www.bleepingcomputer.com Open in urlscan Pro
104.20.184.56 Public Scan

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/

Response headers

age: 71927
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 18 Sep 2025 17:36:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 17:36:54 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 675ms
59ms Font
font/woff2 142.250.72.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/

Response headers

age: 70854
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 18 Sep 2025 17:54:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 17:54:47 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 726ms
110ms Font
font/woff2 142.250.72.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/

Response headers

age: 69103
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 18 Sep 2025 18:23:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 18:23:58 GMT
last-modified: Thu, 01 Aug 2024 20:41:19 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18492
x-xss-protection: 0
server: sffe

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 724ms
109ms Font
font/woff2 142.250.72.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

31.152.160.34.bc.googleusercontent.com

Software

sffe /

Resource Hash

ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/

Response headers

age: 76826
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 18 Sep 2025 16:15:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 16:15:15 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18588
x-xss-protection: 0
server: sffe

GET
H2 200 configs
d.pub.network/v2/sites/bleepingcomputer-com/ 86 KB
8 KB 823ms
93ms Other
application/json 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://d.pub.network/v2/sites/bleepingcomputer-com/configs?env=PROD

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

341e6f392b2615b8ead19ecfbd20e0baaf44f55e8f3f0e240a79500f144800c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:41 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent

GET
H2 200 292x176_data-leak.jpg
www.bleepstatic.com/content/hl-images/2024/08/16/thumb/ 7 KB
7 KB 69ms
49ms Image
image/jpeg 104.26.12.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/content/hl-images/2024/08/16/thumb/292x176_data-leak.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d64a72fcd3fd5f78053efd2f53d052149945d775cf5933b8cfaadf71afbb7c60

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 171982
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=laycBQszdpVzc6LFkUqnhzZk6PycpX%2FeEi%2Fafl8EG%2BMANz%2FywwtsSeMXnIkx1L8Rf5GasoLTQ%2BCs8pKbsS0QNOOTb4a8OXBwLkpKxpig0ey7dO%2FWgW4OL9YpfLzWcea6iD7Yo4w%3D"}],"group":"cf-nel","max_age":604800}
expires: Thu, 17 Oct 2024 13:49:18 GMT
cf-polished: degrade=85, origSize=25754, status=webp_bigger
date: Thu, 19 Sep 2024 13:35:41 GMT
content-type: image/jpeg
last-modified: Fri, 16 Aug 2024 17:04:17 GMT
vary: Accept-Encoding
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8c59f5d99b69ac78-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6880
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 478ms
65ms Image
image/x-icon 142.250.65.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 76836
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 16:15:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 16:15:05 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ 990 B
1 KB 777ms
45ms Image
image/svg+xml 104.96.85.204
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.96.85.204 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-96-85-204.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9ba56f5ffa579747efde1d2a429b325a9fb7220d30f4268e4a44ecbe4a9bf034

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=2592000
timing-allow-origin: *, *
etag: "5ab8e16b5f46213840bcd403e349419c:1708851030.144644"
access-control-request-headers: X-OB-STG,X-OB-PRD
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
expires: Sat, 19 Oct 2024 13:35:41 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 990
date: Thu, 19 Sep 2024 13:35:41 GMT
content-type: image/svg+xml
last-modified: Sun, 25 Feb 2024 08:33:18 GMT
server: AkamaiNetStorage

GET
H3 200 elLoader.js Show response
cds.connatix.com/p/529897/ Frame 3E34 4 KB
2 KB 74ms
37ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/elLoader.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c68e0d0d4046228c3d8c161cc837a4c289b555ff8a07b58132622c86998c4e00

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "70914be879b6ef2cdb9f3433c10d5528"
x-amz-version-id: 0xZDg4vh6ay_RtMFrs9iAUx7xN6NyY_8
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:41 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:41 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:58 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5d9c877ab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1274
server: cloudflare

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202409120101/ 415 KB
140 KB 222ms
221ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202409120101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

8e0ee6b5126b27685602d7c028a175a86ddc6f51ce2c17cf99fa067ef8e59d2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14361930948663601922
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:35:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 19 Sep 2024 13:35:41 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 142832
x-xss-protection: 0
server: cafe

GET
H2 200 jquery.fancybox.css
www.bleepstatic.com/js/redesign/fancybox/ 4 KB
1 KB 97ms
84ms Stylesheet
text/css 104.26.12.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"9108074"
age: 6418
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1W8SjA0HLw20EppD6p4tKL83HNLXw1LYPL21LWMxOQ4VVXmSoJ5P%2FLURCivGD54O%2BjSG9fyG6jcUjOA5EFV%2BweIqlvSwZbES45qey2yA5m%2F16RYnO1Fhldt8rtchmJjwzwQZcyA%3D"}],"group":"cf-nel","max_age":604800}
expires: Mon, 03 Jun 2024 14:55:03 GMT
cf-polished: origSize=4895
date: Thu, 19 Sep 2024 13:35:41 GMT
content-type: text/css
last-modified: Wed, 14 Oct 2015 20:25:51 GMT
vary: Accept-Encoding
cache-control: max-age=3024000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8c59f5dc7e84ac78-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 fontawesome.min.css
www.bleepstatic.com/redesign/fontawesome6/css/ 79 KB
17 KB 100ms
87ms Stylesheet
text/css 104.26.12.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/css/fontawesome.min.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 863ab50a39fc203ca8f614cef14c6cc700ee64bfeacd41426dce9ef8cbd98509

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "2038534161"
age: 3573
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vqznPXVoi%2FAQ9f7Z3eNgg6g1eDtlX8BCNdvTNQX5OwZjWenk%2BfaTvsbR4lCg2MfvtKkaCYQnAnh8yBufbpWKGxs8CEHWxW8FLDEiWpbqZfRrfSxj45TdMMyr%2BsqLkVnH%2FSbU8N8%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 03 Apr 2024 19:14:36 GMT
date: Thu, 19 Sep 2024 13:35:41 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Mon, 14 Nov 2022 22:35:03 GMT
cache-control: max-age=3024000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8c59f5dc7e87ac78-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17356
server: cloudflare

GET
H2 200 brands.min.css
www.bleepstatic.com/redesign/fontawesome6/css/ 18 KB
5 KB 96ms
85ms Stylesheet
text/css 104.26.12.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/css/brands.min.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7e925f6192a3f7907621f9dde8afc47752d671d4a796f2cd5a53cfbc07c214b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "2013745295"
age: 971
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8qDl3%2FR7e3BCOmFJ5pEhLsRZU3FomiloS%2F6mHxwOYRr%2BKFsvIUlQsGNFehwnrByQMpt4VPe8QbJBuOIQxkWG1YRt2id54fCSpAHZSxqipRaDCwzM4OlPUI5CaPresV3RjgZSIAE%3D"}],"group":"cf-nel","max_age":604800}
expires: Mon, 03 Jun 2024 14:51:55 GMT
date: Thu, 19 Sep 2024 13:35:41 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Mon, 14 Nov 2022 22:34:45 GMT
cache-control: max-age=3024000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8c59f5dc7e89ac78-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4725
server: cloudflare

GET
H2 200 solid.min.css
www.bleepstatic.com/redesign/fontawesome6/css/ 572 B
663 B 95ms
85ms Stylesheet
text/css 104.26.12.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/css/solid.min.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a5d218c8e40dc33b9a0c27b49c2a5d0c9696ea53ee6371882d348a31116ae9b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "508050520"
age: 971
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7ZcMAc3%2F1xCQn7zJBGoVFk%2F1vjt6LoF8yRFAzsj84RCKNlLTpfV1pcB9cxnv6EqX1GyEiZmwhjZDoWPXYbnQbDWS3iBqDXfl4grJpD7tGcIZDAX14Zo%2BlUZCHtX4%2BmNuTxIMarY%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 24 Apr 2024 06:24:07 GMT
date: Thu, 19 Sep 2024 13:35:41 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Mon, 14 Nov 2022 22:34:55 GMT
cache-control: max-age=3024000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8c59f5dc7e8bac78-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 325
server: cloudflare

GET
H2 200 fa-solid-900.woff2
www.bleepstatic.com/redesign/fontawesome6/webfonts/ 147 KB
148 KB 358ms
11ms Font
application/octet-stream 104.26.12.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/webfonts/fa-solid-900.woff2
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/redesign/fontawesome6/css/solid.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d27bc752105c079f8a516e9142406a9fc12cbb409f9bf8681f2ddfe0360b52a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://www.bleepstatic.com/redesign/fontawesome6/css/solid.min.css

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 4716
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0NE4oZJ1sDqVKt3nJ92ukDm4R3VDPfvFrd5%2FjregGgD5jbOSjXjZmRIKAEZYOhX%2FaOuHSgg6TFpGXkX%2Bh%2BFCXWYle2xJAmicsDdW8KL3n7XREJ%2FHdSpD5PNKMOkAD5%2BfViwtWE0%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c59f5e01a3cabbb-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 150472
date: Thu, 19 Sep 2024 13:35:42 GMT
content-type: application/octet-stream
last-modified: Mon, 14 Nov 2022 22:33:11 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK spc_fi.php Show response
cdn.firstimpression.io/delivery/ 39 KB
8 KB 1260ms
181ms XHR
application/json 52.85.61.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.firstimpression.io/delivery/spc_fi.php?id=5971&url=%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&charset=UTF-8&ch=6&ref=www.bleepingcomputer.com&viewerId=null&referer=&_firid=54750835
Requested by: Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-119.ewr53.r.cloudfront.net
Software: Apache/2.4.38 (Debian) /
Resource Hash: 8c6461f74d9b94f86a3fb0850ec1d92dcf17d570843e5635288481b765786048

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer

Response headers

Content-Encoding: gzip
Expires: 0
X-Cache: Miss from cloudfront
P3P: CP="CUR ADM OUR NOR STA NID"
X-Amz-Cf-Id: oXiM7NkGT9BqRlXiX_10EQdcOtNesTmon7VN9nVLlbLWnUCxXMI4WQ==
Date: Thu, 19 Sep 2024 13:35:43 GMT
Content-Type: application/json; charset=UTF-8
Vary: Accept-Encoding
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Via: 1.1 6e01480ef7aa01c23bf600698a613304.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Content-Length: 7807
X-Amz-Cf-Pop: EWR53-P1
Server: Apache/2.4.38 (Debian)

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 1191ms
65ms Fetch
text/plain 142.250.72.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-GD465VRQLD&gtm=45je49h0v878037826za200&_p=1726752939505&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=1870454902.1726752942&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726752942&sct=1&seg=0&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&dt=Malware%20locks%20browser%20in%20kiosk%20mode%20to%20steal%20Google%20credentials&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4485
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GD465VRQLD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.72.110 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s32-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 19 Sep 2024 13:35:43 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 fa-brands-400.woff2
www.bleepstatic.com/redesign/fontawesome6/webfonts/ 105 KB
105 KB 36ms
28ms Font
application/octet-stream 104.26.12.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/webfonts/fa-brands-400.woff2
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/redesign/fontawesome6/css/brands.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fe890d088ecf0cc9bc1b9069201e52972dbad6237865524090e15982d0de718

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://www.bleepstatic.com/redesign/fontawesome6/css/brands.min.css

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 4716
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5vv%2F%2BK92sq%2BOwAear725YDwnlv1ueZ%2BLChhCTTsIhMUV1br8%2BgRiwLA2Rd%2F9Hvz54xMMK6I9H48bbHtgNRfxN4t0%2FqcmdDrZSN48c53IpE7KVZQLg7ocWLmogji0CN%2FKqx5PX3w%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c59f5e1fbfaabbb-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 107460
date: Thu, 19 Sep 2024 13:35:42 GMT
content-type: application/octet-stream
last-modified: Mon, 14 Nov 2022 22:32:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 connatix.player.js Show response
cds.connatix.com/p/529897/ Frame 3E34 456 KB
107 KB 54ms
51ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/elLoader.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7105f483747f63150937eba447c9a0e87f5bcf1e9f6724526f7951aa60af4290

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "545e658c8a34d995c5c6c7a663f4a2e7"
x-amz-version-id: VvVqJytrL3mU3qL96rgSlGX9gnzjgqDs
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:42 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:42 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:58 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5e1ffa9ab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 108666
server: cloudflare

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 106 KB
32 KB 918ms
213ms Script
text/javascript 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cba9c0bad6ab9ae56a8adf99dc81e16d1d658d8e49c999640f347aa6cbbb339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 549 / 19985 / m202409160104 / config-hash: 3692081673757629763
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:35:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:43 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 32738
x-xss-protection: 0
server: cafe

GET
H3 200 prebid-analytics-8.49.81.js Show response
a.pub.network/core/ 593 KB
197 KB 58ms
51ms Script
text/javascript 104.18.21.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://a.pub.network/core/prebid-analytics-8.49.81.js

Requested by

Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9fe3fa9b6d5ba52dff72560f9ba9b7fde8bf8a1b1a9e3f0aaabccc1bd6ce07ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 2
access-control-expose-headers: *
x-goog-hash: crc32c=kPT46g==, md5=9cepNFgn1nX+jDkUyROAvw==
cf-cache-status: HIT
etag: W/"f5c7a9345827d675fe8c3914c91380bf"
age: 65161
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Fri, 20 Sep 2024 13:35:42 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 606896
date: Thu, 19 Sep 2024 13:35:42 GMT
content-type: text/javascript
last-modified: Tue, 10 Sep 2024 12:12:54 GMT
vary: Accept-Encoding
x-guploader-uploadid: AD-8lju1Q8woMnY3co7iQiyQif6za1lDc8nkqUboWbi6S3H2dXU4uJ3z40t7m1xOhB5HoYFfutU
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c59f5e22c4436c4-YYZ
access-control-allow-origin: *
x-goog-generation: 1725970374602566
server: cloudflare

GET
H3 200 pubfig.engine.js Show response
a.pub.network/core/pubfig/5.111.0/ 426 KB
121 KB 692ms
691ms Script
application/javascript 104.18.21.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js

Requested by

Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d414c52b82ece25589771f72028163e28027d693ac1e75e2b0c5feb2ba2e893

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 2
access-control-expose-headers: *
x-goog-hash: crc32c=wDy7tg==, md5=Ms3QurXllUEvAW+GmDcnjw==
cf-cache-status: HIT
etag: W/"32cdd0bab5e595412f016f869837278f"
age: 65153
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Thu, 19 Sep 2024 14:35:42 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 436593
date: Thu, 19 Sep 2024 13:35:42 GMT
content-type: application/javascript
last-modified: Mon, 16 Sep 2024 13:12:48 GMT
vary: Accept-Encoding
x-guploader-uploadid: AD-8ljuP7iwO0ihWp1Tw84YxiHJidDs-vi6FIQGyKm-3hFNxo65b-NASh2Jld-qXklSolrvMHlI
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c59f5e24c6b36c4-YYZ
access-control-allow-origin: *
x-goog-generation: 1726492368365191
server: cloudflare

GET
H3 200 zrt_lookup_fy2021.html
googleads.g.doubleclick.net/pagead/html/r20240916/r20110914/ Frame 8684 0
0 532ms
44ms Document
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240916/r20110914/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202409120101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

age: 443
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4126
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 19 Sep 2024 13:28:20 GMT
etag: 14908419571193397619
expires: Thu, 03 Oct 2024 13:28:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 397ms
244ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=HEADER&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 19 Sep 2024 13:35:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame 97AF 0
0 598ms
114ms Document
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&abgtt=1&lmt=1726267479&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x675_l%7C188x675_r&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&pra=7&wgl=1&aihb=0&asro=0&ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aifxl=29_18~30_19&aiixl=29_5~30_6&aslmct=0.7&asamct=0.7&aiepr=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1726752941151&bpp=6&bdt=2752&idt=1403&shv=r20240916&mjsv=m202409120101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=1586041321925&frm=20&pv=2&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31087218%2C95342765%2C95342338&oid=2&pvsid=2992154380907323&tmod=2139344520&uas=0&nvt=1&fsapi=1&fc=896&brdim=240%2C240%2C240%2C240%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=1619

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202409120101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 66
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 19 Sep 2024 13:35:43 GMT
expires: Thu, 19 Sep 2024 13:35:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK / Show response
tag.escalated.io/ 62 KB
26 KB 1079ms
673ms Script
application/javascript 3.131.10.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.escalated.io/?i=KxxajmhPPCsT&d=www.bleepingcomputer.com&type=display&cust=5971&sid=direct&c=&cust2=direct
Requested by: Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.131.10.225 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-131-10-225.us-east-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a03fdbfe8dbcbbd024b57f3764d78b07bc70960c6396b499820d887eff0a7fb4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
ETag: W/"66c752ad-f905"
Connection: keep-alive
Date: Thu, 19 Sep 2024 13:35:43 GMT
Content-Type: application/javascript
Last-Modified: Thu, 22 Aug 2024 15:01:01 GMT
Server: nginx

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/ 479 KB
149 KB 103ms
97ms Script
text/javascript 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77879f54400e07c9d73fefd1e1e06fd736e7dbeffea7669790620753125671ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10756395476737303338
age: 429
x-content-type-options: nosniff
expires: Fri, 19 Sep 2025 13:28:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:28:34 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 152737
x-xss-protection: 0
server: cafe

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 1 KB
926 B 482ms
73ms XHR
application/json 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bleepingcomputer.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27fef41607c030eacd65dbe7c28aedcc901aeb9d08c25207fd66ac5be0288882

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 13:35:44 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 381
date: Thu, 19 Sep 2024 13:35:44 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 player.user.manager.service.js Show response
cds.connatix.com/p/529897/ Frame 3E34 57 KB
16 KB 39ms
38ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/player.user.manager.service.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67a1a3bc747f7bb1a52106937267d02198d2bdccc668a67853764f7241ad4808

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "1ca4c520ea61e986ad3eb913edfa2105"
x-amz-version-id: sSBlqo_pl8VNWcPg1pdv.UkvbrPKOijx
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:43 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:43 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:58 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5eb1fe2ab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15496
server: cloudflare

GET
H3 200 player.renderer.js Show response
cds.connatix.com/p/529897/ Frame 3E34 194 KB
45 KB 35ms
33ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/player.renderer.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa41feda3b4e9bf1010184194f6efce135a41003d0121cbb67c01ab4e2601ff6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "9d2dfe0ac2f189bf35bbfca5bdb601b6"
x-amz-version-id: 3nWxxjOb8_GkqeaSFE62nFYl3VFPTZCe
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:43 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:43 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:58 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5eb1fe5ab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 45687
server: cloudflare

GET
H3 200 cSyncRemoteEntry.js Show response
cds.connatix.com/p/529897/ Frame 3E34 3 KB
2 KB 72ms
70ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/cSyncRemoteEntry.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5eb6e81bf3a8a50152b753f818a4567ad8efb3aaf7e993f9fef8fc27803510a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "12cf9a878331d0c82281750047fb8284"
x-amz-version-id: 3fHcwAE9GSd11V1W3cyUmzfCuGMUeG0m
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:43 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:43 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:57 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5eb1feaab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1395
server: cloudflare

GET
H3 200 player.style.1437465e05a3752bfca8.css
cds.connatix.com/a/ 67 KB
9 KB 69ms
68ms Stylesheet
text/css 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/a/player.style.1437465e05a3752bfca8.css
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81dbe7f87a0b8060dc32882642f85aec878821d8f148f4d4ebe602e7438ef4d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "97dca2b9b2249d84b154ab6e042e70e4"
x-amz-version-id: NKl.o.sA.DvHy6lae45Inm03f8rnLO3j
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:43 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:43 GMT
content-type: text/css
last-modified: Wed, 18 Sep 2024 11:16:17 GMT
vary: Accept-Encoding
access-control-allow-headers: range
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5eb1febab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9346
server: cloudflare

GET
H3 200 player.hls.608c5839285a15038640.js Show response
cds.connatix.com/a/ 290 KB
75 KB 154ms
154ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/a/player.hls.608c5839285a15038640.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01edf57373c19ed033b0737420a8ef2409aa35a7b5b0f44e955a1e11c7907e6b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "56057def5be330e63a9ae8e6b2f04ebe"
x-amz-version-id: wVW_LiQiS5sM_KFJ6qlJIlVRJiH78U8q
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:43 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:43 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:59 GMT
vary: Accept-Encoding
access-control-allow-headers: range
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5eb1fecab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 76690
server: cloudflare

GET
H3 200 player.ads.js Show response
cds.connatix.com/p/529897/ Frame 3E34 406 KB
91 KB 246ms
246ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/player.ads.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d6f9b18eab6720a2cd2440fbef594969273df0628650f5ed3b9b18690ec5184

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "8689abaffde4a3ac85ee2c0c281c508b"
x-amz-version-id: z.EqgJ32KYsnYRLXBTpe8TU4nlnHQBh0
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:43 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:43 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:58 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5eb1feeab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 92955
server: cloudflare

GET
H3 200 / Show response
optimise.net/ 7 KB
7 KB 119ms
93ms Fetch
application/json 34.111.152.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://optimise.net/?k=0&d=bleepingcomputer.com&t=desktop&c=CA&r=1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.152.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

db47f42ded2fe4cff968c9923000cde18dec257d90a3ac4adc6b9edcaed14e3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-api-key: 4e799501-b8b6-4ef1-bad5-225b3dd1aa8d
x-lm: 0

Response headers

access-control-max-age: 3600
access-control-expose-headers: fs-client-rtt,fs-country
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
expires: 0
fs-client-rtt: 19
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: application/json
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm
strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
fs-country: CA

OPTIONS
H2 200 /
optimise.net/ Frame 0
0 549ms
56ms Preflight 34.111.152.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://optimise.net/?k=0&d=bleepingcomputer.com&t=desktop&c=CA&r=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.152.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

e2.ycpi.vip.dca.yahoo.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: x-api-key,x-lm
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-expose-headers: fs-client-rtt,fs-country
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
date: Thu, 19 Sep 2024 13:35:44 GMT
expires: 0
fs-client-rtt: 19
fs-country: CA
pragma: no-cache
strict-transport-security: max-age=31536000
via: 1.1 google

POST
H3 200 mny Show response
capi.connatix.com/core/ Frame 3E34 33 KB
15 KB 111ms
109ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/mny?v=529897&cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 240a37b73aca09b1e2bfe1ebbf4902253f88dc8a15fd08441f69681b12516133

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: multipart/form-data
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f5ed5feea21c-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=86400
content-length: 14569
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: application/x-protobuf
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

GET
H3 200 295.js Show response
cds.connatix.com/p/529897/ Frame 3E34 68 KB
18 KB 33ms
32ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/295.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/cSyncRemoteEntry.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05256c56af95cb837667423c41546cb335d4c08c1f9710242030ccc3d5a20bb5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "8c457b3683038f8898f429fac2e2941c"
x-amz-version-id: eEx_pCd08iyHhFMrGroxqYNU6fO0nKpE
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:44 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:57 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5ed8a1aab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18039
server: cloudflare

GET
H3 200 589.js Show response
cds.connatix.com/p/529897/ Frame 3E34 10 KB
4 KB 34ms
33ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/589.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/cSyncRemoteEntry.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33ba7c2cea36307f37734f947f5f6d99f1d31baa5c75bc27b9e84a25e0e1df22

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "8075e3f64e0ea8e91ac3a7c35d4ef4ad"
x-amz-version-id: 2rJqaNWNVqKKiu4quD0HU.IMyehUX2s_
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:44 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:57 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5ed8a1cab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3291
server: cloudflare

GET
H3 200 402.js Show response
cds.connatix.com/p/529897/ Frame 3E34 3 KB
2 KB 50ms
49ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/402.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/cSyncRemoteEntry.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa893c86f2012f6b8743199994a4b733b32070b86df6bfe437e3feb2adb23303

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "6697ed05357fe938e50b87136896344e"
x-amz-version-id: R.WV7aGH04J6I57dFBt7AyKaeGlnlOIz
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:44 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:57 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5ed8a1eab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1116
server: cloudflare

POST
H3 200 / Show response
capi.connatix.com/metrics/ Frame 3E34 0
376 B 174ms
105ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/metrics/?v=529897&tier=2
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: multipart/form-data
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f5ef5b07abf7-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=86400
content-length: 20
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: application/x-protobuf
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

OPTIONS
H2 200 c
c.pub.network/v2/ Frame 0
0 171ms
42ms Preflight 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 19 Sep 2024 13:35:44 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
via: 1.1 google

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 102ms
62ms Fetch
text/plain 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 674e0580ec30c0c08da895d8e7a84f103b99d51091b012e9839c2e5db29b005c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H3

200

sync Show response
capi.connatix.com/core/ Frame 3E34
Redirect Chain

https://capi.connatix.com/core/sync
https://capi.connatix.com/core/sync?tier=1&final=true&UseUserScore=Yes&LiveIntentCnxUserId=&ImplementationType=0&ClientAb2=0

6 KB
3 KB

92ms
71ms

XHR
application/json

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/sync?tier=1&final=true&UseUserScore=Yes&LiveIntentCnxUserId=&ImplementationType=0&ClientAb2=0
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39a9cec6624a83288728425ca1481245a108d71c30163a8c16f08bf87d06005a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f5f8f94ca21c-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=86400
content-length: 2580
date: Thu, 19 Sep 2024 13:35:46 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
location: https://capi.connatix.com:443/core/sync?tier=1&final=true&UseUserScore=Yes&LiveIntentCnxUserId=&ImplementationType=0&ClientAb2=0
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f5f10b10a21c-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: application/x-protobuf
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

POST
H3 200 pls Show response
capi.connatix.com/core/ Frame 3E34 1 KB
2 KB 78ms
77ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=529897&cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 596e05d795ac197c7c3b6512fa2d32ff1d95c765efa6c8c4e4864f8f0298126e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: multipart/form-data
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f5f10b14a21c-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=86400
content-length: 1248
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: application/x-protobuf
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 639ms
39ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 19 Sep 2024 13:35:45 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 220843
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 366ms
38ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 19 Sep 2024 13:35:45 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 193312
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.js Show response
cdn.confiant-integrations.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/ 96 KB
21 KB 185ms
87ms Script
text/javascript 104.18.43.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.confiant-integrations.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/config.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.43.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fcca58e2a08d18c93cc090844885c2187edeea3674a5ebd45720374e65c295af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "495e6a679b34a0779f0daee6583968a7"
age: 221
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 12:42:02 GMT
vary: Accept-Encoding
x-amz-id-2: +y4FjhPJ/Mttif/pBwKhYS87OP5lLqHJ3llqY6YbOvrDq3/pwOal2zUo3LIBHAfH/9A0mqRVt6A=
cache-control: public, max-age=900, stale-while-revalidate=3600
x-amz-request-id: REAQ8TYD20TG5237
cf-ray: 8c59f5f1eb5b5401-YYZ
accept-ranges: bytes
content-length: 21421
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2

200

tag Show response
btloader.com/
Redirect Chain

https://freestar-io.videoplayerhub.com/gallery.js
https://btloader.com/tag?h=freestar-io&upapi=true

57 KB
19 KB

1380ms
27ms

Script
application/javascript

172.67.41.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?h=freestar-io&upapi=true
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Server: 172.67.41.60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f42a674b938beee58f1bdde8256a3e75c46999fc0adf2826288323edcff440f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "f1f304d1058f75ea7cf741368762a9b9"
age: 330
via: 1.1 google
cf-ray: 8c59f6054ed154d3-YYZ
accept-ranges: bytes
content-length: 19474
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 13:26:34 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: max-age=3600
location: https://btloader.com/tag?h=freestar-io&upapi=true
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AFLliAXHqyBBHNMw%2BvZy%2Fp0o4QezANxqlQuhpRh4QuWkY0YKQeeCs33RAFBDh7scfNRJCOM3xkPH38McMbYkfjvIUBFpoKRdqnrdHou4deZPhas7iTs%2BRUXBOomZKobYxDGMllCtQiPsIgASEBHyuA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c59f5f24b6cab42-YYZ
expires: Thu, 19 Sep 2024 14:35:45 GMT
content-length: 167
date: Thu, 19 Sep 2024 13:35:45 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 324 KB
80 KB 531ms
83ms Script
application/javascript 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fdb7c12792ebd6e785128456249178e9b508c9677a300df8fbc6e7520147baa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"907cbdd883935369790d45cc9bd9e8b7"
age: 2777
via: 1.1 22e9d361a9c4153886c1c8aa0eb4ffa8.cloudfront.net (CloudFront), 1.1 ed8dbde89917eaa6ca93ba7fad809c48.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: M8IstKEPGMtjAG4HA58a-mKbHFNcO3XR6B5pmwg76a-cN7eHA3XJwA==
date: Thu, 19 Sep 2024 12:49:29 GMT
content-type: application/javascript
last-modified: Wed, 28 Aug 2024 22:46:37 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 56 KB
12 KB 531ms
115ms Script
application/javascript 104.22.53.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&ref=&_it=freestar&partner_id=474&ha=_hadron
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.53.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 492db2ca577f4d221e3e28239c19e7db05f1701b298bf278fc4d1fcb92563586

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: public, max-age=432000
content-encoding: br
cf-bgj: minify
etag: W/"1e77f38a1df1490d4175e3c4878bd150"
age: 107
cf-cache-status: HIT
x-amz-request-id: 4GNTEWM5RE8S976C
expires: Tue, 24 Sep 2024 13:35:45 GMT
cf-ray: 8c59f5f439c239e4-YYZ
date: Thu, 19 Sep 2024 13:35:45 GMT
content-type: application/javascript
last-modified: Tue, 04 Jun 2024 15:30:02 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: 1KYvP1UJui3F3sexSI8Edev0ssCxy0r1hoLYL3sInblmS0xC6TVIxfrJbVQshQPcVtGMRX8qMGE=

GET 4d97a662ad
pb-rtd.ccgateway.net/v1.0/realtime/ 0
0

GET
H2 200 edgekit.min.js Show response
cdn.edkt.io/PV483g/ 21 KB
7 KB 470ms
83ms Script
text/javascript 34.120.111.33
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.edkt.io/PV483g/edgekit.min.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.111.33 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 33.111.120.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 9b6a8166404c55bd5b9148597b0492dc78a7eb7fe6d8ca6050ebb655656e1f4d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=Nev1nw==, md5=nyXRH79gkPNZYWtFib0k0A==
etag: "9f25d11fbf6090f359616b4589bd24d0"
age: 15795
x-goog-stored-content-encoding: gzip
expires: Fri, 20 Sep 2024 09:12:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 6718
date: Thu, 19 Sep 2024 09:12:30 GMT
last-modified: Wed, 18 Sep 2024 09:39:37 GMT
content-type: text/javascript
x-guploader-uploadid: AD-8ljusAHrX3G0J0V0RF3mRBkIFroCg2n6Avb9Kjmeutg0GxpxGbahQSQP36DF679hifLFLA1E
cache-control: public, max-age=86400,no-transform
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1726652377074854
content-length: 6718
server: UploadServer

GET
H3

200

envelope Show response
lexicon.33across.com/v1/
Redirect Chain

https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.8&coppa=0
https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.8&coppa=0&b=1&tp=ohqGK%2FjR%2BpbTvHaSzLLbzuGo00wRZuFk8hlfLOYMQI0%3D

42 B
58 B

65ms
57ms

Fetch
application/json

35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.8&coppa=0&b=1&tp=ohqGK%2FjR%2BpbTvHaSzLLbzuGo00wRZuFk8hlfLOYMQI0%3D
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H3
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Thu, 19 Sep 2024 13:35:46 GMT
content-type: application/json
vary: origin

Redirect headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
location: https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.8&coppa=0&b=1&tp=ohqGK%2FjR%2BpbTvHaSzLLbzuGo00wRZuFk8hlfLOYMQI0%3D
access-control-allow-credentials: true
referrer-policy: unsafe-url
via: 1.1 google
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 19 Sep 2024 13:35:45 GMT
vary: origin

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58657/ 391 B
933 B 662ms
43ms Fetch
application/json 69.147.92.12
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58657/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/&pixelId=58657

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.147.92.12 Ashburn, United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

f33f18c1cc424c1246d4bc672be234aa2e671e772b4c8d8edfc8db45fe9b3560

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 19 Sep 2024 13:35:45 GMT
x-xss-protection: 1; mode=block
content-type: application/json
vary: Origin
server: ATS

GET
H2 200 json Show response
gum.criteo.com/sid/ 392 B
694 B 238ms
53ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5486f42f6d7f1fb3adbf924bbec4d772a8adc5d2e4b0cff68f5c076eb9e76f49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 396384
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:45 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 227 B
326 B 2197ms
39ms Fetch
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=474&_it=prebid&t=1&src=id&domain=www.bleepingcomputer.com
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e21d40d06dd91e757348c94fbd108af537e80b902b5878421ff4445440fdf998

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: br
allow: POST, OPTIONS, GET
cf-ray: 8c59f6013b40aafd-YYZ
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:35:47 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
673 B 731ms
123ms Fetch
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ec2-34-195-102-116.compute-1.amazonaws.com

Software

Resource Hash

69ddbfe0111131323a6c637b0fcf18449cd7f4bab70211c0b2c9bb51232bdb9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP="CAO PSA OUR"
date: Thu, 19 Sep 2024 13:35:44 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 any Show response
idx.liadm.com/idex/did-0047/ 126 B
548 B 4036ms
66ms Fetch
text/plain 34.195.102.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/did-0047/any?duid=83077f409aa5--01j857xwvpfdt0vces3nt7r7w2&did=did-0047&cd=.bleepingcomputer.com&pu=https%3A%2F%2Fwww.bleepingcomputer.com&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=thetradedesk&resolve=medianet

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.195.102.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

7007c0fb4b03f9e05635501c0df192f63fb6c1299bb1c68a96e89547672464d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 0c8182a225429044
request-time: 4
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:35:49 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 126
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
574 B 2785ms
53ms Fetch
application/json 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=6bjin1p&fmt=json
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: c1ad6bd5489638d911abe841a4f8a813d2b2494deea4680eca2ed7800fc8fcbb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: private
content-encoding: gzip
access-control-allow-credentials: true
expires: Sat, 19 Oct 2024 13:35:48 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept

GET
H3

200

envelope Show response
lexicon.33across.com/v1/
Redirect Chain

https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.8&coppa=0
https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.8&coppa=0&b=1&tp=Iwa2%2Bz9mbyC0JJ1QPCij7sSz5jHf3eUg5hJRTuYRb%2BI%3D

42 B
58 B

53ms
53ms

Fetch
application/json

35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.8&coppa=0&b=1&tp=Iwa2%2Bz9mbyC0JJ1QPCij7sSz5jHf3eUg5hJRTuYRb%2BI%3D
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H3
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Thu, 19 Sep 2024 13:35:46 GMT
content-type: application/json
vary: origin

Redirect headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
location: https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.8&coppa=0&b=1&tp=Iwa2%2Bz9mbyC0JJ1QPCij7sSz5jHf3eUg5hJRTuYRb%2BI%3D
access-control-allow-credentials: true
referrer-policy: unsafe-url
via: 1.1 google
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 19 Sep 2024 13:35:45 GMT
vary: origin

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58657/ 391 B
591 B 443ms
52ms Fetch
application/json 69.147.92.12
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.147.92.12 Ashburn, United States, ASN14777 (YAHOO, US),

Reverse DNS

e2.ycpi.vip.dca.yahoo.com

Software

ATS /

Resource Hash

6d8c3b7b5477520ecbc76836ecae08b0190393f41aa66ef4687e1a7284877e62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 19 Sep 2024 13:35:45 GMT
x-xss-protection: 1; mode=block
content-type: application/json
vary: Origin
server: ATS

GET
H2 200 json Show response
gum.criteo.com/sid/ 399 B
700 B 168ms
75ms Fetch
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

138d104fdec9cad8910a9cb29e4fb35e23fb0814a9afbd2cdf94c84346cbe6f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 501381
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:45 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 227 B
174 B 1958ms
33ms Fetch
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=474&_it=prebid&t=1&src=id&domain=www.bleepingcomputer.com
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e21d40d06dd91e757348c94fbd108af537e80b902b5878421ff4445440fdf998

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: br
allow: POST, OPTIONS, GET
cf-ray: 8c59f6017b73aafd-YYZ
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:35:47 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
672 B 460ms
124ms Fetch
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

69ddbfe0111131323a6c637b0fcf18449cd7f4bab70211c0b2c9bb51232bdb9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP="CAO PSA OUR"
date: Thu, 19 Sep 2024 13:35:45 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 any Show response
idx.liadm.com/idex/did-0047/ 126 B
0 3809ms
3808ms Fetch
text/plain 34.195.102.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://idx.liadm.com/idex/did-0047/any?duid=83077f409aa5--01j857xwvpfdt0vces3nt7r7w2&did=did-0047&cd=.bleepingcomputer.com&pu=https%3A%2F%2Fwww.bleepingcomputer.com&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=thetradedesk&resolve=medianet
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.102.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-102-116.compute-1.amazonaws.com
Software: /
Resource Hash: 7007c0fb4b03f9e05635501c0df192f63fb6c1299bb1c68a96e89547672464d3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=86399, private
trace-id: 0c8182a225429044
request-time: 4
access-control-allow-credentials: true
expires: Fri, 20 Sep 2024 13:35:49 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 126
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
0 2545ms
2545ms Fetch
application/json 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=6bjin1p&fmt=json
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: c1ad6bd5489638d911abe841a4f8a813d2b2494deea4680eca2ed7800fc8fcbb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: private
content-encoding: gzip
access-control-allow-credentials: true
expires: Sat, 19 Oct 2024 13:35:48 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2

200

j Show response
rp.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1726752946175&did=did-0047&se=e30&duid=83077f409aa5--01j857xwvpfdt0vces3nt7r7w2&tv=8.49.8&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-b...
https://rp.liadm.com/j?dtstmp=1726752946175&did=did-0047&se=e30&duid=83077f409aa5--01j857xwvpfdt0vces3nt7r7w2&tv=8.49.8&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-b...

13 B
368 B

216ms
215ms

Fetch
application/json

3.231.87.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp.liadm.com/j?dtstmp=1726752946175&did=did-0047&se=e30&duid=83077f409aa5--01j857xwvpfdt0vces3nt7r7w2&tv=8.49.8&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&wpn=prebid&cd=.bleepingcomputer.com&n3pc=true
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Server: 3.231.87.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-231-87-30.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-pixel-event-id: 48091d77-b59a-4395-9b33-60f67632f059
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 13
date: Thu, 19 Sep 2024 13:35:47 GMT
content-type: application/json

Redirect headers

access-control-allow-origin: https://www.bleepingcomputer.com
location: /j?dtstmp=1726752946175&did=did-0047&se=e30&duid=83077f409aa5--01j857xwvpfdt0vces3nt7r7w2&tv=8.49.8&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&wpn=prebid&cd=.bleepingcomputer.com&n3pc=true
content-length: 0
access-control-expose-headers: *
date: Thu, 19 Sep 2024 13:35:46 GMT
access-control-allow-credentials: true
access-control-allow-methods: GET

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
10 KB 1670ms
89ms Script
application/javascript 192.184.68.254
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.184.68.254 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 76c46df9a6ba94318fafe8023e3f52e28b1b9a1eaf16dcd4d7ce95ab6942859b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=604800
content-encoding: gzip
etag: "tIg8n6xaLBY4WwNLLw9OGA=="
expires: Thu, 26 Sep 2024 13:35:47 GMT
accept-ranges: bytes
date: Thu, 19 Sep 2024 13:35:47 GMT
content-type: application/javascript
vary: Accept-Encoding

GET
H/1.1 200
OK load.js Show response
s.ntv.io/serve/ 584 KB
183 KB 1578ms
157ms Script
application/x-javascript 23.44.136.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ntv.io/serve/load.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.136.16 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-44-136-16.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 666d6102b5206bb70da7195aee0bf0d23dff1fdbed22ef259e3c54c64c36080d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Encoding: gzip
ETag: "d60eb6fe00eef8c9bb54308f9f90dd19"
Access-Control-Allow-Methods: GET
Date: Thu, 19 Sep 2024 13:35:47 GMT
Last-Modified: Tue, 17 Sep 2024 00:37:58 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
x-amz-id-2: jOZLV511d6I1dslMn5XOmbT/+n2jiYjIgimtc68ivUD8fyYY+y4ZqNdhNlmNAslJXyPYFrGJ6MA=
Transfer-Encoding: chunked
Access-Control-Allow-Headers: *
Cache-Control: public, max-age=3600
Connection: keep-alive, Transfer-Encoding
x-amz-request-id: 42EG73F1060TERFZ
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 freestar_close_button.svg
a.pub.network/core/imgs/ 1 KB
1 KB 54ms
45ms Image
image/svg+xml 104.18.21.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.pub.network/core/imgs/freestar_close_button.svg

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b60f65161ce3517c2794eecab25981c51ffbcbc951a781270403e2f3572d0290

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.bleepingcomputer.com/

Response headers

x-goog-metageneration: 2
access-control-expose-headers: *
x-goog-hash: crc32c=xUDeFg==, md5=1OG2/3P8Bvg2SBLmidtA+g==
cf-cache-status: HIT
etag: W/"d4e1b6ff73fc06f8364812e689db40fa"
age: 347
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Thu, 19 Sep 2024 14:35:46 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 1211
date: Thu, 19 Sep 2024 13:35:46 GMT
content-type: image/svg+xml
last-modified: Wed, 04 Sep 2024 08:16:13 GMT
vary: Accept-Encoding
x-guploader-uploadid: AD-8lju3JVB9D2pxcudGjEggCe4mZHb222ZdPG5QuC7gHLVPUKoAU4KPWmPN6hw6KkOEVoJMK_o
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c59f5faf9cf36c4-YYZ
access-control-allow-origin: *
x-goog-generation: 1725437773526766
server: cloudflare

POST page_load
pb-ing.ccgateway.net/v1.0/parent/4d97a662ad/engagement/trigger/ 0
0

GET
H3 200 fslogo-green.svg
a.pub.network/core/imgs/ 1 KB
1 KB 36ms
35ms Image
image/svg+xml 104.18.21.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.pub.network/core/imgs/fslogo-green.svg

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecc20ed3c5dedbe5bbe73d1e7b14270c65a85f7d0ec4c94c4f0c9f0071e471a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 2
access-control-expose-headers: *
x-goog-hash: crc32c=Jh+rSg==, md5=Mm1svZd2V+EgW9YW0fL6yg==
cf-cache-status: HIT
etag: W/"326d6cbd977657e1205bd616d1f2faca"
age: 347
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Thu, 19 Sep 2024 14:35:46 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 1193
date: Thu, 19 Sep 2024 13:35:46 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 17:04:37 GMT
vary: Accept-Encoding
x-guploader-uploadid: AD-8ljvrL56LvqX7Tk-LtYP06ibHGp9GWz8wz50-SX_uQHMAijRBb80JvVj85ld2rvXTgMu9lkQ
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c59f5fbca6536c4-YYZ
access-control-allow-origin: *
x-goog-generation: 1599584677716817
server: cloudflare

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 7BE1 0
0 112ms
33ms Document
text/html 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-131-10-225.us-east-2.compute.amazonaws.com

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2037
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29981
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Sep 2024 13:01:50 GMT
expires: Thu, 19 Sep 2024 13:51:50 GMT
last-modified: Mon, 16 Sep 2024 19:45:28 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 insights.bin Show response
ins.connatix.com/01edb87e-dd11-404d-8bd2-399ed97b314b/402/ Frame 3E34 794 B
768 B 1460ms
32ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/01edb87e-dd11-404d-8bd2-399ed97b314b/402/insights.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 243c0d12ad72ec2edb96e7ca4195e6421deef3fe9837c4c1736f7a3334cdcbf6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"73675a4bc92c325eade281e1c77a6137"
access-control-allow-methods: GET, HEAD
cf-ray: 8c59f6054f29ac39-YYZ
expires: Fri, 19 Sep 2025 13:35:48 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: application/x-protobuf
last-modified: Thu, 19 Sep 2024 08:58:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 402_media.bin Show response
vid.connatix.com/pid-de820c7a-cd3f-49f4-9038-04e5790f8d5e/01edb87e-dd11-404d-8bd2-399ed97b314b/ca430171-8e6c-4d5b-ac3a-fc7145bd71a8/ Frame 3E34 3 KB
2 KB 1453ms
54ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/pid-de820c7a-cd3f-49f4-9038-04e5790f8d5e/01edb87e-dd11-404d-8bd2-399ed97b314b/ca430171-8e6c-4d5b-ac3a-fc7145bd71a8/402_media.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c2fac048783c64eaa466fcc19026ca88642b2a2e91b20c9c834d16cd8db1ec0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: W/"220ed64612d5403c2faf98dcca9dc706"
xpid: de820c7a-cd3f-49f4-9038-04e5790f8d5e
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:48 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: application/x-protobuf
last-modified: Thu, 19 Sep 2024 08:58:19 GMT
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-headers: range
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f605487aac9c-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H3 200 player.iframe.integration.destroy.36a6acd4c6a25adcf984.js Show response
cds.connatix.com/a/ 748 B
760 B 35ms
34ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/a/player.iframe.integration.destroy.36a6acd4c6a25adcf984.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cbf3c422de9dd1138a40ce357476ce8ae988f0a2a1f3a72f8679ccd5b67aa10

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "e04bbcdba134b1982da8b729c45bc255"
x-amz-version-id: BBRcpFxM0cqNCbT0Pl6K5H4upWy4YSjG
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:46 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:46 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:59 GMT
vary: Accept-Encoding
access-control-allow-headers: range
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f5fcb8e7ab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 378
server: cloudflare

GET
H2 200 insights.bin Show response
ins.connatix.com/52a0506d1ff06142322930b9f68e7f61/ Frame 3E34 576 B
413 B 1386ms
30ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/52a0506d1ff06142322930b9f68e7f61/insights.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b907cb03a10c5d88a8d0dcf23a4ca5086c15d8af3d9ac5a06ef04c40cc6ff0f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"e7a8c7ed74a46ba2e547cd561d5b0ed5"
access-control-allow-methods: GET, HEAD
cf-ray: 8c59f6054f2aac39-YYZ
expires: Fri, 19 Sep 2025 13:35:48 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: application/x-protobuf
last-modified: Sat, 14 Sep 2024 14:09:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DIndex%26api-tier%3D1%26uid%3D&gdpr=0
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DIndex%26api-tier%3D1%26uid%3D&gdpr=0&s=190549&C=1
https://cks.connatix.com/cks?pid=17&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Index&api-tier=1&uid=ZuwotNHM6VUAAGKwAFEXggAA%263513

139 B
253 B

86ms
51ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=17&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Index&api-tier=1&uid=ZuwotNHM6VUAAGKwAFEXggAA%263513
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d87e2f37df4c75db4d67eb4bd8013a83624b0e4d0ed2d98460b060c6572a8b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f60aad0cab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: https://cks.connatix.com/cks?pid=17&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Index&api-tier=1&uid=ZuwotNHM6VUAAGKwAFEXggAA%263513
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G9EKeNzfXJzV%2FuS1Ke8jdsWnLbVN50WT71FmOxoR6ICexBV5aR3tPvjPY%2FtJ2lpON7xnyYaa1QpeGqQmBfSf4JdNC6a9N2DIZ1x1nn8iyvVz9Hbt92E5IpuRvb%2BlKBVCGdu4pXFe"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c59f608d835ac00-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 19 Sep 2024 13:35:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D15%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DBeeswax%26api-tier%3D1%26uid%3D%7Buserid%7D&g...
https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D15%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DBeeswax%26api-tier%3D1%26uid%3D%7Buserid%7D&g...
https://cks.connatix.com/cks?pid=15&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Beeswax&api-tier=1&uid=AABZak7N2FIAABYXV8En4A&gdpr=0

132 B
248 B

30ms
30ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=15&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Beeswax&api-tier=1&uid=AABZak7N2FIAABYXV8En4A&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b5ae240a18bb64b5ba3fa62d80ad8c4c725ba64f5fefdbe21f6e743a233a7e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f65f5924ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:36:02 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://cks.connatix.com/cks?pid=15&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Beeswax&api-tier=1&uid=AABZak7N2FIAABYXV8En4A&gdpr=0
Content-Length: 0
Date: Thu, 19 Sep 2024 13:36:02 GMT
Server: gunicorn
Connection: keep-alive

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1&gdpr=0
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gapzaid&ttd_tpi=1&gdpr=0
https://cks.connatix.com/cks?pid=19&uid=bc8b0835-1393-4f63-9270-2da844e8deab&ttl=1729344948

146 B
255 B

85ms
50ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=19&uid=bc8b0835-1393-4f63-9270-2da844e8deab&ttl=1729344948
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a065f497cb52a6558614c63c0859a4fcfca8f518311de1f096f8cea2987f9197

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f60aad0fab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://cks.connatix.com/cks?pid=19&uid=bc8b0835-1393-4f63-9270-2da844e8deab&ttl=1729344948
content-length: 213
date: Thu, 19 Sep 2024 13:35:48 GMT
server: Kestrel

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ad.turn.com/r/cs?pid=67&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D21%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DAmobee%26api-tier%3D1%26uid%3D%23USER_ID%23&gdpr=0
https://cks.connatix.com/cks?pid=21&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Amobee&api-tier=1&uid=4431262957904967240

129 B
241 B

29ms
28ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=21&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Amobee&api-tier=1&uid=4431262957904967240
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b2c08d9c7d102f02ed572e35f74134af4f5d371724c580ea5cec9a703d8bd20

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f65f390fab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:36:02 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://cks.connatix.com/cks?pid=21&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Amobee&api-tier=1&uid=4431262957904967240
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 19 Sep 2024 13:35:59 GMT

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D25%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DTripleLift%26api-tier%3D1%26uid%3D%24UID&gdpr=0
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D25%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DTripleLift%26api-tier%3D1%26uid%...
https://cks.connatix.com/cks?pid=25&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=TripleLift&api-tier=1&uid=515864219262712206300

131 B
243 B

48ms
47ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=25&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=TripleLift&api-tier=1&uid=515864219262712206300
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f920e116356ae38e87ea22d6fdccc1aacf08465f9d4ee28ff11a81d6ae1477e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f6103a73ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cks.connatix.com/cks?pid=25&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=TripleLift&api-tier=1&uid=515864219262712206300
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 19 Sep 2024 13:35:49 GMT

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D6%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DAppNexus%26api-tier%3D1%26uid%3D%24UID=&gdpr=0
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fcks.connatix.com%252Fcks%253Fpid%253D6%2526ev%253D660e6b66996a490e85b1a7c15e2b4b7f%2526pname%253DAppNexus%2526api-tier%253D1%2526uid%...
https://cks.connatix.com/cks?pid=6&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=AppNexus&api-tier=1&uid=581897326773403389=&gdpr=0

128 B
242 B

47ms
46ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=6&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=AppNexus&api-tier=1&uid=581897326773403389=&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d72ab5cce5d1e94e1a518bc852d8680fb9f54f90d05af08aba41cac5631b0a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f6103a74ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://cks.connatix.com/cks?pid=6&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=AppNexus&api-tier=1&uid=581897326773403389=&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 154.47.17.56; 154.47.17.56; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: fdff468b-5e0c-4781-a982-a36d24eb217e
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:35:49 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=connatix&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D44%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DNexxen%26api-tier%3D1%26uid%3D%5BRX_UUID%5D...
https://sync.1rx.io/usersync2/rmpssp?sub=connatix&zcc=1&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D44%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DNexxen%26api-tier%3D1%26uid%3D%5BRX_U...
https://ad.turn.com/r/cs?pid=45&id=RX-77f2fc8e-b914-43b5-afd5-d80cfef17de3-005&rndcb=1945522523
https://sync.1rx.io/usersync/turn/8015622402356240821?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-77f2fc8e-b914-43b5-afd5-d80cfef17de3-005?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D44%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DNexx...
https://cks.connatix.com/cks?pid=44&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Nexxen&api-tier=1&uid=RX-77f2fc8e-b914-43b5-afd5-d80cfef17de3-005

153 B
260 B

31ms
30ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=44&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Nexxen&api-tier=1&uid=RX-77f2fc8e-b914-43b5-afd5-d80cfef17de3-005
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21c9adb6edd818867c01ecd4e2bb2725a50ae7bc70b841e44673d8ff857daa9d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f660fa96ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:36:02 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://cks.connatix.com/cks?pid=44&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Nexxen&api-tier=1&uid=RX-77f2fc8e-b914-43b5-afd5-d80cfef17de3-005
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Thu, 19 Sep 2024 13:36:07 GMT
etag: RX77f2fc8eb91443b5afd5d80cfef17de3005
content-type: text/html

GET
H3

200

pixel Show response
capi.connatix.com/us/
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=6&nwid=3630&gdpr=0&gdpr_consent=null&url=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d40%26ev%3d660e6b66996a490e85b1a7c15e2b4b7f%26pname%3dSmartA...
https://capi.connatix.com/us/pixel?puid=1025924811267706626&pId=40&gdpr=0&gdpr_consent=

82 B
413 B

62ms
60ms

Script
image/gif

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/us/pixel?puid=1025924811267706626&pId=40&gdpr=0&gdpr_consent=
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7f28e33d6a65a4269a7f4e327a177ead60fea39cb13129a35c4b24fef84f5af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

surrogate-control: no-cache, no-store, must-revalidate, max-age=0
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 8c59f618a9a2a21c-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 95
date: Thu, 19 Sep 2024 13:35:51 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

cache-control: no-cache,no-store
location: https://capi.connatix.com/us/pixel?puid=1025924811267706626&pId=40&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 19 Sep 2024 13:35:50 GMT
pragma: no-cache

GET
H2 200 cookie Show response
c1.adform.net/ 35 B
522 B 1115ms
43ms Script
image/gif 185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/cookie?redirect_url=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D46%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DAdForm%26api-tier%3D1%26uid%3D%24UID&gdpr=0

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/589.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

7fff1569ea68ef52782ba25b0cf3934627f7a4fc1e8e22f4652de959c5f97978

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: image/gif
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET multi-sync.html
secure-assets.rubiconproject.com/utils/xapi/ Frame F696 0
0

GET

/
de.tynt.com/deb/ Frame C10F
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0015a00002y7TWTAA2&ru=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D37%26UserId%3D660e6b66996a490e85b1a7c15e2b4b7f%26DemandPartnerN...
https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00002y7TWTAA2&ru=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D37%26UserId%3D660e6b66996a490e85b1a7c15e2b4b7f%26DemandPartnerName%3D_3...

0
0

GET user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 69CA 0
0

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=WIMKYDH0&gdpr=0&gdpr_consent=null&redirectUri=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d45%26ev%3d660e6b66996a490e85b1a7c15e2b4b7f%26pname%3...
https://cks.connatix.com/cks?pid=45&pname=Sharethrough&api-tier=1&uid=0f918fba-cde2-4226-9f81-74432a0e5288&gdpr=0&gdpr_consent=null

146 B
255 B

43ms
42ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=45&pname=Sharethrough&api-tier=1&uid=0f918fba-cde2-4226-9f81-74432a0e5288&gdpr=0&gdpr_consent=null
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8da364092fcca0c03c8d90746adf78abd28edf7c2cce987ff76a7cd5efdf215c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f60f296aab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cks.connatix.com/cks?pid=45&pname=Sharethrough&api-tier=1&uid=0f918fba-cde2-4226-9f81-74432a0e5288&gdpr=0&gdpr_consent=null
content-length: 0

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=561340&daaqp=1&ev=1&rurl=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D13%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DPulsePoint%26api-tier%3D1%26uid%3D%...
https://cks.connatix.com/cks?pid=13&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=PulsePoint&api-tier=1&uid=entIUMJq7Y6Q

122 B
238 B

124ms
121ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=13&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=PulsePoint&api-tier=1&uid=entIUMJq7Y6Q
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c089ec01c2c92834a46aed993389441d6f42c56bca11e8efd071c10ccafb5040

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f61769b8ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:50 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://cks.connatix.com/cks?pid=13&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=PulsePoint&api-tier=1&uid=entIUMJq7Y6Q
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-85f9594754-qjq7d
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
server: Jetty(10.0.14)

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=g&gdpr={gdpr}&gdpr_consent={gdpr_consent}&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d48%26ev%3d660e6b66996a490e85b1a7c15e2b4b7f%26pname%3dSmaato%26api-ti...
https://cks.connatix.com/cks?pid=48&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Smaato&api-tier=1&uid=6db2e17714

120 B
234 B

135ms
133ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=48&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Smaato&api-tier=1&uid=6db2e17714
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: edc399fa02411570c4e2b1e380cd049b760a0e406d1b7cd2a216a428dd661f7b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f61769b6ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:50 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://cks.connatix.com/cks?pid=48&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Smaato&api-tier=1&uid=6db2e17714
via: 1.1 bf49868a84302f57b8f20d68a5a57812.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: 7TEPv9_vskGpHhfSrwpJwu18CFsjqlFopfwiiLegN69_s-XrCbZo4w==
date: Thu, 19 Sep 2024 13:35:50 GMT
x-amz-cf-pop: JFK52-P7
server: CloudFront

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://i.ctnsnet.com/int/cm?exc=24&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D28%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DCrimtan%26api-tier%3D1%26uid%3D%5Buser_id%5D&gdpr=0
https://cks.connatix.com/cks?pid=28&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Crimtan&api-tier=1&uid=4b889810fd7f4e8c83fe907574592b07

142 B
251 B

120ms
117ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=28&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Crimtan&api-tier=1&uid=4b889810fd7f4e8c83fe907574592b07
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71609e712f51acba6b35c0d76ca57e07afc2fdda35305f2fca8ea7ab58f26ad9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f61769aeab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:50 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://cks.connatix.com/cks?pid=28&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Crimtan&api-tier=1&uid=4b889810fd7f4e8c83fe907574592b07
pragma: no-cache
via: 1.1 google
expires: Fri, 01 Jan 1990 00:00:00 GMT
status: 302
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CUR OUR NOR"
content-length: 0
x-xss-protection: 1; mode=block
date: Thu, 19 Sep 2024 13:35:50 GMT
content-type: text/html;charset=UTF-8

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D43%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DSonobi%26api-tier%3D1%26uid%3D%5BUID%5D&gdpr=0
https://cks.connatix.com/cks?pid=43&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Sonobi&api-tier=1&uid=efcb09bb-e5a1-4f81-8bc3-973d1c186f0c

146 B
253 B

129ms
120ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=43&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Sonobi&api-tier=1&uid=efcb09bb-e5a1-4f81-8bc3-973d1c186f0c
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 189226a46279bbacb04ea6704ba733616fc7ddd94c753e767b0be91599cd1c0b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f61769acab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:50 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://cks.connatix.com/cks?pid=43&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Sonobi&api-tier=1&uid=efcb09bb-e5a1-4f81-8bc3-973d1c186f0c
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 19 Sep 2024 13:35:50 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-35
x-xss-protection: 0

GET /
csync.loopme.me/ 0
0

GET
H2 200 sync Show response
x.bidswitch.net/ 43 B
183 B 1717ms
48ms Script
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://x.bidswitch.net/sync?ssp=connatix&user_id=660e6b66996a490e85b1a7c15e2b4b7f&gdpr=0
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/589.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: d346801abbf9bb4e9e9a055239053d4ab5596514304f601a6c70604187acb744

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 19 Sep 2024 13:35:51 GMT
content-type: image/gif

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=105&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D9%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DCentro%26api-tier%3D1%26uid%3D%7BuserId...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=105&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D9%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DCentro%26api-tier%3D1%26uid%3...
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=b75d9ed5-993d-48a9-bf04-5e8cf4ba9ae2-66ec28b7-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=b75d9ed5-993d-48a9-bf04-5e8cf4ba9ae2-66ec28b7-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=b75d9ed5-993d-48a9-bf04-5e8cf4ba9ae2-66ec28b7-5553&partner_url=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D9%26ev%3D660e6b6...
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=b75d9ed5-993d-48a9-bf04-5e8cf4ba9ae2-66ec28b7-5553&partner_url=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D9%26ev%3D6...
https://cks.connatix.com/cks?pid=9&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Centro&api-tier=1&uid=b75d9ed5-993d-48a9-bf04-5e8cf4ba9ae2-66ec28b7-5553&gdpr=0

159 B
263 B

29ms
28ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=9&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Centro&api-tier=1&uid=b75d9ed5-993d-48a9-bf04-5e8cf4ba9ae2-66ec28b7-5553&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f096672de58974f0fe865de7b2e6bbc66944a21124be2e53c93a8056e6f1939d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f64bce84ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:59 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://cks.connatix.com/cks?pid=9&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Centro&api-tier=1&uid=b75d9ed5-993d-48a9-bf04-5e8cf4ba9ae2-66ec28b7-5553&gdpr=0
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 19 Sep 2024 13:35:59 GMT
server: Jetty(11.0.13)

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ads.yieldmo.com/pbsync?is=smartnews&redirectUri=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D39%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DYieldMo%26api-tier%3D1%26uid%3D%24UID&gdpr=0
https://cks.connatix.com/cks?pid=39&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=YieldMo&api-tier=1&uid=VRYofYYK3oYot_1DS8ch&gdpr=0

130 B
246 B

29ms
28ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=39&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=YieldMo&api-tier=1&uid=VRYofYYK3oYot_1DS8ch&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29597da20b0161859e4f6cfa511c5cacaa52436932b93d3ebe16594364c7a96c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f62fcb32ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://cks.connatix.com/cks?pid=39&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=YieldMo&api-tier=1&uid=VRYofYYK3oYot_1DS8ch&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://connatix-supply-partners.tremorhub.com/sync?UISCX=660e6b66996a490e85b1a7c15e2b4b7f&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D5%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DTel...
https://cks.connatix.com/cks?pid=5&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Telaria&api-tier=1&uid=e41d024793374cf499f781052764e5f1

141 B
251 B

28ms
27ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=5&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Telaria&api-tier=1&uid=e41d024793374cf499f781052764e5f1
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 853bb1cd5082672e3d15561a41ccdabdbbb9d3c62cf30821f16ee4ff7cdd2d4c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f648ab77ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:58 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://cks.connatix.com/cks?pid=5&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Telaria&api-tier=1&uid=e41d024793374cf499f781052764e5f1
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Thu, 19 Sep 2024 13:35:58 GMT
server: nginx

GET
H3

200

us Show response
capi.connatix.com/core/
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3672&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=ebe0e44056419bacaa87a61f23a4c317&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0

0
253 B

55ms
54ms

Script
application/json

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=ebe0e44056419bacaa87a61f23a4c317&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f61b0b82a21c-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 19 Sep 2024 13:35:51 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache
Location: https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=ebe0e44056419bacaa87a61f23a4c317&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
Pragma: no-cache
x-sticky-vk: 1726752951472056-276
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 19 Sep 2024 13:35:51 GMT
Server: nginx

GET
H2 200 sync-iframe
cs-server-s2s.yellowblue.io/ Frame 4E8F 0
0 770ms
41ms Document
text/html 44.213.160.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr={gdpr}&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d660e6b66996a490e85b1a7c15e2b4b7f%26pname%3dIronSource%26api-tier%3d1%26uid%3d{partnerId}%26direct%3D1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/589.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 44.213.160.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-213-160-10.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: cs-server-s2s.yellowblue.io
content-type: text/html
date: Thu, 19 Sep 2024 13:35:48 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.resetdigital.co/csync?pid=connatix&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D35%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DResetDigital%26api-tier%3D1%26uid%3D%24USER_I...
https://cks.connatix.com/cks?pid=35&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=ResetDigital&api-tier=1&uid=0000015ABACC79AE

126 B
240 B

38ms
37ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=35&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=ResetDigital&api-tier=1&uid=0000015ABACC79AE
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c084cfc5682a90f51571766a9806b27777e301fbec8bf3139e83efeed2700ca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f61b9eecab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:51 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
location: https://cks.connatix.com/cks?pid=35&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=ResetDigital&api-tier=1&uid=0000015ABACC79AE
content-length: 0
date: Thu, 19 Sep 2024 13:35:51 GMT
content-type: text/html

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17331/ 43 KB
13 KB 328ms
38ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17331/sync.min.js?gdpr=0
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/589.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f48c5d349a73b41850ff4349fc02a2e43f172ecfbb5efe7e9437e6ca38403178

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7a801cdc14047a14bf5f276389e89151"
age: 27791
via: 1.1 dd80355363eac92e0372107558e579a8.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: KrNunDq46C-yKDyKHZXZg5bk21YcfLWcNquObYscTd_hQzNZJHaf2w==
date: Thu, 19 Sep 2024 06:08:28 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:59:45 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.colossusssp.com/1a1c07e870d45c05896c3f9e9973d4b4.gif?puid=660e6b66996a490e85b1a7c15e2b4b7f&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D34%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f...
https://cks.connatix.com/cks?pid=34&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Colossus&api-tier=1&uid=62b6fdf2-16a5-45a0-9002-6edbd2aac242

146 B
253 B

81ms
62ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=34&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Colossus&api-tier=1&uid=62b6fdf2-16a5-45a0-9002-6edbd2aac242
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e758823887771b358f39a2a4d134298acd44615d60478432603da30dc04953a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f6238fa4ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Cache-Control: no-cache, no-store, must-revalidate
Location: https://cks.connatix.com/cks?pid=34&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Colossus&api-tier=1&uid=62b6fdf2-16a5-45a0-9002-6edbd2aac242
Pragma: no-cache
Connection: keep-alive
Expires: 0
Date: Thu, 19 Sep 2024 13:35:52 GMT
Server: nginx

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D1%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DSundaySky%26api-tier%3D1%26uid%3D%24%7Bssky_uuid%7D&gdpr=0
https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D1%26ev%3D660e6b66996a490e85b1a7c15e2b4b7f%26pname%3DSundaySky%26api-tier%3D1%26uid%3D%24%7Bssky_uuid%7D&gdpr...
https://cks.connatix.com/cks?pid=1&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=SundaySky&api-tier=1&uid=d6.568403bec21748e2ba58c1db28832e28

144 B
252 B

30ms
30ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=1&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=SundaySky&api-tier=1&uid=d6.568403bec21748e2ba58c1db28832e28
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10b4094501644ad85a67a98c6c8ce2484467bb67dc402ad690e8239dd3f1f11b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f620acb3ab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

x-content-type-options: nosniff
location: https://cks.connatix.com/cks?pid=1&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=SundaySky&api-tier=1&uid=d6.568403bec21748e2ba58c1db28832e28
content-length: 0
date: Thu, 19 Sep 2024 13:35:52 GMT
x-frame-options: DENY

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=connatix&cspid=25&append=0&cb=%24%7BADELPHIC_CACHE_BUSTER%7D&redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D29%26ev%3D660e6b66996a4...
https://cks.connatix.com/cks?pid=29&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Adelphic&api-tier=1&uid=31b7a3b9-e544-4ba9-a78c-96fec3de5650

146 B
254 B

41ms
40ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=29&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Adelphic&api-tier=1&uid=31b7a3b9-e544-4ba9-a78c-96fec3de5650
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5682efab4c6662e3ffcfcea530a81f97599b41fa107bd535500ec9238f2b7703

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8c59f628bc6cab9a-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

X-CI-RTID: ebd3536b-e12d-46d2-bae3-73650f9cfbe0
Location: https://cks.connatix.com/cks?pid=29&ev=660e6b66996a490e85b1a7c15e2b4b7f&pname=Adelphic&api-tier=1&uid=31b7a3b9-e544-4ba9-a78c-96fec3de5650
Content-Length: 177
Date: Thu, 19 Sep 2024 13:35:53 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET cm
us-u.openx.net/w/1.0/ Frame 3E34 0
0

GET cksync
cs.media.net/ Frame 3E34 0
0

GET 712202.gif
id.rlcdn.com/ Frame 3E34 0
0

GET
H3

200

report
capi.connatix.com/us/google/ Frame 3E34
Redirect Chain

https://capi.connatix.com/us/google/pixel?tier=1&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=connatix&google_hm=NjYwZTZiNjY5OTZhNDkwZTg1YjFhN2MxNWUyYjRiN2Y&extra1=660e6b66996a490e85b1a7c15e2b4b7f&gdpr=0&google_redir=https%3a%2f%2fcapi.connatix....
https://capi.connatix.com/us/google/report?extra1=660e6b66996a490e85b1a7c15e2b4b7f&gdpr=0

82 B
82 B

97ms
96ms

Image
image/gif

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/google/report?extra1=660e6b66996a490e85b1a7c15e2b4b7f&gdpr=0
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

surrogate-control: no-cache, no-store, must-revalidate, max-age=0
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 8c59f605fb05a21c-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 95
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

cache-control: no-cache, must-revalidate
location: https://capi.connatix.com/us/google/report?extra1=660e6b66996a490e85b1a7c15e2b4b7f&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 290
date: Thu, 19 Sep 2024 13:35:48 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 45ms
44ms Fetch
text/plain 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 674e0580ec30c0c08da895d8e7a84f103b99d51091b012e9839c2e5db29b005c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Thu, 19 Sep 2024 13:35:46 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

POST
H/1.1 200
OK post Show response
tag.escalated.io/ 31 B
445 B 413ms
59ms Fetch
application/json 3.131.10.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.escalated.io/post

Requested by

Host: tag.escalated.io
URL: https://tag.escalated.io/?i=KxxajmhPPCsT&d=www.bleepingcomputer.com&type=display&cust=5971&sid=direct&c=&cust2=direct

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

3.131.10.225 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

64502a4e175debf859635c4bc5ac52181bb3bf8d436a9146397e47cb675ffd20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

Cache-Control: no-store
Connection: keep-alive
X-Content-Type-Options: nosniff
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Content-Length: 31
Date: Thu, 19 Sep 2024 13:35:47 GMT
X-XSS-Protection: 1; mode=block
Content-Type: application/json; charset=utf-8
Server: nginx
Access-Control-Allow-Headers: X-Forwarded-For, X-Requested-With, Content-Type

OPTIONS page_load
pb-ing.ccgateway.net/v1.0/parent/4d97a662ad/engagement/trigger/ Frame 0
0

GET
H2 200 hadronid Show response
id.hadron.ad.gt/api/v1/ 54 KB
55 KB 348ms
46ms Script
text/plain 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/hadronid?_it=prebid&partner_id=474&_it=prebid
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1bf5435c55a81e3f050dc22ed008eb354bcecd1c042316e81a95a488a6c0ae43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: DYNAMIC
debug: NON-OPTIONS
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
access-control-allow-credentials: true
cf-ray: 8c59f61f4c923a09-YYZ
access-control-allow-origin: *
content-length: 55794
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: Content-Type; text/javascript; charset=UTF-8
server: cloudflare
access-control-allow-headers: authorization,content-type

GET
H3 200 wrap.js Show response
cdn.confiant-integrations.net/gptprebidnative/202407090940/ 284 KB
101 KB 164ms
150ms Script
application/javascript 104.18.43.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.confiant-integrations.net/gptprebidnative/202407090940/wrap.js
Requested by: Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/config.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.43.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d3ec73884fd2e63fb637af556b4725f116702bab37326dbf7ce0e876d7b1587

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "76074361c87e7c8d3af88302818b71f9"
age: 6208593
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:47 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 09 Jul 2024 14:20:21 GMT
vary: Accept-Encoding
x-amz-id-2: R2MXS85vOK0COPVd6dgcyWsEtEVuHv/mslcjrD+If4HBhOmfzoNEuRpXq+n9OH46pIJkDrvb+HR5g4IPwwBFBw==
cache-control: public, max-age=31536000
x-amz-request-id: RA0XGCNJ7H1V70PD
cf-ray: 8c59f5ff88b85401-YYZ
accept-ranges: bytes
content-length: 103346
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 138 B
288 B 43ms
42ms XHR
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=freestar&partner_id=474&sync=0&domain=www.bleepingcomputer.com&url=https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&ref=&_it=freestar&partner_id=474&ha=_hadron
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee98a89ac06c466e939c0998035d790935c174679393dc22247193c344dff284

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
debug: NON-OPTIONS
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
access-control-allow-credentials: true
cf-ray: 8c59f6018b7caafd-YYZ
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:35:47 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

GET
H2 200 0ab198dd-b265-462a-ae36-74e163ad6159 Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 1291ms
46ms Script
application/javascript 108.138.106.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/0ab198dd-b265-462a-ae36-74e163ad6159
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-108.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: ee5ebc2e5e093ee9ea3485ae13632e54bba29b488b7956923112de35efe7ded4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=3600
age: 1984
via: 1.1 836a4a85ed2221f76e2beedeab244eba.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: O93QFM-UotJEvP-4EKvf9HJ6HAX_kC81pgzDBZ1-44Lqf5P2dU73MQ==
date: Thu, 19 Sep 2024 13:02:49 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 3 KB
3 KB 40ms
38ms XHR
application/json 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com&pubid=0ab198dd-b265-462a-ae36-74e163ad6159
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 3cc3e7477f9c8eef291c048ee6e8e4e15d57a4b95c315089e072ef1dd190fb2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 9678
access-control-allow-credentials: true
via: 1.1 ed8dbde89917eaa6ca93ba7fad809c48.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Hit from cloudfront
content-length: 2865
x-amz-cf-id: ZF1zejtTRoMNgZx8KahXa8vkWjwMMh2jXGwc8J-V6sNocdibeCyqmg==
date: Thu, 19 Sep 2024 10:54:28 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
382 B 982ms
86ms XHR
text/javascript 108.138.127.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&pid=g07fFMuw0bIKa&cb=0&ws=1600x1200&v=24.827.1552&t=622&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_728x90_320x50_InContent_1%22%2C%22s%22%3A%5B%22728x90%22%2C%22554x312%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_1%22%2C%22s%22%3A%5B%22300x250%22%2C%22120x600%22%2C%22160x600%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_2%22%2C%22s%22%3A%5B%22300x250%22%2C%22120x600%22%2C%22160x600%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_3%22%2C%22s%22%3A%5B%22300x250%22%2C%22120x600%22%2C%22160x600%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%2C%22554x312%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&schain=1.0%2C1%21freestar.com%2C412%2C1%2C%2C%2C&sm=fc91bf5c-a056-450e-b640-b2088058b887&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.127.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-127-64.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 bd83fc15ab125846f839dd3c1ad21462.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 43
x-amz-cf-id: TGi0ZNxpIpZ5lDn-0kZ6WRot1isvaaRBr-MhpLsl8Swh0MNLnMSdwA==
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: JFK50-P4
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 843 B
894 B 1090ms
296ms XHR
text/javascript 108.138.127.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&pid=g07fFMuw0bIKa&cb=1&ws=1600x1200&v=24.827.1552&t=622&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22s%22%3A%5B%221x1%22%2C%22300x50%22%2C%22320x50%22%2C%22468x60%22%2C%22728x90%22%2C%22970x90%22%2C%22300x100%22%2C%22320x100%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&schain=1.0%2C1%21freestar.com%2C412%2C1%2C%2C%2C&sm=fc91bf5c-a056-450e-b640-b2088058b887&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.127.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-127-64.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 47f9154857e3b0fdd934cce641c49a6ddb14ebe3ae1f7678a9152259cf60e99c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 bd83fc15ab125846f839dd3c1ad21462.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 554
x-amz-cf-id: yA7wPPK_j54x6GwHH-4cMx_QKxObQGZAs-t9aqH4HuZRDttK8N0X1g==
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: JFK50-P4
server: Server

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 550ms
193ms XHR
application/javascript 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
age: 75835
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: _IxkgXlelghMpqSIIcAbCgSfUCivjPfOtzOfPL8oLrwSWrvSNnj3Kw==
date: Wed, 18 Sep 2024 16:31:53 GMT
content-type: application/javascript
vary: Accept-Encoding,Origin
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 410372c9ac35ccad4a4fd5dbf80c9f38.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
296 B 982ms
128ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

8a493bf2a5e2bcd6ebd2c6a4005e81e6f1d85a9510bf1632466514f79e9a99d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:47 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
295 B 1112ms
124ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

4f7db1214904712cec872e10f74b8a4dd35e639f3fdb328e26c3494e9e9965fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:47 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 841 B
898 B 1091ms
387ms XHR
text/javascript 108.138.127.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&pid=g07fFMuw0bIKa&cb=2&ws=1600x1200&v=24.827.1552&t=622&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_728x90_300x250__320x100_320x50_dynamic1_slot%22%2C%22s%22%3A%5B%22468x60%22%2C%22728x90%22%2C%22300x250%22%2C%22336x280%22%2C%22554x312%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_728x90_300x250__320x100_320x50_dynamic%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&schain=1.0%2C1%21freestar.com%2C412%2C1%2C%2C%2C&sm=fc91bf5c-a056-450e-b640-b2088058b887&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.127.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-127-64.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: bac749da0d322dd00bd550eb5515af0917d079419ec9bf2721eac2e9317436b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 bd83fc15ab125846f839dd3c1ad21462.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 557
x-amz-cf-id: FdwZos9tTz-IBm1UGqBZHDNdCyjKSyD_E7OhPx7Xxac-3hivqRMxwA==
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: JFK50-P4
server: Server

GET topics_frame.html
ads.pubmatic.com/AdServer/js/topics/ Frame 9900 0
0

GET topics_frame.html
pa.openx.net/ Frame 8E01 0
0

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 339ms
46ms Preflight
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=freestar&partner_id=474&sync=0&domain=www.bleepingcomputer.com&url=https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 8c59f6013b42aafd-YYZ
content-length: 0
content-type: application/json
date: Thu, 19 Sep 2024 13:35:47 GMT
debug: OPTIONS block
expires: Fri, 19 Sep 2025 13:35:47 GMT
server: cloudflare

POST cookie_sync
s2s.t13.io/ 0
0

POST auction
s2s.t13.io/openrtb2/ 0
0

POST prebid
prebid.media.net/rtb/ 0
0

POST prebid
ib.adnxs.com/ut/v3/ 0
0

GET imp
g2.gumgum.com/hbid/ 0
0

POST auction
tlx.3lift.com/header/ 0
0

POST bidRequest
c2shb.pubgw.yahoo.com/ 0
0

POST translator
hbopenbid.pubmatic.com/ 0
0

POST openrtb
ex.ingage.tech/v1/ 0
0

POST hb-multi
hb.yellowblue.io/ 0
0

POST pbjs
htlb.casalemedia.com/openrtb/ 0
0

GET fastlane.json
fastlane.rubiconproject.com/a/api/ 0
0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 4 KB
457 B 954ms
940ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2992154380907323&correlator=3531351860762978&eid=31086815&output=ldjh&gdfp_req=1&vrg=202409160104&ptt=17&impl=fifs&iu_parts=15184186%3A1006593%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_300x250_300x600_160x600_Right_3%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=320x50%7C728x90%7C554x312%2C300x250%7C120x600%7C160x600%7C300x600%2C300x250%7C120x600%7C160x600%7C300x600%2C300x250%7C120x600%7C160x600%7C300x600%2C320x50%7C728x90%7C970x90%7C970x250%7C554x312&fluid=height%2C0%2C0%2C0%2Cheight&ifi=3&didk=1410863669~1679461619~1679461618~1679461617~2757140747&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1726752948207&lmt=1726267479&adxs=268%2C1082%2C1082%2C1082%2C436&adys=4730%2C782%2C2474%2C3684%2C6234&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1%7C0%7C2%7C3%7C4&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&vis=1&psz=834x90%7C306x600%7C306x600%7C306x600%7C1200x250&msz=834x90%7C306x600%7C306x600%7C306x600%7C1170x250&fws=4%2C4%2C4%2C516%2C4&ohw=834%2C306%2C306%2C306%2C1170&td=1&egid=28368&tan=158e1374-5708-45eb-a51b-13271901dcf4%2C158e1374-5708-45eb-a51b-13271901dcf5%2C158e1374-5708-45eb-a51b-13271901dcf6%2C158e1374-5708-45eb-a51b-13271901dcf7%2C158e1374-5708-45eb-a51b-13271901dcf8&tdf=2&topics=9&tps=9&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDA5ODZlY2ExLTFlYWEtNDA5OC1iMzY4LTk4MzNmMGM5ZWZmMlgBEmUKCXlhaG9vLmNvbRJWTzlxY1VQZkl1TVF5bU5pYjRiZG9yVXczeGo3OGRoVWliTVBLcWxkV3V6Z3Nqa0RCNHQ0NVBoMmZ6VW42YlpIWkNPcmRENUIxc2VVV0wxWWY3OGNtNXdYAQ..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1726752938400&idt=5906&prev_scp=fsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3D1c896b22-8240-4ae5-900c-64ddc729df02%26floors_id%3D133d59%26floors_hour%3D13%26fs_placementName%3Dbleepingcomputer_728x90_320x50_InContent_1%26fs_ad_product%3Dbanner%26amznbid%3D1%26amznp%3D1%26fs-auuid%3Db627fe12-e584-47e4-912d-e5efff440dcf%26fsbid%3Dtimeout%7Cfsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3D426e1f11-ef40-401a-86e2-f0a7776b7925%26floors_id%3D20cc62%26floors_hour%3D13%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_1%26fs_ad_product%3Dbanner%26amznbid%3D1%26amznp%3D1%26fs-auuid%3Db627fe12-e584-47e4-912d-e5efff440dcf%26fsbid%3Dtimeout%7Cfsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3D6f3aa4bd-410a-4749-9a37-010e49d4f41c%26floors_id%3D51ac03%26floors_hour%3D13%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_2%26fs_ad_product%3Dbanner%26amznbid%3D1%26amznp%3D1%26fs-auuid%3Db627fe12-e584-47e4-912d-e5efff440dcf%26fsbid%3Dtimeout%7Cfsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3D8041b3d7-9bde-4fb2-b557-cdecd22ec8e6%26floors_id%3D88f340%26floors_hour%3D13%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_3%26fs_ad_product%3Dbanner%26amznbid%3D1%26amznp%3D1%26fs-auuid%3Db627fe12-e584-47e4-912d-e5efff440dcf%26fsbid%3Dtimeout%7Cfsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3Df5b0f11b-b654-400b-9ca6-38979d002489%26floors_id%3De2b310%26floors_hour%3D13%26fs_placementName%3Dbleepingcomputer_728x90_970x90_970x250_320x50_BTF%26fs_ad_product%3Dbanner%26amznbid%3D1%26amznp%3D1%26fs-auuid%3Db627fe12-e584-47e4-912d-e5efff440dcf%26fsbid%3Dtimeout&cust_params=fsitf%3DY-NYY-YYYY-YYYYY------------------------%26fs_liveintent%3DY%26fs_session_id%3D1ca33be5-1b63-4234-b9d8-28c9235e9af3%26fs_pageview_id%3D7dfbc652479c15462af601e06e48be60%26user-agent%3DChrome%26fs_iiq_enabled%3Dtrue%26section%3Dnews%252Csecurity%26floors_user%3D1%26floors_rtt%3D19%26fs_testgroup%3Doptimised&adks=3006093167%2C1994841743%2C1512476352%2C3569010014%2C4003487347&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

45a8fef330cf0d3e216c83abe80bc0def44584c276357ce28b217431754cf41e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2,-2,-2,-2,-2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2,-2,-2,-2,-2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2,-2,-2,-2,-2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 427
x-xss-protection: 0
server: cafe

GET container.html
7a6ca953a7993755c4024080786e3253.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FAE4 0
0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 806 B
383 B 585ms
571ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3d27db0f7711901d4e969f5941e21bee21bfb27ea780557abce74340d4b02295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 353
x-xss-protection: 0
server: cafe

GET
H3 200 player.lit.ui.js Show response
cds.connatix.com/p/529897/ 172 KB
36 KB 76ms
76ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/529897/player.lit.ui.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/529897/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 23df0276fbd15fc73deb21ba8f509e71f9d9f34286de5fae22421956e979daf0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "4ab04b0eaa905ca38e3a1465b345e6ac"
x-amz-version-id: ron8YS2TivbChYy_GNUU3lnPntN2e3fT
access-control-allow-methods: *
expires: Fri, 19 Sep 2025 13:35:48 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: text/javascript
last-modified: Thu, 19 Sep 2024 08:14:58 GMT
x-amz-expiration: expiry-date="Tue, 08 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8c59f6085aa1ab9a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 36721
server: cloudflare

GET ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 3E34 0
0

GET 81549
i.liadm.com/s/ Frame 3E34 0
0

GET
H3 200 / Show response
optimise.net/ 7 KB
7 KB 65ms
62ms Fetch
application/json 34.111.152.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://optimise.net/?k=1&d=bleepingcomputer.com&t=desktop&c=CA&r=1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.152.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

b196c5bcf7986cfbc59123846f5f29032c3e6af163f17f1f604c58b3ad64bd78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-api-key: 4e799501-b8b6-4ef1-bad5-225b3dd1aa8d
x-lm: 0

Response headers

access-control-max-age: 3600
access-control-expose-headers: fs-client-rtt,fs-country
age: 3
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
expires: 0
fs-client-rtt: 25
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:45 GMT
content-type: application/json
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm
strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 7296
fs-country: CA

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 1427ms
34ms Image
image/gif 23.200.0.203
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=b627fe12-e584-47e4-912d-e5efff440dcf&cid=8CUJ8GUQF&crid=315461417|315461417|315461417|315461417|315461417&adunit_count=5&dn=www.bleepingcomputer.com&requrl=https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/&istop=true&event=client_timeout&value=5&rd=622
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.0.203 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-0-203.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 19 Sep 2024 13:35:54 GMT
Access-Control-Allow-Origin: *
Content-Length: 35
Date: Thu, 19 Sep 2024 13:35:54 GMT
Content-Type: image/gif

GET
H2 200 474 Show response
a.ad.gt/api/v1/u/matches/ 13 KB
4 KB 384ms
31ms Script
application/javascript 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/474?_it=freestar
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&ref=&_it=freestar&partner_id=474&ha=_hadron
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61114713a02e21f68b203212dc5c5234db262a6dd5985c04aefd5cbc2fac45e6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 73
cross-origin-resource-policy: cross-origin
cf-ray: 8c59f62afb60ab84-YYZ
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 13:34:41 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 1536ms
41ms Script
application/javascript 23.203.179.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.203.179.38 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-179-38.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 19 Sep 2024 13:50:55 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 19 Sep 2024 13:35:55 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 48ms
42ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 9416
via: 1.1 dd80355363eac92e0372107558e579a8.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: jxQ7diIY1zSvdl6n3pJhK7bFQ-4f-FM3DjPyuHNQAAMrUxTCCdb8JQ==
date: Thu, 19 Sep 2024 10:58:58 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 16 KB
6 KB 3454ms
54ms Script
application/javascript 104.18.35.167
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.35.167 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 712369aef7db8ee613780ed94892762890345add2113c7749b2f03b819c0a4fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66ce363e-403e"
age: 147159
cf-ray: 8c59f63e6d9e39d8-YYZ
expires: Sun, 22 Sep 2024 13:35:57 GMT
date: Thu, 19 Sep 2024 13:35:57 GMT
content-type: application/javascript
last-modified: Tue, 27 Aug 2024 20:25:34 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 98 KB
29 KB 3513ms
57ms Script
text/javascript 172.67.38.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.38.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

827eba33ff7f627627e79285ae329f7269998b7ca965f96f2c1ee59ce7116406

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-id-2: OMyh/4R5riwZgtQdTawna9iOsXwu2U8Id7T4V0CvKQZWPEZH6xyZwSU3KObS+4u8r+AYy9q/M2vtSS8OtECbxzozxzt5QtV0
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"6f43174cf2798dcd024756859322fc73"
age: 2483
x-amz-request-id: T9K1F4FNTF865FM9
cf-ray: 8c59f640ddcf39de-YYZ
date: Thu, 19 Sep 2024 13:35:57 GMT
content-type: text/javascript;charset=utf-8
last-modified: Mon, 16 Sep 2024 11:24:35 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 54ms
46ms Fetch
text/plain 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 674e0580ec30c0c08da895d8e7a84f103b99d51091b012e9839c2e5db29b005c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Thu, 19 Sep 2024 13:35:48 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

OPTIONS bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0

OPTIONS
H2 204 openrtb
ex.ingage.tech/v1/ Frame 0
0 814ms
55ms Preflight 104.18.41.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ex.ingage.tech/v1/openrtb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.106 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-ray: 8c59f60ceb10ac09-YYZ
date: Thu, 19 Sep 2024 13:35:49 GMT
server: cloudflare
vary: Origin, Access-Control-Request-Headers

OPTIONS
H2 200 /
optimise.net/ Frame 0
0 87ms
35ms Preflight 34.111.152.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://optimise.net/?k=1&d=bleepingcomputer.com&t=desktop&c=CA&r=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.152.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: x-api-key,x-lm
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-expose-headers: fs-client-rtt,fs-country
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
date: Thu, 19 Sep 2024 13:35:48 GMT
expires: 0
fs-client-rtt: 20
fs-country: CA
pragma: no-cache
strict-transport-security: max-age=31536000
via: 1.1 google

POST auction
s2s.t13.io/openrtb2/ 0
0

POST prebid
prebid.media.net/rtb/ 0
0

POST translator
hbopenbid.pubmatic.com/ 0
0

POST hb-multi
hb.yellowblue.io/ 0
0

POST bidRequest
c2shb.pubgw.yahoo.com/ 0
0

POST prebid
ib.adnxs.com/ut/v3/ 0
0

POST auction
tlx.3lift.com/header/ 0
0

POST pbjs
htlb.casalemedia.com/openrtb/ 0
0

GET fastlane.json
fastlane.rubiconproject.com/a/api/ 0
0

POST openrtb
ex.ingage.tech/v1/ 0
0

GET rules-p-UeXruRVtZz7w6.js
rules.quantcount.com/ 0
0

GET
H2

400

websiteconfig Show response
btloader.com/
Redirect Chain

https://btloader.com/websiteconfig?bt_env=prod&o=5714937848528896&w=
https://btloader.com/websiteconfig?bt_env=prod&o=5714937848528896

30 B
161 B

162ms
151ms

Fetch
text/plain

172.67.41.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://btloader.com/websiteconfig?bt_env=prod&o=5714937848528896

Requested by

Host: blank
URL: about:blank

Protocol

Server

172.67.41.60 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

651388948a3444f5e74d15fefeb121fa16fea72c1b4d9e60beb4bee393cf2e3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: BYPASS
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 8c59f614c85636ae-YYZ
access-control-allow-origin: *
content-length: 30
date: Thu, 19 Sep 2024 13:35:50 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: public, max-age=3600, must-revalidate
location: /websiteconfig?bt_env=prod&o=5714937848528896
cf-cache-status: EXPIRED
via: 1.1 google
cf-ray: 8c59f60b7fd836ae-YYZ
access-control-allow-origin: *
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: text/html; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 px.gif
ad-delivery.net/ 43 B
907 B 1353ms
41ms Image
image/gif 104.26.2.70
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: blank
URL: about:blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.70 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 98226
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oPSXnG1fIAMeERXdSwaLjhFLu4rxgr64D%2F3fxPT2vSNgV3b3vEGdpQmB%2FMe8O%2FIbvFoX70%2BK8GAV07MXC4CAYijb70FapPERivJ0KnOtLvdP53Cen5HFsWVPqv1YP29UOg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Fri, 20 Sep 2024 13:35:55 GMT
x-goog-stored-content-length: 43
date: Thu, 19 Sep 2024 13:35:55 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: ABPtcPoO8lHTf149iQY1YWi3D4zx22EAtSAz_AcGCaHZE_ooDIimXVBuIG_p1OOO9HKPZxksl_S475t5TA
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c59f6351a27398a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif
ad-delivery.net/ 43 B
326 B 864ms
49ms Image
image/gif 104.26.2.70
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.9153707285696147
Requested by: Host: blank
URL: about:blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.70 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 98226
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YpgfhhWWVoAyKBrdJAEjo5vdDHrv%2BPgcuug6SdICbNUPxsOCiMk84VzaC0%2FSftciNqp3YlPHHr33t8t0R4riVlUqu4HZA0INB%2BRAOx7%2F8FfhuUIH9q2VimEyEJElffzVUA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Fri, 20 Sep 2024 13:35:55 GMT
x-goog-stored-content-length: 43
date: Thu, 19 Sep 2024 13:35:55 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: ABPtcPoO8lHTf149iQY1YWi3D4zx22EAtSAz_AcGCaHZE_ooDIimXVBuIG_p1OOO9HKPZxksl_S475t5TA
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8c59f6351a2a398a-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H2 200 882.json Show response
id5-sync.com/g/v2/ 632 B
1 KB 126ms
124ms Fetch
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/882.json

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

ed60a0533e3834db8d69b5cd9f74b081a71dc55e86900f2478197fe040895d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP="CAO PSA OUR"
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: application/json
vary: Origin

POST
H2 200 882.json Show response
id5-sync.com/g/v2/ 632 B
1 KB 133ms
130ms Fetch
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/882.json

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

1be95367fe0ba2a25256c238150e2d26bc242de7e9510c058868e216520f14cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP="CAO PSA OUR"
date: Thu, 19 Sep 2024 13:35:49 GMT
content-type: application/json
vary: Origin

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 35ms
34ms Image
image/gif 23.200.0.203
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=1e2c771d-3842-47a4-b801-7d0b24544c6b&cid=8CUJ8GUQF&crid=315461417&adunit_count=1&dn=www.bleepingcomputer.com&requrl=https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/&istop=true&event=client_timeout&value=1&rd=622
Requested by: Host: blank
URL: about:blank
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.0.203 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-0-203.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 19 Sep 2024 13:35:55 GMT
Access-Control-Allow-Origin: *
Content-Length: 35
Date: Thu, 19 Sep 2024 13:35:55 GMT
Content-Type: image/gif

POST auction
s2s.t13.io/openrtb2/ 0
0

POST prebid
prebid.media.net/rtb/ 0
0

POST hb-multi
hb.yellowblue.io/ 0
0

POST bidRequest
c2shb.pubgw.yahoo.com/ 0
0

POST auction
tlx.3lift.com/header/ 0
0

POST prebid
ib.adnxs.com/ut/v3/ 0
0

GET fastlane.json
fastlane.rubiconproject.com/a/api/ 0
0

POST openrtb
ex.ingage.tech/v1/ 0
0

POST pbjs
htlb.casalemedia.com/openrtb/ 0
0

POST translator
hbopenbid.pubmatic.com/ 0
0

POST
H2 200 error Show response
pixel.quantcount.com/tag/ 0
159 B 1130ms
98ms XHR
text/plain 192.184.68.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.quantcount.com/tag/error
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.184.68.228 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Thu, 19 Sep 2024 13:35:50 GMT
access-control-allow-headers: Accept, Accept-Language, Content-Type, Content-Language

GET
H2 200 pixel;r=1911709829;rf=1;a=p-UeXruRVtZz7w6;url=about%3Ablank;uht=2;fpan=1;fpa=P0-1260303962-1726752948934;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=bleepingcomputer.com;dst=1...
pixel.quantserve.com/ 35 B
456 B 72ms
69ms Image
image/gif 192.184.68.254
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1911709829;rf=1;a=p-UeXruRVtZz7w6;url=about%3Ablank;uht=2;fpan=1;fpa=P0-1260303962-1726752948934;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=bleepingcomputer.com;dst=1;et=1726752949783;tzo=420;ogl=;ses=91a2cf35-5f40-418f-91ca-dc35640e5d84;mdl=

Requested by

Host: blank
URL: about:blank

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.184.68.254 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=86400
cache-control: private, no-cache, no-store, proxy-revalidate
pragma: no-cache
expires: Fri, 04 Aug 1978 12:00:00 GMT
content-length: 35
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
date: Thu, 19 Sep 2024 13:35:55 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"filters":[],"trigger_data":"1"}]}
content-type: image/gif

POST auction_end
pb-ing.ccgateway.net/v1.0/parent/4d97a662ad/engagement/trigger/ 0
0

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 55ms
54ms Fetch
text/plain 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 674e0580ec30c0c08da895d8e7a84f103b99d51091b012e9839c2e5db29b005c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Thu, 19 Sep 2024 13:35:50 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 42ms
41ms Image
image/gif 23.200.0.203
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=209ca183-9427-46a0-9faf-c04ebeb1b1c0&cid=8CUJ8GUQF&crid=315461417&adunit_count=1&dn=www.bleepingcomputer.com&requrl=https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/&istop=true&event=client_timeout&value=1&rd=622
Requested by: Host: blank
URL: about:blank
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.0.203 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-0-203.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 19 Sep 2024 13:35:55 GMT
Access-Control-Allow-Origin: *
Content-Length: 35
Date: Thu, 19 Sep 2024 13:35:55 GMT
Content-Type: image/gif

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 446 B
196 B 277ms
251ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

112.128.160.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

9f8f24e8668d36ea11846467976fbe1e9b9817ce5407ab14b67698ea2a2fda31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:50 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 166
x-xss-protection: 0
server: cafe

OPTIONS auction_end
pb-ing.ccgateway.net/v1.0/parent/4d97a662ad/engagement/trigger/ Frame 0
0

GET
H2 200 floors Show response
api.floors.dev/sgw/v1/ 4 KB
4 KB 100ms
97ms Fetch
application/json 34.160.128.112
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.floors.dev/sgw/v1/floors?d=bleepingcomputer.com&t=desktop&k=1&r=1&c=CA

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.128.112 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

d839e15024b54dadc296f0a8d7839a40490841f4c1f2ac14c4d8801a6c163077

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-api-key: 4e799501-b8b6-4ef1-bad5-225b3dd1aa8d
x-lm: 0

Response headers

strict-transport-security: max-age=31536000
access-control-max-age: 3600
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
via: 1.1 google
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:52 GMT
cache-status: disabled
content-type: application/json
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm

OPTIONS bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0

OPTIONS
H2 200 floors
api.floors.dev/sgw/v1/ Frame 0
0 1849ms
796ms Preflight 34.160.128.112
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.floors.dev/sgw/v1/floors?d=bleepingcomputer.com&t=desktop&k=1&r=1&c=CA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.128.112 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

112.128.160.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: x-api-key,x-lm
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
cache-status: disabled
content-length: 0
date: Thu, 19 Sep 2024 13:35:52 GMT
expires: 0
pragma: no-cache
strict-transport-security: max-age=31536000
via: 1.1 google

OPTIONS bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 135ms
123ms Fetch
text/plain 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 674e0580ec30c0c08da895d8e7a84f103b99d51091b012e9839c2e5db29b005c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Thu, 19 Sep 2024 13:35:50 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 59ms
56ms Fetch
text/plain 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 674e0580ec30c0c08da895d8e7a84f103b99d51091b012e9839c2e5db29b005c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Thu, 19 Sep 2024 13:35:51 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
539 B 9252ms
120ms XHR
application/json 44.217.140.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17331/sync.min.js?gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.217.140.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-217-140-218.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 9a3c499fba4036cad75d36c85a172112d5b6c0a11d9a456cea842325b1e9979d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Thu, 19 Sep 2024 13:36:01 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.14.122
server: Jetty(9.4.38.v20210224)

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 48ms
46ms Fetch
text/plain 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 674e0580ec30c0c08da895d8e7a84f103b99d51091b012e9839c2e5db29b005c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Thu, 19 Sep 2024 13:35:51 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

OPTIONS
H2 200 rtd
id.hadron.ad.gt/api/v1/ Frame 0
0 45ms
44ms Preflight
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8c59f6222f13aafd-YYZ
content-length: 0
content-type: application/json
date: Thu, 19 Sep 2024 13:35:52 GMT
debug: rtd-nx-ny
server: cloudflare

OPTIONS
H2 200 rtd
id.hadron.ad.gt/api/v1/ Frame 0
0 42ms
41ms Preflight
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8c59f6224f30aafd-YYZ
content-length: 0
content-type: application/json
date: Thu, 19 Sep 2024 13:35:52 GMT
debug: rtd-nx-ny
server: cloudflare

OPTIONS
H2 200 rtd
id.hadron.ad.gt/api/v1/ Frame 0
0 47ms
47ms Preflight
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8c59f6225f37aafd-YYZ
content-length: 0
content-type: application/json
date: Thu, 19 Sep 2024 13:35:52 GMT
debug: rtd-nx-ny
server: cloudflare

POST
H2 200 rtd Show response
id.hadron.ad.gt/api/v1/ 27 B
85 B 46ms
44ms Fetch
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33c1ab6a01b4049878497c2874d8cbb72e14ee7cf14fafec3c09b45f9874b67e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

cf-cache-status: DYNAMIC
debug: rtd-nx-ny
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c59f6227f4eaafd-YYZ
access-control-allow-origin: *
content-length: 27
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: *

POST
H2 200 rtd Show response
id.hadron.ad.gt/api/v1/ 27 B
82 B 71ms
56ms Fetch
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33c1ab6a01b4049878497c2874d8cbb72e14ee7cf14fafec3c09b45f9874b67e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

cf-cache-status: DYNAMIC
debug: rtd-nx-ny
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c59f6229f64aafd-YYZ
access-control-allow-origin: *
content-length: 27
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: *

POST
H2 200 rtd Show response
id.hadron.ad.gt/api/v1/ 27 B
82 B 61ms
42ms Fetch
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33c1ab6a01b4049878497c2874d8cbb72e14ee7cf14fafec3c09b45f9874b67e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

cf-cache-status: DYNAMIC
debug: rtd-nx-ny
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c59f622cf98aafd-YYZ
access-control-allow-origin: *
content-length: 27
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: *

POST
H2 200 rtd Show response
id.hadron.ad.gt/api/v1/ 27 B
82 B 71ms
58ms Fetch
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33c1ab6a01b4049878497c2874d8cbb72e14ee7cf14fafec3c09b45f9874b67e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

cf-cache-status: DYNAMIC
debug: rtd-nx-ny
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c59f622cf97aafd-YYZ
access-control-allow-origin: *
content-length: 27
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: *

POST
H2 200 rtd Show response
id.hadron.ad.gt/api/v1/ 27 B
82 B 44ms
40ms Fetch
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33c1ab6a01b4049878497c2874d8cbb72e14ee7cf14fafec3c09b45f9874b67e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

cf-cache-status: DYNAMIC
debug: rtd-nx-ny
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c59f622cf99aafd-YYZ
access-control-allow-origin: *
content-length: 27
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: *

POST
H2 200 rtd Show response
id.hadron.ad.gt/api/v1/ 27 B
82 B 77ms
75ms Fetch
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33c1ab6a01b4049878497c2874d8cbb72e14ee7cf14fafec3c09b45f9874b67e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

cf-cache-status: DYNAMIC
debug: rtd-nx-ny
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c59f622efacaafd-YYZ
access-control-allow-origin: *
content-length: 27
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: *

POST
H2 200 rtd Show response
id.hadron.ad.gt/api/v1/ 27 B
82 B 66ms
61ms Fetch
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/rtd
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33c1ab6a01b4049878497c2874d8cbb72e14ee7cf14fafec3c09b45f9874b67e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

cf-cache-status: DYNAMIC
debug: rtd-nx-ny
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 8c59f622ffb3aafd-YYZ
access-control-allow-origin: *
content-length: 27
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: *

POST auction
s2s.t13.io/openrtb2/ 0
0

POST auction
tlx.3lift.com/header/ 0
0

POST bidRequest
c2shb.pubgw.yahoo.com/ 0
0

POST
H2 200 prebid
ib.adnxs.com/ut/v3/ 0
0 109ms
84ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 154.47.17.56; 154.47.17.56; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
an-x-request-uuid: bdd63506-194a-4ed7-8da5-f220c2766ebf
content-length: 145
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:35:52 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 204 translator
hbopenbid.pubmatic.com/ 0
0 106ms
81ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:52 GMT
access-control-allow-credentials: true

POST hb-multi
hb.yellowblue.io/ 0
0

POST pbjs
htlb.casalemedia.com/openrtb/ 0
0

POST
H2 200 prebid
prebid.media.net/rtb/ 0
0 105ms
82ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 3
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:35:52 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/json;charset=utf-8
server: envoy

GET
H2 200 fastlane.json
fastlane.rubiconproject.com/a/api/ 0
0 96ms
84ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=500600&zone_id=2983354&size_id=2&alt_size_ids=1%2C19%2C43%2C44%2C55%2C117%2C221&rp_schain=1.0,1!freestar.com,412,1,,,&eid_yahoo.com=O9qcUPfIuMQymNib4bdorUw3xj78dhUibMPKqldWuzgsjkDB4t45Ph2fzUn6bZHZCOrdD5B1seUWL1Yf78cm5w%5E3&eid_criteo.com=BvtYTV9ZJTJGViUyRlRYSW12SnZwQlVIelFNdXNYRWZrSjlXTzVEaTlpYSUyQkczak50TWZONWJibXZoc3dDc2VQUm9BRm1mUld1V25YVXcwcHJXMDNkU3c1YkY3cnpKTmJmeHN4amJVYWgxelJBWFh5aUVKUSUzRA%5E1&eid_audigent.com=0001yum0eal66iaeaaaf9f79jieca9kiib69gblgkiabackkc2jl%5E1&eid_id5-sync.com=ID5*05HXXUt7s_5IZ1xOiEU7dLLp4kZ_JnoLKcrykN9GZXLGTK_spefem4bDYgb6IdXY%5E1%5E2&tpid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_pubcid.org=0986eca1-1eaa-4098-b368-9833f0c9eff2%5E1&tpid_tdid=bc8b0835-1393-4f63-9270-2da844e8deab&eid_adserver.org=bc8b0835-1393-4f63-9270-2da844e8deab&rf=about%3Ablank&tg_v.id=0d2426b2-0065-48d3-9360-a53d168936a0&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-25&tg_i.sectioncat=IAB19-25&tg_i.pagecat=IAB19-25&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=535&tg_i.fs_ad_product=stickyFooter&tg_i.pbadslot=%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%2Fbleepingcomputer_970x90_728x90_320x50_sticky&tk_flint=pbjs_lite_v8.49.8&x_source.tid=9e67e39a-a80b-40b9-84eb-6bf9f9f3d503&l_pb_bid_id=2826f369fc3cc286&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=fca43ffe-be0e-40ae-b8a0-0a7eebc8528e&rp_maxbids=1&p_gpid=%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%2Fbleepingcomputer_970x90_728x90_320x50_sticky&m_ch_mobile=%3F0&slots=1&rand=0.09200245618031211
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST openrtb
ex.ingage.tech/v1/ 0
0

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 75ms
73ms Fetch
text/plain 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 674e0580ec30c0c08da895d8e7a84f103b99d51091b012e9839c2e5db29b005c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Thu, 19 Sep 2024 13:35:52 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 435 B
191 B 503ms
502ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

48c371b50d16257535224e39fa7e24daf19bee3a7c8cd7d014c836cf7a1558fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 161
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 436 B
187 B 458ms
453ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d22504c337c5e5d815922dac829a916f8ca3f3bf8e76cd7790bc50ed39e2d3ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 158
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 440 B
192 B 593ms
587ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8df5336eb07a097c0454f553c467db6d01c627c4779292da1119d0c1ad62def6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 162
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 443 B
192 B 455ms
448ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2df091bc964f1304f74f7d02c4ea35c589affced36575078e8b2de01b394091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 163
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 440 B
191 B 786ms
772ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0e9f6a1794eb6ffdc3753e9b24cf41c77b50c91821b5b4da1ebb9c84cd3e38d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 161
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 440 B
191 B 689ms
675ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad64b4fb67e37febde93abab1727fe57ff021461d933f7a4324592775610cdd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 161
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 35ms
34ms Image
image/gif 23.200.0.203
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=9e67e39a-a80b-40b9-84eb-6bf9f9f3d503&cid=8CUJ8GUQF&crid=315461417&adunit_count=1&dn=www.bleepingcomputer.com&requrl=https://www.bleepingcomputer.com/news/security/malware-locks-browser-in-kiosk-mode-to-steal-google-credentials/&istop=true&event=client_timeout&value=1&rd=622
Requested by: Host: blank
URL: about:blank
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.0.203 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-0-203.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 19 Sep 2024 13:35:55 GMT
Access-Control-Allow-Origin: *
Content-Length: 35
Date: Thu, 19 Sep 2024 13:35:55 GMT
Content-Type: image/gif

POST
H2 200 auction Show response
s2s.t13.io/openrtb2/ 6 KB
2 KB 259ms
224ms Fetch
application/json 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s2s.t13.io/openrtb2/auction

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

0067811c92066b0cd35e2e0177de7acc358b88486406e1160f579dc3661e9cc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2299
date: Thu, 19 Sep 2024 13:35:53 GMT
x-prebid: pbs-java/2.15.0
content-type: application/json

POST
H2 200 openrtb Show response
ex.ingage.tech/v1/ 2 KB
899 B 124ms
90ms Fetch
application/json 104.18.41.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ex.ingage.tech/v1/openrtb
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.106 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 259e6141ae8281568d8a7d2bdf0ba25dbb6022044b5da07e2cfe41da308c906e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f6280c6bac03-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 146ms
113ms Fetch
application/json 3.222.148.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.49.8&referrer=about%3Ablank&tmax=622

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.222.148.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 38 B
637 B 216ms
185ms Fetch
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=393562
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa326a729a213ec85de0b40867e75ba204b16a7449009da14b6e253813673227

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FYrKBspg5kGQQCDfAMs3RaR7p%2FAxwCE9YImFAjLLftdh6BVgE9BYcoTdRNb%2FQuF%2BuYD7Zne0XXn7QuCclIQi4xcUlL57m1EhZNFuVfx7hg0ZenCREwCgMmjEaFSvc4iq7b%2Fs2vKX"}],"group":"cf-nel","max_age":604800}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8c59f627fe68abac-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 38
server: cloudflare

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
64 B 64ms
31ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:53 GMT
access-control-allow-credentials: true

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
636 B 229ms
197ms Fetch
application/json 52.85.61.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-91.ewr53.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 6079032a34fc3bb4307c908d23d3874664c3eb96f4d2abaa8a55849baa382138

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 126
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 17da55c14108bb8cae904f764f67c0e0.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: 9iWqCK4-9jqr6dgpySMB1WYEFhDso1xDjuLgs-wA-5a5mTykfrDjUw==
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
x-amz-cf-pop: EWR53-P1
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 56 B
228 B 96ms
59ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 324c63e1f671c42393f71e3ca0d790c0551eef8cbd618624b3b1fb1df7cef126

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 3
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:35:53 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 111ms
85ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

12a73c3d400a9f3cca5c54ba668bd79cdc6fa95168e6a412505441f6851b77b4

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 154.47.17.56; 154.47.17.56; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
an-x-request-uuid: f5bc7650-d3b9-45bc-8de2-dd6cb6447a22
content-length: 145
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:35:53 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 725 B
759 B 72ms
51ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=500600&zone_id=2983354&size_id=2&rp_schain=1.0,1!freestar.com,412,1,,,&eid_yahoo.com=O9qcUPfIuMQymNib4bdorUw3xj78dhUibMPKqldWuzgsjkDB4t45Ph2fzUn6bZHZCOrdD5B1seUWL1Yf78cm5w%5E3&eid_criteo.com=BvtYTV9ZJTJGViUyRlRYSW12SnZwQlVIelFNdXNYRWZrSjlXTzVEaTlpYSUyQkczak50TWZONWJibXZoc3dDc2VQUm9BRm1mUld1V25YVXcwcHJXMDNkU3c1YkY3cnpKTmJmeHN4amJVYWgxelJBWFh5aUVKUSUzRA%5E1&eid_audigent.com=0001yum0eal66iaeaaaf9f79jieca9kiib69gblgkiabackkc2jl%5E1&eid_id5-sync.com=ID5*05HXXUt7s_5IZ1xOiEU7dLLp4kZ_JnoLKcrykN9GZXLGTK_spefem4bDYgb6IdXY%5E1%5E2&tpid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_pubcid.org=0986eca1-1eaa-4098-b368-9833f0c9eff2%5E1&tpid_tdid=bc8b0835-1393-4f63-9270-2da844e8deab&eid_adserver.org=bc8b0835-1393-4f63-9270-2da844e8deab&rf=about%3Ablank&tg_v.id=0d2426b2-0065-48d3-9360-a53d168936a0&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-25&tg_i.sectioncat=IAB19-25&tg_i.pagecat=IAB19-25&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=535&tg_i.fs_ad_product=banner&tg_i.pbadslot=%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%2Fbleepingcomputer_728x90_320x50_InContent_1&tk_flint=pbjs_lite_v8.49.8&x_source.tid=d2b6cc8e-87e9-4111-9bc7-87a356f35137&l_pb_bid_id=3187c6f5febce1d7&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=e0a77af2-aeb9-4a08-8747-ddad0effb6a9&rp_maxbids=1&p_gpid=%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%2Fbleepingcomputer_728x90_320x50_InContent_1&m_ch_mobile=%3F0&slots=1&rand=0.5004456251618981
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: fcdd66efbeb3c2658c491d42252d0b54d67205278dc3b35da08202e26242f154

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 725
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 137ms
108ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

4d6af3a1417c69ce6db32b62baca8e6bdf714128ff4976dbd249cc8d09763887

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 auction Show response
s2s.t13.io/openrtb2/ 1 KB
416 B 169ms
147ms Fetch
application/json 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s2s.t13.io/openrtb2/auction

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

7e6b39027b698d3bbccb6ae1edbca164680a232ddb4fe56a3bf9558cf7951e4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 354
date: Thu, 19 Sep 2024 13:35:53 GMT
x-prebid: pbs-java/2.15.0
content-type: application/json

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
64 B 60ms
33ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:53 GMT
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 762 B
820 B 65ms
46ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=500600&zone_id=2983354&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!freestar.com,412,1,,,&eid_yahoo.com=O9qcUPfIuMQymNib4bdorUw3xj78dhUibMPKqldWuzgsjkDB4t45Ph2fzUn6bZHZCOrdD5B1seUWL1Yf78cm5w%5E3&eid_criteo.com=BvtYTV9ZJTJGViUyRlRYSW12SnZwQlVIelFNdXNYRWZrSjlXTzVEaTlpYSUyQkczak50TWZONWJibXZoc3dDc2VQUm9BRm1mUld1V25YVXcwcHJXMDNkU3c1YkY3cnpKTmJmeHN4amJVYWgxelJBWFh5aUVKUSUzRA%5E1&eid_audigent.com=0001yum0eal66iaeaaaf9f79jieca9kiib69gblgkiabackkc2jl%5E1&eid_id5-sync.com=ID5*05HXXUt7s_5IZ1xOiEU7dLLp4kZ_JnoLKcrykN9GZXLGTK_spefem4bDYgb6IdXY%5E1%5E2&tpid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_pubcid.org=0986eca1-1eaa-4098-b368-9833f0c9eff2%5E1&tpid_tdid=bc8b0835-1393-4f63-9270-2da844e8deab&eid_adserver.org=bc8b0835-1393-4f63-9270-2da844e8deab&rf=about%3Ablank&tg_v.id=0d2426b2-0065-48d3-9360-a53d168936a0&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-25&tg_i.sectioncat=IAB19-25&tg_i.pagecat=IAB19-25&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=535&tg_i.fs_ad_product=banner&tg_i.pbadslot=%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%2Fbleepingcomputer_300x250_300x600_160x600_Right_1&tk_flint=pbjs_lite_v8.49.8&x_source.tid=6651099b-ba65-4da2-bad8-3f61f9c957c3&l_pb_bid_id=338995347bffa88b&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=a7269385-2b77-4cd8-b26e-b2d91bcfc948&rp_maxbids=1&p_gpid=%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%2Fbleepingcomputer_300x250_300x600_160x600_Right_1&m_ch_mobile=%3F0&slots=1&rand=0.5857055903885506
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 245aa16215b3d12fe00d7fe2eadbbaece445b471b108bdb16401e1816fecf40a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 762
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 6 KB
3 KB 221ms
202ms Fetch
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=393562
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a32df83a352b59d8d913d60ffdc673406a00386435ceaaabbcba84c50d8b5ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PNnOC4Qv9yvcmIGhYRGGkvh7mymK16DosPn%2FO9rkSSFyQ0DQUTe3EEiM8uxs8y0JmkQMF%2FnKl2FDj5L6%2BF71NDKs1HFYpxP%2FqLKuZzapsF9zeDr0Qm1hsuqiBHyxtdVVAiSYM6Fg"}],"group":"cf-nel","max_age":604800}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8c59f6280e6eabac-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 2777
server: cloudflare

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 168ms
141ms Fetch
application/json 3.222.148.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.49.8&referrer=about%3Ablank&tmax=622

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.222.148.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
x-auction-status: 29, 29, 29
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 56 B
207 B 145ms
118ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 324c63e1f671c42393f71e3ca0d790c0551eef8cbd618624b3b1fb1df7cef126

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 5
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:35:53 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 139 B
1 KB 369ms
347ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

d5cfef5ef879f7462b1bc42b4141c3d762e24578c1dc5327113e10bf446534ab

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 154.47.17.56; 154.47.17.56; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
an-x-request-uuid: 9bc2dfc3-5a62-4cf4-a691-e0b87baa71a7
content-length: 139
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:35:53 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
636 B 322ms
302ms Fetch
application/json 52.85.61.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-91.ewr53.r.cloudfront.net
Software: istio-envoy /
Resource Hash: f410b49132f202d22286d5539d87d550fbbd674e3463eaab28368a78de04e272

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 235
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 17da55c14108bb8cae904f764f67c0e0.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: wBq599LWIiteQAiabSBb5nl8eH5rBjBy84KWLHVauLViR_6qoNme6Q==
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
x-amz-cf-pop: EWR53-P1
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 141ms
117ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a4c98f9e18a307396b770355dfda6afb7cedc6fbb757b8a2eae3d8fe4a0e2538

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 142ms
118ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0763ee5900979bc51a5fc48b08901974a4cab27cf54d5d1e882f6bb763da6275

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 129ms
106ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

9754983fb392b18c37ac4718abbdff1fcff864ae54fe07f3d6c04041d0322b1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 openrtb Show response
ex.ingage.tech/v1/ 2 KB
875 B 194ms
171ms Fetch
application/json 104.18.41.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ex.ingage.tech/v1/openrtb
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.106 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1680f7aecf89041b400c8d2d56a7445eb903077bb03c351119ebbfd1bf2b4461

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f6281c85ac03-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

OPTIONS auction_end
pb-ing.ccgateway.net/v1.0/parent/4d97a662ad/engagement/trigger/ Frame 0
0

POST auction_end
pb-ing.ccgateway.net/v1.0/parent/4d97a662ad/engagement/trigger/ 0
0

POST
H3 200 auction Show response
s2s.t13.io/openrtb2/ 1 KB
417 B 191ms
190ms Fetch
application/json 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s2s.t13.io/openrtb2/auction

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

ec44b66c1e7bcb79184a0edeceaa868b6be009acda10a3cf384936199f1caeec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 395
date: Thu, 19 Sep 2024 13:35:53 GMT
x-prebid: pbs-java/2.15.0
content-type: application/json

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
636 B 54ms
43ms Fetch
application/json 52.85.61.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-91.ewr53.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 1a4a991f1f416a068a8c6f033bb67d93367811314cd34ce4bd6ded15aaf57634

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 17da55c14108bb8cae904f764f67c0e0.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: lAkRxfFxzIeHGX8CZCfqEfWICD1r4R2C97qNgjpQxh7oXhntkP3HdQ==
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
x-amz-cf-pop: EWR53-P1
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 762 B
796 B 62ms
55ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=500600&zone_id=2983354&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!freestar.com,412,1,,,&eid_yahoo.com=O9qcUPfIuMQymNib4bdorUw3xj78dhUibMPKqldWuzgsjkDB4t45Ph2fzUn6bZHZCOrdD5B1seUWL1Yf78cm5w%5E3&eid_criteo.com=BvtYTV9ZJTJGViUyRlRYSW12SnZwQlVIelFNdXNYRWZrSjlXTzVEaTlpYSUyQkczak50TWZONWJibXZoc3dDc2VQUm9BRm1mUld1V25YVXcwcHJXMDNkU3c1YkY3cnpKTmJmeHN4amJVYWgxelJBWFh5aUVKUSUzRA%5E1&eid_audigent.com=0001yum0eal66iaeaaaf9f79jieca9kiib69gblgkiabackkc2jl%5E1&eid_id5-sync.com=ID5*05HXXUt7s_5IZ1xOiEU7dLLp4kZ_JnoLKcrykN9GZXLGTK_spefem4bDYgb6IdXY%5E1%5E2&tpid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_pubcid.org=0986eca1-1eaa-4098-b368-9833f0c9eff2%5E1&tpid_tdid=bc8b0835-1393-4f63-9270-2da844e8deab&eid_adserver.org=bc8b0835-1393-4f63-9270-2da844e8deab&rf=about%3Ablank&tg_v.id=0d2426b2-0065-48d3-9360-a53d168936a0&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-25&tg_i.sectioncat=IAB19-25&tg_i.pagecat=IAB19-25&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=535&tg_i.fs_ad_product=banner&tg_i.pbadslot=%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%2Fbleepingcomputer_300x250_300x600_160x600_Right_2&tk_flint=pbjs_lite_v8.49.8&x_source.tid=4cfc6cae-2fce-431a-a2ca-4fb958e9c5bf&l_pb_bid_id=379c9fd98fd77a1b&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=4d3d417e-7692-446e-974a-8ff63624be8c&rp_maxbids=1&p_gpid=%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%2Fbleepingcomputer_300x250_300x600_160x600_Right_2&m_ch_mobile=%3F0&slots=1&rand=0.6075581292078112
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: a52d20b0d83f196bf9138f8fb259e645d6c231b53ecd7699a072d96f552dbb74

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 762
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST
H2 200 openrtb Show response
ex.ingage.tech/v1/ 2 KB
872 B 98ms
88ms Fetch
application/json 104.18.41.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ex.ingage.tech/v1/openrtb
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.106 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85ec946c0796cb02a72e12bd6a9b4178e39938cd2769d53fd672e7b315004bff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f6297e76ac03-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
634 B 175ms
168ms Fetch
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=393562
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14d2ff72771529c3d062b19bab3abe37dd3fb8830e453f5592092a6409acb32b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=haSEkxINHT61xJO8usY10PHy22Z9WfeesXVmdxm7bOTAmCBJvq4B7FWY8pFa4k7Vu08w2rD9nQbfJG1RUENCMY4txl%2B3ZOxGNbWM8HKczNN8XIHgr3MUeEhmnS%2FV3zVuc%2FEC9LYH"}],"group":"cf-nel","max_age":604800}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8c59f6297fbfabac-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 37
server: cloudflare

POST
H3 200 prebid Show response
prebid.media.net/rtb/ 56 B
93 B 127ms
119ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 324c63e1f671c42393f71e3ca0d790c0551eef8cbd618624b3b1fb1df7cef126

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 6
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:35:53 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 123ms
108ms Fetch
application/json 3.222.148.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.49.8&referrer=about%3Ablank&tmax=622

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.222.148.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
x-auction-status: 29, 29, 29
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
64 B 51ms
37ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:53 GMT
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 169ms
159ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

c69e47e532d2804bea4a11078896f89a9aec5ab65a1de13ea4f755ea8565f936

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 154.47.17.56; 154.47.17.56; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
an-x-request-uuid: f6a07870-b718-4504-b5c4-fc8640c4168b
content-length: 145
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:35:53 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 59ms
50ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

7fe515546216c323743f71ef37c636b95590b4367c24f89cb97751b2267147c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 65ms
56ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

cbc365ace808a90df979334a46bfbd9ad8b7d9867e001e69699231c7a0966cd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 158ms
150ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a22349db0e4eaef73c148bab59629601f0c6b94c55213e161cf002d614b63b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
539 B 7301ms
87ms XHR
application/json 44.217.140.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.217.140.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-217-140-218.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a6d4cb9a0aab64b437ebc30dd0616a1433d50abc6519427d9287824ec335015d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Thu, 19 Sep 2024 13:36:01 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.51.23
server: Jetty(9.4.38.v20210224)

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 54ms
52ms Fetch
text/plain 34.160.152.31
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/pubfig/5.111.0/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 674e0580ec30c0c08da895d8e7a84f103b99d51091b012e9839c2e5db29b005c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

POST
H3 200 auction Show response
s2s.t13.io/openrtb2/ 1 KB
372 B 203ms
196ms Fetch
application/json 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s2s.t13.io/openrtb2/auction

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

9386205f7e28b89d73376bfa985ed5c2c257f383bc9249001f65348ceedd7801

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 350
date: Thu, 19 Sep 2024 13:35:54 GMT
x-prebid: pbs-java/2.15.0
content-type: application/json

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 762 B
796 B 79ms
74ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=500600&zone_id=2983354&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!freestar.com,412,1,,,&eid_yahoo.com=O9qcUPfIuMQymNib4bdorUw3xj78dhUibMPKqldWuzgsjkDB4t45Ph2fzUn6bZHZCOrdD5B1seUWL1Yf78cm5w%5E3&eid_criteo.com=BvtYTV9ZJTJGViUyRlRYSW12SnZwQlVIelFNdXNYRWZrSjlXTzVEaTlpYSUyQkczak50TWZONWJibXZoc3dDc2VQUm9BRm1mUld1V25YVXcwcHJXMDNkU3c1YkY3cnpKTmJmeHN4amJVYWgxelJBWFh5aUVKUSUzRA%5E1&eid_audigent.com=0001yum0eal66iaeaaaf9f79jieca9kiib69gblgkiabackkc2jl%5E1&eid_id5-sync.com=ID5*05HXXUt7s_5IZ1xOiEU7dLLp4kZ_JnoLKcrykN9GZXLGTK_spefem4bDYgb6IdXY%5E1%5E2&tpid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_pubcid.org=0986eca1-1eaa-4098-b368-9833f0c9eff2%5E1&tpid_tdid=bc8b0835-1393-4f63-9270-2da844e8deab&eid_adserver.org=bc8b0835-1393-4f63-9270-2da844e8deab&rf=about%3Ablank&tg_v.id=0d2426b2-0065-48d3-9360-a53d168936a0&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-25&tg_i.sectioncat=IAB19-25&tg_i.pagecat=IAB19-25&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=535&tg_i.fs_ad_product=banner&tg_i.pbadslot=%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%2Fbleepingcomputer_300x250_300x600_160x600_Right_3&tk_flint=pbjs_lite_v8.49.8&x_source.tid=6f30afa0-e3aa-4e88-9925-541130776b1a&l_pb_bid_id=416ea3768f47285d&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=0010deae-4ef6-43e2-8e2e-808176907656&rp_maxbids=1&p_gpid=%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%2Fbleepingcomputer_300x250_300x600_160x600_Right_3&m_ch_mobile=%3F0&slots=1&rand=0.4289984640072755
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 0a9d0a88f1527d53cb25a280c4419ef9a4ab5d3bfc60348a2209a52b75523eda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 762
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
637 B 165ms
158ms Fetch
application/json 52.85.61.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-91.ewr53.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 393046f02647b1a0e07e367dbb68e334e00466b9950589082c8baf7d3a45bddc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 51
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 17da55c14108bb8cae904f764f67c0e0.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: _oJYv9jyIk3rgxiaig23mE8gf5PWNpCEswMTZbW4LM96ZMvNOIFOXA==
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
x-amz-cf-pop: EWR53-P1
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 38 B
637 B 246ms
239ms Fetch
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=393562
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4326e6ba93b30cfec2341bc2cfbc3b718e6d32497c9cb9dfcf70a28e36b6c190

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5QQjzysYYmXp0XBOQXehCE1haDVeEUKXBb%2FI0E%2B0zeYLtpI2en3upeW9HTzS5MmeIuFjastVE5FHTB8q8TQxtPLhHKA%2FiQz8TNfQ0GVKA0VJH%2FSKItm5PiORmNSyckZP3LQ2n%2Bw1"}],"group":"cf-nel","max_age":604800}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8c59f62a1869abac-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 38
server: cloudflare

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 194ms
180ms Fetch
application/json 3.222.148.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.49.8&referrer=about%3Ablank&tmax=622

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.222.148.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
x-auction-status: 29, 29, 29
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 openrtb Show response
ex.ingage.tech/v1/ 2 KB
898 B 91ms
75ms Fetch
application/json 104.18.41.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ex.ingage.tech/v1/openrtb
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.106 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c14cbb599f38c738cdb008be9f46c31d1e9ff2b1a86f89566c13b0cf75ed62f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f62a2f63ac03-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
64 B 53ms
33ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:53 GMT
access-control-allow-credentials: true

POST
H3 200 prebid Show response
prebid.media.net/rtb/ 56 B
93 B 102ms
93ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 324c63e1f671c42393f71e3ca0d790c0551eef8cbd618624b3b1fb1df7cef126

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 33
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:35:53 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 88ms
69ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

9cc94054f28eb67bc4bc313a1d9707399b89776b32c415976c69002d32ef2561

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 154.47.17.56; 154.47.17.56; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
an-x-request-uuid: e0000c31-6d51-4197-8dc4-282a652c2a52
content-length: 145
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:35:53 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 65ms
48ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

5a587cd3295b48e3dd9a73e72633582c52e615a5cf74a3f76a030e9de0572602

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 88ms
71ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

7042a4a56ea0372f5a3a66c49a7a4c1ef3be929725f8bb752a1dedcdbfae3319

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 93ms
77ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

f5debb6b575243b05b1ecc160f08827157e1a964ccba809f9f58cdec984d9d95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

GET
H2 200 sync
x.bidswitch.net/ 43 B
93 B 55ms
52ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid
Requested by: Host: blank
URL: about:blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: image/gif

POST
H3 200 auction Show response
s2s.t13.io/openrtb2/ 1 KB
375 B 228ms
225ms Fetch
application/json 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s2s.t13.io/openrtb2/auction

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

e30d1c4597f21c56dc54cf4db5ec07d3c33b2aee68982b162475b46e295684d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 353
date: Thu, 19 Sep 2024 13:35:54 GMT
x-prebid: pbs-java/2.15.0
content-type: application/json

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 762 B
820 B 112ms
111ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=500600&zone_id=2983354&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.com,412,1,,,&eid_yahoo.com=O9qcUPfIuMQymNib4bdorUw3xj78dhUibMPKqldWuzgsjkDB4t45Ph2fzUn6bZHZCOrdD5B1seUWL1Yf78cm5w%5E3&eid_criteo.com=BvtYTV9ZJTJGViUyRlRYSW12SnZwQlVIelFNdXNYRWZrSjlXTzVEaTlpYSUyQkczak50TWZONWJibXZoc3dDc2VQUm9BRm1mUld1V25YVXcwcHJXMDNkU3c1YkY3cnpKTmJmeHN4amJVYWgxelJBWFh5aUVKUSUzRA%5E1&eid_audigent.com=0001yum0eal66iaeaaaf9f79jieca9kiib69gblgkiabackkc2jl%5E1&eid_id5-sync.com=ID5*05HXXUt7s_5IZ1xOiEU7dLLp4kZ_JnoLKcrykN9GZXLGTK_spefem4bDYgb6IdXY%5E1%5E2&tpid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_pubcid.org=0986eca1-1eaa-4098-b368-9833f0c9eff2%5E1&tpid_tdid=bc8b0835-1393-4f63-9270-2da844e8deab&eid_adserver.org=bc8b0835-1393-4f63-9270-2da844e8deab&rf=about%3Ablank&tg_v.id=0d2426b2-0065-48d3-9360-a53d168936a0&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-25&tg_i.sectioncat=IAB19-25&tg_i.pagecat=IAB19-25&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=535&tg_i.fs_ad_product=banner&tg_i.pbadslot=%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF&tk_flint=pbjs_lite_v8.49.8&x_source.tid=80337dba-72b3-45bb-9cce-2cba95a15682&l_pb_bid_id=4595ee866c976aa5&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=3d9fa643-bd45-43ac-8666-658949789aae&rp_maxbids=1&p_gpid=%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF&m_ch_mobile=%3F0&slots=1&rand=0.3095846717688726
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: b2f5b295cd71c6a41ceae6e81aeaaea8acb4c554c5331416e1849be087de3380

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 762
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
64 B 41ms
36ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:54 GMT
access-control-allow-credentials: true

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 38 B
633 B 130ms
127ms Fetch
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=393562
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d94e0cbb4ff3e0e391ec27d18181920299df0d5a310566ba984af39cdab058e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=snQqjDNrEf6M0ii23mTNLABUfyG1mLx4LrfQDNMOT57eQcyNkTO0akpcQV7psYBOpv6Hg95Mf%2FtCgR4luXI1TpIwiaeZJs1dUoCp4u6EYKZgx4UtA%2BB8%2Fn6MIVJ4YhkQfEfYzgfA"}],"group":"cf-nel","max_age":604800}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8c59f62ad93eabac-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 38
server: cloudflare

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 124ms
121ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

fe8e5fff10c25f5ee0fa9d77bedda0939fd3f7094ce74a88f54f2920a38d20e9

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 154.47.17.56; 154.47.17.56; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
an-x-request-uuid: 61a9073f-0e9f-4561-ad44-f1b3ebc581a3
content-length: 145
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:35:54 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H3 200 prebid Show response
prebid.media.net/rtb/ 56 B
93 B 72ms
69ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 324c63e1f671c42393f71e3ca0d790c0551eef8cbd618624b3b1fb1df7cef126

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 9
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:35:54 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 openrtb Show response
ex.ingage.tech/v1/ 2 KB
875 B 101ms
90ms Fetch
application/json 104.18.41.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ex.ingage.tech/v1/openrtb
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.106 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0dd28e5276236a26e8acdb884b306f425638b21053283c704b0817a7171c4e16

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f62af867ac03-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 59ms
48ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

23773c9860da1868bf3be9447bfcc8f3bc4a9833ee602164896541e7cb902387

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 61ms
53ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

36f2f239b0a62b10935390f6e44b52f0020777f98303d66aba0dce4e5feea1c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 70ms
60ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

be74cfbceb2692ca7c21d7ce374bb5381854c87f73c72ac99652ff4f170cc91a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 146ms
137ms Fetch
application/json 3.222.148.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.49.8&referrer=about%3Ablank&tmax=622

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.222.148.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
x-auction-status: 29
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
633 B 66ms
61ms Fetch
application/json 52.85.61.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-91.ewr53.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 70a1e70a37676a5ff383b0b8bed7397837b118fb8728601a969c3d401e6d026a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 3
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 17da55c14108bb8cae904f764f67c0e0.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: zTBn3ranqE6yi9TbytXbiizIrcc0OHmwdS99OM9dO1hoH2IE_MLFZg==
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
x-amz-cf-pop: EWR53-P1
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
145 B 1319ms
89ms Image
image/gif 54.189.44.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001726752954-K9PZEJ4T-KTTX&halo_id=060ixe7ju6a65a88gfkjedk6gi8i67ihjbiuom2wi0e0ye44qoywmky0qu4u02usw
Requested by: Host: blank
URL: about:blank
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.189.44.64 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-189-44-64.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache
content-length: 43
date: Thu, 19 Sep 2024 13:35:56 GMT
content-type: image/gif
server: nginx/1.24.0

POST
H3 200 auction Show response
s2s.t13.io/openrtb2/ 5 KB
2 KB 202ms
198ms Fetch
application/json 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s2s.t13.io/openrtb2/auction

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

fdd2fef0285aa2277437bbcb07306e048ca45f5b65c3683c5c4455c02afa736d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2214
date: Thu, 19 Sep 2024 13:35:54 GMT
x-prebid: pbs-java/2.15.0
content-type: application/json

POST
H3 200 prebid Show response
prebid.media.net/rtb/ 56 B
93 B 63ms
59ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 324c63e1f671c42393f71e3ca0d790c0551eef8cbd618624b3b1fb1df7cef126

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 4
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
expires: Thu, 19 Sep 2024 13:35:54 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 13:35:53 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
635 B 45ms
42ms Fetch
application/json 52.85.61.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-91.ewr53.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 715bb882d8bad48337e75868220005e60be273cfe66ac666e50c5f9ca2cb03d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 17da55c14108bb8cae904f764f67c0e0.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: HAY-tWUrvTzFbfmIv-HLVS2dHiEAycBUlc9iYpn8I10XISKY1ONprA==
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
x-amz-cf-pop: EWR53-P1
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 82ms
72ms Fetch
application/json 3.222.148.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.49.8&referrer=about%3Ablank&tmax=622

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.222.148.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
x-auction-status: 29, 29
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 785 B
819 B 67ms
59ms Fetch
application/json 69.173.146.10
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=500600&zone_id=2983354&size_id=15&alt_size_ids=2%2C1%2C16&rp_schain=1.0,1!freestar.com,412,1,,,&eid_yahoo.com=O9qcUPfIuMQymNib4bdorUw3xj78dhUibMPKqldWuzgsjkDB4t45Ph2fzUn6bZHZCOrdD5B1seUWL1Yf78cm5w%5E3&eid_criteo.com=BvtYTV9ZJTJGViUyRlRYSW12SnZwQlVIelFNdXNYRWZrSjlXTzVEaTlpYSUyQkczak50TWZONWJibXZoc3dDc2VQUm9BRm1mUld1V25YVXcwcHJXMDNkU3c1YkY3cnpKTmJmeHN4amJVYWgxelJBWFh5aUVKUSUzRA%5E1&eid_audigent.com=0001yum0eal66iaeaaaf9f79jieca9kiib69gblgkiabackkc2jl%5E1&eid_id5-sync.com=ID5*05HXXUt7s_5IZ1xOiEU7dLLp4kZ_JnoLKcrykN9GZXLGTK_spefem4bDYgb6IdXY%5E1%5E2&tpid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_liveintent.com=7-tzr%2FjqPTern6vpdGn07Rh%2B8DWJvHJhJfGMSwhKiy4iMPFmD0WfALaAIAQ5qvu6fYxvhXiY30xLG%2B66%2FRiq8zIZxow8eOTsA8SZTHemBtzd4MGg%3D%3D&eid_pubcid.org=0986eca1-1eaa-4098-b368-9833f0c9eff2%5E1&tpid_tdid=bc8b0835-1393-4f63-9270-2da844e8deab&eid_adserver.org=bc8b0835-1393-4f63-9270-2da844e8deab&rf=about%3Ablank&tg_v.id=0d2426b2-0065-48d3-9360-a53d168936a0&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fmalware-locks-browser-in-kiosk-mode-to-steal-google-credentials%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-25&tg_i.sectioncat=IAB19-25&tg_i.pagecat=IAB19-25&tg_i.mobile=0&tg_i.fs_optimized=false&tg_i.fs_site=535&tg_i.fs_ad_product=dynamicAd&tg_i.pbadslot=%2F15184186%2Fbleepingcomputer_728x90_300x250__320x100_320x50_dynamic%2Fbleepingcomputer_728x90_300x250__320x100_320x50_dynamic1_slot&tk_flint=pbjs_lite_v8.49.8&x_source.tid=1c666d31-e228-4fbe-9cf6-85802ec6c0a2&l_pb_bid_id=5105595664b74b5d&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=3a2384b3-e29e-40c3-9b68-47f24c529f7e&rp_maxbids=1&p_gpid=%2F15184186%2Fbleepingcomputer_728x90_300x250__320x100_320x50_dynamic%2Fbleepingcomputer_728x90_300x250__320x100_320x50_dynamic1_slot&m_ch_mobile=%3F0&slots=1&rand=0.30708689143536816
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.10 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 32c1ae0e0a4adff512a5ba3ded8a675f4afd5cfe248fc43403f837a9aeb08498

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 785
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.21.4

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 75ms
61ms Fetch
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

0e81599466fe50ccc9e1d24f0b344db06f1df2ebb3e634c7dc0308e0fb89d138

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 154.47.17.56; 154.47.17.56; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
an-x-request-uuid: adf930f5-3f12-4594-bf4a-51a61c425cc3
content-length: 144
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Sep 2024 13:35:54 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
64 B 44ms
31ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:54 GMT
access-control-allow-credentials: true

POST
H2 200 openrtb Show response
ex.ingage.tech/v1/ 2 KB
877 B 90ms
75ms Fetch
application/json 104.18.41.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ex.ingage.tech/v1/openrtb
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.106 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 24530ffc2110f466fa6a5b4595656003f1f7d22070f27a99b97f0ca874907e45

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8c59f62b7902ac03-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 59ms
46ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

b173b9ee92e3d84fa16f480253a14c96ed4beabccbbe05416b1614436f74d8c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
406 B 59ms
47ms Fetch
application/json 54.90.36.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c2shb.pubgw.yahoo.com/bidRequest

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.90.36.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

9bff40cca7d5beb68d507b54d9a8753c067ffeca9bc39f32c3596843b6b6c272

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-openrtb-version: 2.5
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json

Response headers

x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
access-control-max-age: 3600
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS,POST
allow: OPTIONS,POST
x-content-type-options: nosniff
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 66
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
access-control-allow-headers: x-openrtb-version,Content-Type

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 38 B
640 B 186ms
179ms Fetch
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=393562
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.81.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16b1f6dea740ca18ea336ed6223b9edce86611604a00c221bf500e4c901d698c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QUJuPI8agpn8qxQNRnuQllmWa7utiAsraSGhPdqJhzNKZXHDcIx7BPYh1pOAMViKVjiP3%2BzZLWJD2P%2FCLCc3i53%2FEv%2FTEFiV%2B3ct5GM5E5qbE967ASadlRz%2B4C%2FTG4MARnzs7N2S"}],"group":"cf-nel","max_age":604800}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 19 Sep 2024 13:35:54 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8c59f62b79d4abac-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 38
server: cloudflare

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 449 B
194 B 125ms
122ms Fetch
text/plain 172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2992154380907323&correlator=3531351860762978&eid=31086815&output=ldjh&gdfp_req=1&vrg=202409160104&ptt=17&impl=fifs&iu_parts=15184186%3A1006593%2Cbleepingcomputer_728x90_300x250__320x100_320x50_dynamic&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C468x60%7C728x90%7C300x250%7C336x280%7C554x312&fluid=height&ifi=16&didk=1878567608&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3Da6f6ec05bdf48766%3AT%3D1726752948%3ART%3D1726752948%3AS%3DALNI_MaRAncOTeub1_vYbYD3WaFefzrAbw&gpic=UID%3D00000a518c9e054b%3AT%3D1726752948%3ART%3D1726752948%3AS%3DALNI_MZvJFhvAu8MXRnrPbH64TM6FThwYg&abxe=1&dt=1726752954343&lmt=1726267479&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&td=1&egid=28368&tan=158e1374-5708-45eb-a51b-13271901dd01&tdf=2&topics=9&tps=9&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1KjA1SFhYVXQ3c181SVoxeE9pRVU3ZExMcDRrWl9Kbm9MS2NyeWtOOUdaWExHVEtfc3BlZmVtNGJEWWdiNklkWFlYARI0CgpwdWJjaWQub3JnEiQwOTg2ZWNhMS0xZWFhLTQwOTgtYjM2OC05ODMzZjBjOWVmZjJYARKGAQoObGl2ZWludGVudC5jb20ScjctdHpyL2pxUFRlcm42dnBkR24wN1JoKzhEV0p2SEpoSmZHTVN3aEtpeTRpTVBGbUQwV2ZBTGFBSUFRNXF2dTZmWXh2aFhpWTMweExHKzY2L1JpcTh6SVp4b3c4ZU9Uc0E4U1pUSGVtQnR6ZDRNR2c9PVgBEmUKCXlhaG9vLmNvbRJWTzlxY1VQZkl1TVF5bU5pYjRiZG9yVXczeGo3OGRoVWliTVBLcWxkV3V6Z3Nqa0RCNHQ0NVBoMmZ6VW42YlpIWkNPcmRENUIxc2VVV0wxWWY3OGNtNXdYARJGCgxhdWRpZ2VudC5jb20SNDAwMDF5dW0wZWFsNjZpYWVhYWFmOWY3OWppZWNhOWtpaWI2OWdibGdraWFiYWNra2MyamxYAQ..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1726752938400&idt=5906&prev_scp=fsrefresh%3D0%26fsrebid%3D1%26fs_uuid%3Dd2e7e572-d587-494d-a89f-a9c438e084b6%26floors_id%3D24ee07%26floors_hour%3D13%26fs_placementName%3Dbleepingcomputer_728x90_300x250__320x100_320x50_dynamic%26fs_ad_product%3DdynamicAd%26fs_clientservermask%3D20030300100023220011202%26fsbid%3Dtimeout%26fs-auuid%3D1c666d31-e228-4fbe-9cf6-85802ec6c0a2%26fspbg%3Dfs_universal%26fs_source%3Ds2s%26fs_auction_id%3D1c666d31-e228-4fbe-9cf6-85802ec6c0a2%26freestar_path%3Dblank%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dttdfsx_300x250%26fs_format%3Dbanner%26fs_size%3D300x250%26fs_pb%3D0.10%26fs_adid%3D534b41844c632e8a%26fs_bidder%3Dttdfsx&cust_params=fsitf%3DY-NYY-YYYY-YYYYY------------------------%26fs_liveintent%3DY%26fs_session_id%3D1ca33be5-1b63-4234-b9d8-28c9235e9af3%26fs_pageview_id%3D7dfbc652479c15462af601e06e48be60%26user-agent%3DChrome%26fs_iiq_enabled%3Dtrue%26section%3Dnews%252Csecurity%26floors_user%3D1%26floors_rtt%3D19%26fs_testgroup%3Doptimised&adks=4025797488&frm=20&eo_id_str=ID%3D4d6b207cf343132b%3AT%3D1726752948%3ART%3D1726752948%3AS%3DAA-AfjbVxpo1tFFGQ1ZNlq248JwM

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409160104/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS