49c79145cff6e0f788599753073a9274532491248a7edb496f228
4665b35d29422d7ac8cc098831967548548333a4e3ac29c64e1aaf4b1a588812
4768743ee402a33b24686c04ff71a4ad7a7696ddd670e1aaa9a0affdb16cc535
4b5f2f22901c77a8cc18e0676f0623d4f7b760a462d10f5133f056933822355c
4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173
507b46c0cdd1d84f5f2a3fcb01b1dd4c361dbdfb990c5849518364e7f202c66f
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
67647d243664c803c53a387c6a155e31f3de24f036cbda437f496b7029102f64
6b3ad759afacddbdad073984f6432f9ed9b978b5be8f76c9ba19ca0ad51fe276
6cdbea2d9f793814d6693f028e0f9e23165d84d1ad8b15f88f4400ea3f0081a1
74cc3d3fa2f0e9d87e92f07e8382e1ecc522716bdcadb54597f44c02e419e936
7ae8eda2c07f5838b8371cb4201171613fe9a52aeb04bb8efe97ff01bc462d2d
7b291bac4cab78306a75e1a45638905656722c05eea8ddf56f41048bbd7588a9
7cbd2debba636d6de6bdc4c597118c083c934c49c5a8a5444c84c3bcd73d0a1f
7d2672062d2eb14b4c091e1fa0aacc3640f119ba719c298eb2d86af25d9201d6
7de86495b2cc2bb8cb0114b62861ee7775a0ce3aa22177bf11adf33135933fde
80ab0799dbe7f45f5866dc9967c571ba00b6fac81662834639f7ba50049aaa1e
81ab67a50a01c52c9cffc2a0fd8579dd4cbdcd41bb6fe4a7754d2bac02cfad65
82216f2342ec0614c6909b2eb7b69db5cfbc540de8e0924dfa7c729c56d4dd9e
8320163c0d005d17448757260965ce18cbef6c82c2ca320a42cb790a5783d92d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8516a3d6bbc87aa41198c0b35592094b482257dd7f722c73905de1b1da1ec7ab
88263aceb0ae5d452ba0388704e9681e8a45ee77a66b7f1f37b3137c24deef10
8c8e5300a1d28e2de399a374c50e30ddc0a9e2bb8f555788ba382d42e8769c1c
99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8
9a7f6085f7574b224a950a25344ed986dbf084b17edcbd242c49b83ec919a35f
9c5f7a946a48510df172029e403e19c33beb8669e3abaffbc9a5253d5688aaff
a07ab8752f2e4ea99f15850d17443d509bfc596a3d2d102a30fc6679e4da344c
a265418dbb1cfd8b2e2deb427dfa7c0ca02dec94fe0beacc2538e55e8bedc93c
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
ac1bf36aed26fae169ac70fec5be5871b9aa7e003e3f83f82ac145c5e0070c2a
b32fdba24ef8fc68878f826c926dc0378816ab7323e999c6cd8caae14ebe0b18
babd67449c70dd4bcdbf2839f234e39e1f9422bad80b5045ce78a0000f159f31
bb4736cddb69197136237f1f5f2ebd358e83efe98a0d4e869652c1eb60453fdd
c6576db616c5497d13204eddb011b38fbd15f94249887afbafed9f77eaf95f4b
c94c22c6e66c1b86f0bcb32c29ec785d9cdb5635e29a346904629a4508567197
ca9d128784b0994e0cbb00ea655dc2fedd9ce4cf90998fa1291a245197cfbaf7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d3ebd26857ac44dd4d19a76025282ad1b0fdf534e557ef90064ebe3566980415
d6aecc3e017162f65188ea2b29fb05b279905deee5ab8d4ce3615a32bfe2c6ea
d8e471d7ce340e300f33e2141469310b31b09f410e082601350c22dcd0fbf22b
d913735d45bb70e8359a5335af0008df83c19497e22c88856945fe929871aae9
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dd09be184b9062495023bb42ce6a19f99465b0b9169cd065894ca7726dc43908
e14ce4a00dfd030eb01eeaab7e48e7d8735710b524828690b1178b02d96f0393
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e658be4f48eb6f0e9edd2ca9d90c43e3035a6d970dc901689feaa2bd0dc22b63
e90ebb4d1748bb5f43a9115cd9d1e3954e356a05f1999480f85217bfbe5f8c2b
eadeb47ef5a6f2a99d91feb8c1f3925a1a04f5e16798b40c6b932b48e8097309
eba4c89e4442ca5e503a274c281841632953833beb37a05835758fd1c0fc59e2
ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3
ef2eb887d17469178bb02f386fb204696b3ac26070369d4724a2a9c16fb60e9b
f25e38427a40e8d86aee0f6077a7dc2e8d2178a3e93d18b9e11abe025f2809cd
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08
f6d85ab20ffe300e23d8361f0942f724329bd69656c46ba5e744725739b74dd9
fcf141e0d500bdf35aa15bac2ae6a9354b4bb3b2edc6d39015e4a4d2f2d8a8c4

blog.confiant.com Open in urlscan Pro 52.6.3.192 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

70 Requests

100 %HTTPS

54 %IPv6

9 Domains

14 Subdomains

13 IPs

3 Countries

1009 kBTransfer

2626 kBSize

0 Cookies

30 Outgoing links

Page URL History

Redirected requests

70 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.confiant.com Open in urlscan Pro
52.6.3.192 Public Scan

Screenshot
Live screenshot

Full Image

70
Requests

100 %
HTTPS

54 %
IPv6

9
Domains

14
Subdomains

13
IPs

3
Countries

1009 kB
Transfer

2626 kB
Size

0
Cookies

70 HTTP transactions
4 data transactions