www.androidpolice.com Open in urlscan Pro
44.196.161.176 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/rtD3aeKMSb
Effective URL:
https://www.androidpolice.com/hackers-vlc-malware/
Submission: On April 18 via api (April 18th 2022, 12:53:45 pm UTC) from US — Scanned from DE

Summary HTTP 194 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 76 IPs in 9 countries across 56 domains to perform 194 HTTP transactions. The main IP is 44.196.161.176, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.androidpolice.com. The Cisco Umbrella rank of the primary domain is 137569.
TLS certificate: Issued by R3 on April 6th 2022. Valid for: 3 months.

This is the only time www.androidpolice.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1 1	108.157.4.36 108.157.4.36	16509 (AMAZON-02) (AMAZON-02)
13	44.196.161.176 44.196.161.176	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700:10:... 2606:4700:10::6816:4485	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:ba39	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	143.204.98.122 143.204.98.122	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
20	2600:9000:231... 2600:9000:2315:d000:1a:5235:f980:93a1	16509 (AMAZON-02) (AMAZON-02)
1	151.139.128.11 151.139.128.11	20446 (STACKPATH...) (STACKPATH-CDN)
4	199.232.192.134 199.232.192.134	54113 (FASTLY) (FASTLY)
1	18.66.245.59 18.66.245.59	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
1	18.66.248.54 18.66.248.54	16509 (AMAZON-02) (AMAZON-02)
6	35.186.249.84 35.186.249.84	15169 (GOOGLE) (GOOGLE)
2	52.32.125.98 52.32.125.98	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
5	143.204.95.188 143.204.95.188	16509 (AMAZON-02) (AMAZON-02)
2	34.213.63.176 34.213.63.176	16509 (AMAZON-02) (AMAZON-02)
1	52.205.167.202 52.205.167.202	14618 (AMAZON-AES) (AMAZON-AES)
1	35.190.59.101 35.190.59.101	15169 (GOOGLE) (GOOGLE)
3	35.201.67.47 35.201.67.47	15169 (GOOGLE) (GOOGLE)
2	35.190.91.160 35.190.91.160	15169 (GOOGLE) (GOOGLE)
6	3.228.106.126 3.228.106.126	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:215... 2600:9000:2156:600:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82f::200e	15169 (GOOGLE) (GOOGLE)
2	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	143.204.98.49 143.204.98.49	16509 (AMAZON-02) (AMAZON-02)
1	104.89.31.187 104.89.31.187	16625 (AKAMAI-AS) (AKAMAI-AS)
2	35.85.185.37 35.85.185.37	16509 (AMAZON-02) (AMAZON-02)
1	46.105.202.126 46.105.202.126	16276 (OVH) (OVH)
1 2	2606:4700::68... 2606:4700::6810:7eaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2620:1ec:27::... 2620:1ec:27::cafe:1784	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	34.120.117.212 34.120.117.212	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
3	23.35.236.201 23.35.236.201	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	2a0c:5c81:509... 2a0c:5c81:5095:0:225:90ff:fefa:245d	55081 (24SHELLS) (24SHELLS)
9	63.250.60.64 63.250.60.64	204548 (CLOUDWEBM...) (CLOUDWEBMANAGE-IL-FR)
2	35.158.225.181 35.158.225.181	16509 (AMAZON-02) (AMAZON-02)
1 1	23.88.75.189 23.88.75.189	24940 (HETZNER-AS) (HETZNER-AS)
3 3	23.35.236.247 23.35.236.247	16625 (AKAMAI-AS) (AKAMAI-AS)
4 7	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
2	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
3 3	185.33.220.242 185.33.220.242	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	2600:1f18:612... 2600:1f18:612b:4200:fed4:35ed:3821:843c	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
2	52.28.203.152 52.28.203.152	16509 (AMAZON-02) (AMAZON-02)
1	185.94.180.124 185.94.180.124	35220 (SPOTX-AMS) (SPOTX-AMS)
1	18.196.159.207 18.196.159.207	16509 (AMAZON-02) (AMAZON-02)
1	18.156.156.167 18.156.156.167	16509 (AMAZON-02) (AMAZON-02)
1	204.237.133.116 204.237.133.116	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
1	18.66.248.107 18.66.248.107	16509 (AMAZON-02) (AMAZON-02)
5	20.84.22.197 20.84.22.197	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	34.210.126.15 34.210.126.15	16509 (AMAZON-02) (AMAZON-02)
1 7	44.239.49.199 44.239.49.199	16509 (AMAZON-02) (AMAZON-02)
2 3	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1 2	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3 7	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1	178.162.133.149 178.162.133.149	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
2 2	213.19.147.44 213.19.147.44	26120 (RHYTHMONE) (RHYTHMONE)
2 2	216.200.232.249 216.200.232.249	30419 (MEDIAMATH...) (MEDIAMATH-INC)
2	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
8	23.227.139.243 23.227.139.243	55081 (24SHELLS) (24SHELLS)
2 2	185.184.8.90 185.184.8.90	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
3	2600:9000:215... 2600:9000:2156:2a00:f:4f64:8940:93a1	16509 (AMAZON-02) (AMAZON-02)
2 3	37.157.4.39 37.157.4.39	198622 (ADFORM) (ADFORM)
1	198.47.127.19 198.47.127.19	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
2	54.236.193.207 54.236.193.207	14618 (AMAZON-AES) (AMAZON-AES)
1 13	18.194.231.56 18.194.231.56	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
1 1	194.213.62.37 194.213.62.37	13036 (TMOBILE-) (TMOBILE-)
1	2606:4700:303... 2606:4700:3037::ac43:c1e6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	44.240.45.112 44.240.45.112	16509 (AMAZON-02) (AMAZON-02)
1 1	178.250.2.151 178.250.2.151	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 1	37.252.173.228 37.252.173.228	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	72.251.244.141 72.251.244.141	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
2	2606:4700::68... 2606:4700::6812:c039	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	23.205.235.133 23.205.235.133	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2a05:d018:d29... 2a05:d018:d29:3601:ceb4:b945:274f:b273	16509 (AMAZON-02) (AMAZON-02)
1 2	209.54.176.128 209.54.176.128	16509 (AMAZON-02) (AMAZON-02)
1 1	64.74.236.63 64.74.236.63	19024 (INTERNAP-...) (INTERNAP-BLK5)
194	76

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.4.36 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-36.dus51.r.cloudfront.net

flip.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 44.196.161.176 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-196-161-176.compute-1.amazonaws.com

www.androidpolice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:4485 (United States)

ASN13335 (CLOUDFLARENET, US)

static1.anpoimages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:ba39 (United States)

ASN13335 (CLOUDFLARENET, US)

f.convertkit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 143.204.98.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-122.fra50.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2600:9000:2315:d000:1a:5235:f980:93a1 (United States)

ASN16509 (AMAZON-02, US)

live.primis.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (United States)

ASN20446 (STACKPATH-CDN, US)

s.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 199.232.192.134 (United States)

ASN54113 (FASTLY, US)

androidpolice.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.245.59 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-245-59.dus51.r.cloudfront.net

cdn.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.54 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-54.dus51.r.cloudfront.net

static.narrativ.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.186.249.84 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 84.249.186.35.bc.googleusercontent.com

scarfsmash.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.32.125.98 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-125-98.us-west-2.compute.amazonaws.com

a.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 143.204.95.188 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-95-188.fra50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.213.63.176 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-213-63-176.us-west-2.compute.amazonaws.com

seg.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.205.167.202 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-167-202.compute-1.amazonaws.com

p1.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.59.101 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 101.59.190.35.bc.googleusercontent.com

r.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.67.47 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 47.67.201.35.bc.googleusercontent.com

t.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.91.160 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 160.91.190.35.bc.googleusercontent.com

p.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.228.106.126 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-228-106-126.compute-1.amazonaws.com

events.release.narrativ.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:600:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-49.fra50.r.cloudfront.net

ats.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.89.31.187 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-89-31-187.deploy.static.akamaitechnologies.com

secure.cdn.fastclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.85.185.37 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-85-185-37.us-west-2.compute.amazonaws.com

id.halo.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.202.126 (France)

ASN16276 (OVH, FR)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7eaf (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:27::cafe:1784 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.117.212 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 212.117.120.34.bc.googleusercontent.com

ls.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.35.236.201 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-201.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Amsterdam, Netherlands) 2 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0c:5c81:5095:0:225:90ff:fefa:245d (London, United Kingdom)

ASN55081 (24SHELLS, US)

s.console.adtarget.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 63.250.60.64 (Frankfurt am Main, Germany)

ASN204548 (CLOUDWEBMANAGE-IL-FR, US)

video.primis.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.158.225.181 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-225-181.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.88.75.189 (Gunzenhausen, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.189.75.88.23.clients.your-server.de

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.35.236.247 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-247.deploy.static.akamaitechnologies.com

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 76.223.111.18 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.220.242 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1f18:612b:4200:fed4:35ed:3821:843c (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

60687.publishers.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.28.203.152 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com

c2shb.pubgw.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.94.180.124 (Amsterdam, Netherlands)

ASN35220 (SPOTX-AMS, US)

search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.159.207 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-159-207.eu-central-1.compute.amazonaws.com

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.156.156.167 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-156-167.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 204.237.133.116 (West Chester, United States)

ASN3257 (GTT-BACKBONE GTT, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-107.dus51.r.cloudfront.net

geo.privacymanager.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 20.84.22.197 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

f.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.210.126.15 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-210-126-15.us-west-2.compute.amazonaws.com

p.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 44.239.49.199 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-44-239-49-199.us-west-2.compute.amazonaws.com

ids.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.197.193.217 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.110 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 216.58.212.162 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f162.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.162.133.149 (Rijswijk, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com

sync.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.19.147.44 (Utrecht, Netherlands) 2 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.200.232.249 (Monrovia, United States) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 23.227.139.243 (Piscataway, United States)

ASN55081 (24SHELLS, US)

sync.console.adtarget.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.90 (Amsterdam, Netherlands) 2 redirects

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net

creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2156:2a00:f:4f64:8940:93a1 (United States)

ASN16509 (AMAZON-02, US)

js.adscale.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.157.4.39 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

cm.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.47.127.19 (United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.236.193.207 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-236-193-207.compute-1.amazonaws.com

api.narrativ.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 18.194.231.56 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com

ih.adscale.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.213.62.37 (Novy Jicin, Czech Republic) 1 redirects

ASN13036 (TMOBILE-, CZ)
PTR: bbnautid4.ibillboard.com

bbnaut.ibillboard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::ac43:c1e6 (United States)

ASN13335 (CLOUDFLARENET, US)

images.getadmiral.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.240.45.112 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-240-45-112.us-west-2.compute.amazonaws.com

pixels.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.151 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.173.228 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 866.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

adscale-emea.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.251.244.141 (Amsterdam, Netherlands) 2 redirects

ASN29791 (VOXEL-DOT-NET, US)
PTR: tracking-failover-02.ams2.m6r.eu

tracking.m6r.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:c039 (United States)

ASN13335 (CLOUDFLARENET, US)

app.convertkit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.205.235.133 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-235-133.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:22::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3601:ceb4:b945:274f:b273 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.54.176.128 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.74.236.63 (United States) 1 redirects

ASN19024 (INTERNAP-BLK5, US)
PTR: chi.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	primis.tech live.primis.tech — Cisco Umbrella Rank: 2980 video.primis.tech — Cisco Umbrella Rank: 5969	3 MB
16	adscale.de 1 redirects js.adscale.de — Cisco Umbrella Rank: 7114 ih.adscale.de — Cisco Umbrella Rank: 5512	16 KB
15	ad.gt 1 redirects a.ad.gt — Cisco Umbrella Rank: 4688 seg.ad.gt — Cisco Umbrella Rank: 10673 id.halo.ad.gt — Cisco Umbrella Rank: 5894 p.ad.gt — Cisco Umbrella Rank: 5334 ids.ad.gt — Cisco Umbrella Rank: 4265 pixels.ad.gt — Cisco Umbrella Rank: 5222	26 KB
13	androidpolice.com www.androidpolice.com — Cisco Umbrella Rank: 137569	272 KB
11	doubleclick.net 3 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 193 googleads.g.doubleclick.net — Cisco Umbrella Rank: 40 cm.g.doubleclick.net — Cisco Umbrella Rank: 211 stats.g.doubleclick.net — Cisco Umbrella Rank: 95	133 KB
9	adtarget.com.tr s.console.adtarget.com.tr — Cisco Umbrella Rank: 5421 sync.console.adtarget.com.tr — Cisco Umbrella Rank: 5813	4 KB
9	narrativ.com static.narrativ.com — Cisco Umbrella Rank: 8085 events.release.narrativ.com — Cisco Umbrella Rank: 8012 api.narrativ.com — Cisco Umbrella Rank: 33943	42 KB
9	skimresources.com s.skimresources.com — Cisco Umbrella Rank: 2989 r.skimresources.com — Cisco Umbrella Rank: 2852 t.skimresources.com — Cisco Umbrella Rank: 3002 p.skimresources.com — Cisco Umbrella Rank: 4088 ls.skimresources.com — Cisco Umbrella Rank: 9130	17 KB
8	3lift.com 4 redirects eb2.3lift.com — Cisco Umbrella Rank: 400 tlx.3lift.com — Cisco Umbrella Rank: 569	4 KB
8	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 1219 f.clarity.ms — Cisco Umbrella Rank: 2124 c.clarity.ms — Cisco Umbrella Rank: 637	25 KB
7	pubmatic.com 1 redirects ads.pubmatic.com — Cisco Umbrella Rank: 461 hbopenbid.pubmatic.com — Cisco Umbrella Rank: 457 image2.pubmatic.com — Cisco Umbrella Rank: 898 image6.pubmatic.com — Cisco Umbrella Rank: 622	18 KB
7	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 302 s.amazon-adsystem.com — Cisco Umbrella Rank: 281	82 KB
6	scarfsmash.com scarfsmash.com — Cisco Umbrella Rank: 154284	220 KB
6	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 37	22 KB
5	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 350 prebid-server.rubiconproject.com — Cisco Umbrella Rank: 1106 eus.rubiconproject.com — Cisco Umbrella Rank: 567 token.rubiconproject.com — Cisco Umbrella Rank: 675	11 KB
4	adnxs.com 4 redirects secure.adnxs.com — Cisco Umbrella Rank: 438 adscale-emea.adnxs.com — Cisco Umbrella Rank: 17343	4 KB
4	disqus.com androidpolice.disqus.com — Cisco Umbrella Rank: 305022	6 KB
3	adform.net 2 redirects cm.adform.net — Cisco Umbrella Rank: 2148 track.adform.net — Cisco Umbrella Rank: 4449	1 KB
3	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 355	1 KB
3	yahoo.com 1 redirects c2shb.pubgw.yahoo.com — Cisco Umbrella Rank: 1137 pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 474	1 KB
3	casalemedia.com 3 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 556 ssum.casalemedia.com — Cisco Umbrella Rank: 1353	3 KB
3	spotxchange.com 2 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 531 search.spotxchange.com — Cisco Umbrella Rank: 426	2 KB
3	adlightning.com tagan.adlightning.com — Cisco Umbrella Rank: 1459	84 KB
3	convertkit.com f.convertkit.com — Cisco Umbrella Rank: 15724 app.convertkit.com — Cisco Umbrella Rank: 16563	14 KB
2	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 234	895 B
2	m6r.eu 2 redirects tracking.m6r.eu — Cisco Umbrella Rank: 12948	1 KB
2	creativecdn.com 2 redirects creativecdn.com — Cisco Umbrella Rank: 677	721 B
2	gstatic.com fonts.gstatic.com	45 KB
2	mathtag.com 2 redirects sync.mathtag.com — Cisco Umbrella Rank: 445	1 KB
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 542	814 B
2	google.de ampcid.google.de — Cisco Umbrella Rank: 46741 www.google.de — Cisco Umbrella Rank: 5383	966 B
2	tremorhub.com 1 redirects 60687.publishers.tremorhub.com	646 B
2	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 289	440 B
2	openx.net u.openx.net — Cisco Umbrella Rank: 709	380 B
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 46	2 KB
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 897	2 KB
2	google.com ampcid.google.com — Cisco Umbrella Rank: 1782 www.google.com — Cisco Umbrella Rank: 4	1 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 71	126 KB
2	parsely.com cdn.parsely.com — Cisco Umbrella Rank: 2749 p1.parsely.com — Cisco Umbrella Rank: 2214	26 KB
2	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 98	161 KB
1	zemanta.com 1 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 593	301 B
1	linkedin.com px.ads.linkedin.com — Cisco Umbrella Rank: 482	708 B
1	criteo.com 1 redirects dis.criteo.com — Cisco Umbrella Rank: 706	557 B
1	getadmiral.com images.getadmiral.com — Cisco Umbrella Rank: 101868	1 KB
1	ibillboard.com 1 redirects bbnaut.ibillboard.com — Cisco Umbrella Rank: 18336	550 B
1	sonobi.com sync.go.sonobi.com — Cisco Umbrella Rank: 868	478 B
1	privacymanager.io geo.privacymanager.io — Cisco Umbrella Rank: 1433	594 B
1	loopme.me 1 redirects csync.loopme.me — Cisco Umbrella Rank: 985	244 B
1	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 1681	11 KB
1	fastclick.net secure.cdn.fastclick.net — Cisco Umbrella Rank: 1654	17 KB
1	rlcdn.com ats.rlcdn.com — Cisco Umbrella Rank: 1312	38 KB
1	adsafeprotected.com static.adsafeprotected.com — Cisco Umbrella Rank: 565	481 B
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 176	29 KB
1	anpoimages.com static1.anpoimages.com — Cisco Umbrella Rank: 167405	704 KB
1	flip.it 1 redirects flip.it — Cisco Umbrella Rank: 235495	335 B
1	t.co t.co — Cisco Umbrella Rank: 476	507 B
194	56

	Domain	Requested by
20	live.primis.tech	www.androidpolice.com live.primis.tech tagan.adlightning.com
13	ih.adscale.de	1 redirects js.adscale.de ih.adscale.de
13	www.androidpolice.com	t.co www.androidpolice.com
9	video.primis.tech	www.androidpolice.com live.primis.tech
8	sync.console.adtarget.com.tr	s.console.adtarget.com.tr js.adscale.de
7	cm.g.doubleclick.net	3 redirects www.androidpolice.com eb2.3lift.com
7	ids.ad.gt	1 redirects www.androidpolice.com
7	eb2.3lift.com	4 redirects live.primis.tech eb2.3lift.com
6	events.release.narrativ.com	static.narrativ.com tagan.adlightning.com www.androidpolice.com
6	scarfsmash.com	www.androidpolice.com scarfsmash.com
6	www.google-analytics.com	www.androidpolice.com www.googletagmanager.com www.google-analytics.com
5	f.clarity.ms	www.clarity.ms f.clarity.ms
5	c.amazon-adsystem.com	www.androidpolice.com c.amazon-adsystem.com live.primis.tech
4	androidpolice.disqus.com	www.androidpolice.com tagan.adlightning.com
3	js.adscale.de	s.console.adtarget.com.tr js.adscale.de ih.adscale.de
3	match.adsrvr.org	2 redirects eb2.3lift.com
3	secure.adnxs.com	3 redirects
3	ads.pubmatic.com	tagan.adlightning.com s.console.adtarget.com.tr live.primis.tech
3	t.skimresources.com	www.androidpolice.com s.skimresources.com
3	tagan.adlightning.com	www.androidpolice.com tagan.adlightning.com
2	s.amazon-adsystem.com	1 redirects eb2.3lift.com
2	eus.rubiconproject.com	live.primis.tech eus.rubiconproject.com
2	c.bing.com	1 redirects eb2.3lift.com
2	c.clarity.ms	1 redirects
2	app.convertkit.com	f.convertkit.com
2	tracking.m6r.eu	2 redirects
2	track.adform.net	2 redirects
2	api.narrativ.com	static.narrativ.com
2	creativecdn.com	2 redirects
2	fonts.gstatic.com	fonts.googleapis.com
2	sync.mathtag.com	2 redirects
2	sync.1rx.io	2 redirects
2	image2.pubmatic.com	1 redirects www.androidpolice.com
2	c2shb.pubgw.yahoo.com	live.primis.tech
2	60687.publishers.tremorhub.com	1 redirects www.androidpolice.com
2	ssum-sec.casalemedia.com	2 redirects
2	x.bidswitch.net	www.androidpolice.com eb2.3lift.com
2	u.openx.net	tagan.adlightning.com www.androidpolice.com
2	sync.search.spotxchange.com	2 redirects
2	fonts.googleapis.com	tagan.adlightning.com
2	ls.skimresources.com	s.skimresources.com
2	unpkg.com	1 redirects www.androidpolice.com
2	id.halo.ad.gt	tagan.adlightning.com a.ad.gt
2	securepubads.g.doubleclick.net	tagan.adlightning.com www.googletagservices.com
2	p.skimresources.com	www.androidpolice.com
2	seg.ad.gt	www.androidpolice.com p.ad.gt
2	a.ad.gt	www.androidpolice.com p.ad.gt
2	www.googletagmanager.com	www.androidpolice.com www.googletagmanager.com
2	pagead2.googlesyndication.com	www.androidpolice.com pagead2.googlesyndication.com
1	token.rubiconproject.com	eus.rubiconproject.com
1	b1sync.zemanta.com	1 redirects
1	pr-bh.ybp.yahoo.com	1 redirects
1	px.ads.linkedin.com	eb2.3lift.com
1	adscale-emea.adnxs.com	1 redirects
1	dis.criteo.com	1 redirects
1	pixels.ad.gt	tagan.adlightning.com
1	ssum.casalemedia.com	1 redirects
1	images.getadmiral.com	www.androidpolice.com
1	bbnaut.ibillboard.com	1 redirects
1	www.google.de	www.androidpolice.com
1	www.google.com	www.androidpolice.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	image6.pubmatic.com	ads.pubmatic.com
1	cm.adform.net	s.console.adtarget.com.tr
1	sync.go.sonobi.com	www.androidpolice.com
1	p.ad.gt	a.ad.gt
1	geo.privacymanager.io	ats.rlcdn.com
1	hbopenbid.pubmatic.com	live.primis.tech
1	tlx.3lift.com	live.primis.tech
1	prebid-server.rubiconproject.com	live.primis.tech
1	search.spotxchange.com	live.primis.tech
1	ampcid.google.de	www.google-analytics.com
1	pixel.rubiconproject.com	www.androidpolice.com
1	csync.loopme.me	1 redirects
1	s.console.adtarget.com.tr	tagan.adlightning.com
1	www.clarity.ms	t.co
1	cdn.id5-sync.com	tagan.adlightning.com
1	secure.cdn.fastclick.net	tagan.adlightning.com
1	ats.rlcdn.com	tagan.adlightning.com
1	googleads.g.doubleclick.net	tagan.adlightning.com
1	ampcid.google.com	www.google-analytics.com
1	static.adsafeprotected.com	www.androidpolice.com
1	r.skimresources.com	s.skimresources.com
1	p1.parsely.com	www.androidpolice.com
1	www.googletagservices.com	www.androidpolice.com
1	static.narrativ.com	www.androidpolice.com
1	cdn.parsely.com	www.androidpolice.com
1	s.skimresources.com	www.androidpolice.com
1	f.convertkit.com	www.androidpolice.com
1	static1.anpoimages.com	www.androidpolice.com
1	flip.it	1 redirects
1	t.co
194	92

This site contains links to these domains. Also see Links.

Domain
www.youtube.com
www.facebook.com
twitter.com
news.google.com
feedly.com
www.pushbullet.com
www.linkedin.com
symantec-enterprise-blogs.security.com
www.instagram.com
stevehuff.substack.com
getadmiral.com

Subject Issuer	Validity	Valid
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
androidpolice.com R3	`2022-04-06` - `2022-07-05`	3 months	crt.sh
*.anpoimages.com E1	`2022-04-04` - `2022-07-03`	3 months	crt.sh
convertkit.com Cloudflare Inc ECC CA-3	`2021-06-07` - `2022-06-06`	a year	crt.sh
*.adlightning.com Amazon	`2021-06-24` - `2022-07-23`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.primis.tech Amazon	`2021-10-28` - `2022-11-26`	a year	crt.sh
*.skimresources.com DigiCert SHA2 Secure Server CA	`2021-09-27` - `2022-10-28`	a year	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2020-04-20` - `2022-05-09`	2 years	crt.sh
*.parsely.com Amazon	`2021-07-05` - `2022-08-03`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
static.narrativ.com Amazon	`2022-04-15` - `2023-05-13`	a year	crt.sh
scarfsmash.com R3	`2022-03-23` - `2022-06-21`	3 months	crt.sh
*.ad.gt Amazon	`2021-06-09` - `2022-07-08`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
*.release.narrativ.com Amazon	`2021-08-05` - `2022-09-03`	a year	crt.sh
static.adsafeprotected.com Amazon	`2021-09-05` - `2022-10-04`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
secure.cdn.fastclick.net DigiCert SHA2 Secure Server CA	`2022-01-15` - `2023-01-17`	a year	crt.sh
halo.ad.gt Amazon	`2022-04-04` - `2023-05-03`	a year	crt.sh
cdn.id5-sync.com R3	`2022-04-13` - `2022-07-12`	3 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2022-02-27` - `2023-02-27`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
s.console.adtarget.com.tr ZeroSSL ECC Domain Secure Site CA	`2022-03-29` - `2022-06-27`	3 months	crt.sh
primis.tech Go Daddy Secure Certificate Authority - G2	`2021-10-29` - `2022-06-18`	8 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2022-04-05` - `2023-05-04`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.google.de GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
web.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-03-08` - `2022-08-31`	6 months	crt.sh
*.spotxchange.com GeoTrust RSA CA 2018	`2022-03-11` - `2023-03-29`	a year	crt.sh
*.3lift.com Amazon	`2021-06-12` - `2022-07-11`	a year	crt.sh
*.privacymanager.io Amazon	`2021-09-25` - `2022-10-24`	a year	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh
*.go.sonobi.com Go Daddy Secure Certificate Authority - G2	`2021-12-08` - `2023-01-09`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
sync.console.adtarget.com.tr R3	`2022-03-28` - `2022-06-26`	3 months	crt.sh
*.adscale.de Amazon	`2021-08-08` - `2022-09-06`	a year	crt.sh
*.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-05-28` - `2022-06-15`	a year	crt.sh
api.planethowl.com Amazon	`2022-03-03` - `2023-04-01`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh
getadmiral.com Cloudflare Inc ECC CA-3	`2022-04-12` - `2023-04-12`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2022-03-28` - `2022-09-28`	6 months	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2022-03-16` - `2022-09-16`	6 months	crt.sh

This page contains 20 frames:

Primary Page: https://www.androidpolice.com/hackers-vlc-malware/
Frame ID: 52060036AC03BDD47D524AE87D599220
Requests: 115 HTTP requests in this frame

Frame: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]&x=600&y=338&cbuster=1650286416&pubUrlAuto=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&isDoublePreroll=1&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Frame ID: 8112435443F5C6A371F644059E883F20
Requests: 25 HTTP requests in this frame

Frame: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.5838110022306084
Frame ID: 162D130A9C4790B55E77C2B72D42F697
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220413/r20190131/zrt_lookup.html
Frame ID: 9D49BCF3B5F6426FD28FA145D3CD4D42
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Frame ID: 61E41FB17EB3D6E59BEF12C619C6420B
Requests: 2 HTTP requests in this frame

Frame: https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=94&advUuid=901fa428-bf16-11ec-a358-1d7abbad0206
Frame ID: 2367DEDE6C7BE335CBF7B699DFD2A9D6
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D98%26advUuid%3D
Frame ID: 7B8847B588586CFE4491E66D8C61AF63
Requests: 1 HTTP requests in this frame

Frame: https://s.console.adtarget.com.tr/sync.html?aid=556966
Frame ID: 9EF0CB3201D8176A62EFC090852B31D2
Requests: 4 HTTP requests in this frame

Frame: https://events.release.narrativ.com/api/v0/session.html
Frame ID: 46EB8C4986C04607AA6E5400AF231996
Requests: 1 HTTP requests in this frame

Frame: https://sync.console.adtarget.com.tr/csync?t=a&ep=544989&extuid=${USER_ID}
Frame ID: EBB84DFD7844B0CCF4D68DC63C01D5AE
Requests: 1 HTTP requests in this frame

Frame: https://sync.console.adtarget.com.tr/csync?t=a&ep=550070&extuid=${USER_ID}
Frame ID: 62D8E17E90E714519C2018E8D14AA481
Requests: 1 HTTP requests in this frame

Frame: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=ew60bgDoqUNrWDTTXGAN&pi=admatic&tc=1
Frame ID: 12F9169558908C437ED7D70BB14B812E
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307406%26extuid%3D%24%7BUID%7D
Frame ID: 7A3E79691577B3D635A45B9D180A387C
Requests: 1 HTTP requests in this frame

Frame: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Frame ID: F31438BDEF19729C6A85ED8BAAAB3EC5
Requests: 5 HTTP requests in this frame

Frame: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
Frame ID: A86BB64BD0998B92497D58F5F9145944
Requests: 1 HTTP requests in this frame

Frame: https://sync.console.adtarget.com.tr/csync?t=a&ep=502624&extuid=${USER_ID}
Frame ID: DDB8435ED3ADFF68C93CCE03E2A43CCF
Requests: 1 HTTP requests in this frame

Frame: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Frame ID: 1E2DD14CBE6C06063E5F7A1B985FD99E
Requests: 11 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Frame ID: 300031936FF52302E04317D5F56DBAA8
Requests: 3 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?gdpr=true&
Frame ID: CED0550014DB8723EE07FB365D6736C3
Requests: 11 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156595&gdpr=1&gdpr_consent=
Frame ID: 502FF83BE6A2ADC6EE635AE8E4749470
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Chinese hackers are using VLC media player to launch malware attacksuser-signalchecklistsettings-toggle-horizontal

Page URL History Show full URLs

https://t.co/rtD3aeKMSb Page URL
https://flip.it/3nSJRw HTTP 302
https://www.androidpolice.com/hackers-vlc-malware/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

194
Requests

85 %
HTTPS

29 %
IPv6

56
Domains

92
Subdomains

76
IPs

9
Countries

5157 kB
Transfer

8942 kB
Size

86
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.youtube.com/AndroidPolice

Search URL Search Domain Scan URL

URL: https://www.facebook.com/AndroidPolice

Search URL Search Domain Scan URL

URL: https://twitter.com/AndroidPolice

Search URL Search Domain Scan URL

URL: https://news.google.com/publications/CAAqBggKMLuYFDDSzAI

Search URL Search Domain Scan URL

URL: https://feedly.com/i/subscription/feed%2Fhttps://www.androidpolice.com/feed

Search URL Search Domain Scan URL

URL: https://www.pushbullet.com/channel-popup?tag=androidpolicefeed

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F%2F&src=sdkpreparse
Title: Share

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Chinese%20hackers%20are%20using%20VLC%20media%20player%20to%20launch%20malware%20attacks&url=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F
Title: Tweet

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&title=Chinese%20hackers%20are%20using%20VLC%20media%20player%20to%20launch%20malware%20attacks&source=www.androidpolice.com&summary=The%20likely%20state-sponsored%20hacks%20began%20in%202021
Title: Share

Search URL Search Domain Scan URL

URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-china-ngo-government-attacks
Title: Symantec's cybersecurity experts

Search URL Search Domain Scan URL

URL: https://twitter.com/SteveHuff

Search URL Search Domain Scan URL

URL: https://www.instagram.com/stevenhuff/

Search URL Search Domain Scan URL

URL: https://stevehuff.substack.com/

Search URL Search Domain Scan URL

URL: https://getadmiral.com/pb/?utm_source=www.androidpolice.com&utm_medium=pb&session=5-a67513e069cc672b482650f1bfcf20d4-6763652d6575726f70652d7765737431-0
Title: Powered By

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/rtD3aeKMSb Page URL
https://flip.it/3nSJRw HTTP 302
https://www.androidpolice.com/hackers-vlc-malware/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 63

https://unpkg.com/web-vitals/dist/web-vitals.iife.js HTTP 302
https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.iife.js

Request Chain 71

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID&__user_check__=1&sync_id=901fa465-bf16-11ec-a358-1d7abbad0206 HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=94&advUuid=901fa428-bf16-11ec-a358-1d7abbad0206

Request Chain 78

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D HTTP 307
https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=93&advUuid=0d40b5f9-427c-4b8f-b38e-29ec89dd29f1

Request Chain 79

https://ssum-sec.casalemedia.com/usermatchredir?s=192962&cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D99%26advUuid%3D HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D99%26advUuid%3D&s=192962&C=1 HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=99&advUuid=Yl1fUAXpC-7TJacXbW-QhgAABFkAAAIB

Request Chain 80

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3Dhttps%253A%252F%252Fsync.intentiq.com%252Fprofiles_engine%252FProfilesEngineServlet%253Fat%253D20%2526mi%253D10%2526dpi%253D259151345%2526pcid%253D%24UID%26advId%3D121%26advUuid%3D%24UID HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=1&cmp_cs=&us_privacy=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3Dhttps%253A%252F%252Fsync.intentiq.com%252Fprofiles_engine%252FProfilesEngineServlet%253Fat%253D20%2526mi%253D10%2526dpi%253D259151345%2526pcid%253D%24UID%26advId%3D121%26advUuid%3D%24UID HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&pixel=https%3A%2F%2Fsync.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26mi%3D10%26dpi%3D259151345%26pcid%3D4717929926806835954726&advId=121&advUuid=4717929926806835954726

Request Chain 82

https://secure.adnxs.com/getuid?https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D105%26advUuid%3D%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Flive.primis.tech%252Flive%252FliveCS.php%253Fsource%253Dexternal%2526csuuid%253D625d5f503d373%2526pixel%253D%2526advId%253D105%2526advUuid%253D%2524UID HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=105&advUuid=7389662982991471923

Request Chain 83

https://60687.publishers.tremorhub.com/pubsync?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3Dhttps%253A%252F%252Fsync.intentiq.com%252Fprofiles_engine%252FProfilesEngineServlet%253Fat%253D20%2526mi%253D10%2526dpi%253D%2B584182936%2526pcid%253D%5Btvid%5D%26advId%3D126%26advUuid%3D%5Btvid%5D HTTP 302
https://60687.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3Dhttps%253A%252F%252Fsync.intentiq.com%252Fprofiles_engine%252FProfilesEngineServlet%253Fat%253D20%2526mi%253D10%2526dpi%253D%2B584182936%2526pcid%253D%5Btvid%5D%26advId%3D126%26advUuid%3D%5Btvid%5D

Request Chain 101

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&adnxs_id=$UID HTTP 302
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&adnxs_id=7389662982991471923

Request Chain 102

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&gpdr=0&ttd_puid=AU1D-0100-001650286417-FFKNOTDX-3H3N HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&gpdr=0&ttd_puid=AU1D-0100-001650286417-FFKNOTDX-3H3N HTTP 302
https://ids.ad.gt/api/v1/t_match?tdid=792d858a-f40f-4998-80b0-9589a3aa6526&id=AU1D-0100-001650286417-FFKNOTDX-3H3N

Request Chain 103

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001650286417-FFKNOTDX-3H3N HTTP 302
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001650286417-FFKNOTDX-3H3N

Request Chain 104

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001650286417-FFKNOTDX-3H3N HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm=&google_sc=&google_ula=450542624&id=AU1D-0100-001650286417-FFKNOTDX-3H3N&google_tc= HTTP 302
https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&google_gid=CAESEBuuhYK8SRbXe23a1-5tK5A&google_cver=1&google_ula=450542624,0

Request Chain 105

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001650286417-FFKNOTDX-3H3N HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY1MDI4NjQxNy1GRktOT1REWC0zSDNO

Request Chain 108

https://sync.1rx.io/usersync/audigent/0?dspret=1&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Funruly%3Fid%3DAU1D-0100-001650286417-FFKNOTDX-3H3N%26unruly_id%3D%5BRX_UUID%5D HTTP 302
https://sync.1rx.io/usersync/audigent/0?zcc=1&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Funruly%3Fid%3DAU1D-0100-001650286417-FFKNOTDX-3H3N%26unruly_id%3D%5BRX_UUID%5D&cb=1650286417260 HTTP 302
https://ids.ad.gt/api/v1/unruly?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&unruly_id=OPTOUT

Request Chain 109

https://sync.mathtag.com/sync/img?redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmediamath_match%3Fuser_id%3D%5BMM_UUID%5D%26id%3DAU1D-0100-001650286417-FFKNOTDX-3H3N HTTP 302
https://ids.ad.gt/api/v1/mediamath_match?user_id=f457625d-5f52-4800-98df-ad5f597ab011&id=AU1D-0100-001650286417-FFKNOTDX-3H3N

Request Chain 116

https://creativecdn.com/cm-notify?pi=admatic HTTP 302
https://creativecdn.com/cm-notify?pi=admatic&tc=1 HTTP 302
https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=ew60bgDoqUNrWDTTXGAN&pi=admatic&tc=1

Request Chain 133

https://ih.adscale.de/uu?cbfn=receive&t=1650286417 HTTP 302
https://ih.adscale.de/uu?cbfn=receive&t=1650286417&nut&uu=e5c668e31ea84d1f9f80ad285d6f4583

Request Chain 141

https://bbnaut.ibillboard.com/match/AdScale?partneruid=e5c668e31ea84d1f9f80ad285d6f4583&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg%3Ftpid%3D101%26tpuid%3DIBB_USER_ID&gdpr=0 HTTP 302
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=101&tpuid=BBID-01-03250004175712454-16580088

Request Chain 145

https://ssum.casalemedia.com/usermatchredir?s=183592&cb=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D63%26tpuid%3D__UID__&uid=fe341246438db1d68dccf02f5e7957a81c62235048361433f18b8472cfe63955&tpid=63&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=Yl1fUAXpC.7TJacXbW.QhgAA%261113

Request Chain 154

https://track.adform.net/serving/cookie/match/?party=9&uid=5815c490ed3dd65326730e11f2227174bdb455b6632e329a684ccf10317b7eed&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg&gdpr=0 HTTP 302
https://track.adform.net/serving/cookie/match/?CC=1&party=9&uid=5815c490ed3dd65326730e11f2227174bdb455b6632e329a684ccf10317b7eed&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=42&gdpr=0&tpuid=3887939266147751660

Request Chain 155

https://dis.criteo.com/dis/usersync.aspx?r=17&p=32&cp=adscale&url=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D40%26tpuid%3D%40%40CRITEO_USERID%40%40&uid=8e42914b087d1e41055162852986a7c77c2ba16fc2724222df6881db946167e0&tpid=40&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=3954445a-0b39-46c4-91c5-0efaa65fa778&gdpr=0

Request Chain 157

https://sync.mathtag.com/sync/img?mt_exid=26&redir=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D39%26tpuid%3D%5BMM_UUID%5D&uid=b4d5719d2649f3e77f8b14c00ebfde1274607310b5ceee4b2ebbe0cc38dc40ce&tpid=39&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=f457625d-5f52-4800-98df-ad5f597ab011&gdpr=0&gdpr_consent=

Request Chain 158

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_sc&uid=90f097368445d894119f99e5a97e20c301c1cd72d2d6da37f9c1c1d0aff39ea5&tpid=38&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?uid=90f097368445d894119f99e5a97e20c301c1cd72d2d6da37f9c1c1d0aff39ea5&tpid=38&gdpr=0&tpuid=CAESEIAhbJWZV8UDZ_6YLKh2WrM&google_cver=1

Request Chain 159

https://adscale-emea.adnxs.com/getuid?https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg%3Ftpid%3D75%26tpuid%3D%24UID&gdpr=0 HTTP 302
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=75&tpuid=7389662982991471923&gdpr=0

Request Chain 160

https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=3002c21ea4f8379b91fafda45c62c753e9a70868bf284b487510f3983248ed0e&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fjs&gdpr=0 HTTP 302
https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=3002c21ea4f8379b91fafda45c62c753e9a70868bf284b487510f3983248ed0e&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fjs&gdpr=0&checkcookies=true HTTP 302
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/js?tpid=48&tpuid=a65462d315c203f2ccfdb52aa9f210f2

Request Chain 165

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=D9F8A82D2A7D4A28B9441D8CD537E7D9&RedC=c.clarity.ms&MXFR=0EE475E512F369663DC1646F16F36743 HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=D9F8A82D2A7D4A28B9441D8CD537E7D9&MUID=1C16A8E6A8576BE71376B96CA93C6A6F

Request Chain 178

https://eb2.3lift.com/ebda?sync=1&gdpr=1&cmp_cs= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDcxNzkyOTkyNjgwNjgzNTk1NDcyNg%3D%3D

Request Chain 180

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDcxNzkyOTkyNjgwNjgzNTk1NDcyNg%3D%3D

Request Chain 182

https://pr-bh.ybp.yahoo.com/sync/triplelift/4717929926806835954726?gdpr=1&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=2662&xuid=y-WJ7KWHpE2oRkldSzyQ.YtFmI5jZcDS29iDbB56f0Aw--~A&dongle=0883

Request Chain 185

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=4717929926806835954726 HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=4717929926806835954726&dcc=t

Request Chain 186

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

194 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 rtD3aeKMSb
t.co/ 221 B
507 B 135ms
119ms Document
text/html 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/rtD3aeKMSb

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 173
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 12:53:33 GMT
expires: Mon, 18 Apr 2022 12:58:34 GMT
server: tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: e474b4492568d4c96dfef66545b36aa4b97b14c029c691ad4161ad5fda8f6114
x-response-time: 113
x-xss-protection: 0

GET
H2

200

Primary Request / Show response
www.androidpolice.com/hackers-vlc-malware/
Redirect Chain

https://flip.it/3nSJRw
https://www.androidpolice.com/hackers-vlc-malware/

627 KB
130 KB

830ms
384ms

Document
text/html

44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/hackers-vlc-malware/

Requested by

Host: t.co
URL: https://t.co/rtD3aeKMSb

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

fbe72bd9c443125dbadb506dd1059c8e95d959617c383b87f7e03cbdf39bc98b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://t.co/rtD3aeKMSb
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, private
content-encoding: br
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
content-type: text/html; charset=UTF-8
date: Mon, 18 Apr 2022 12:53:35 GMT
referrer-policy: no-referrer-when-downgrade
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

cache-control: public, max-age=3600
content-length: 144
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 12:53:35 GMT
location: https://www.androidpolice.com/hackers-vlc-malware/
vary: Accept
via: 1.1 b0067143f1e1520182fe27b53cced2a6.cloudfront.net (CloudFront)
x-amz-cf-id: UBGzpwdiyC2CSd_4bHz9V0hkR0T_YQFjLaQAqMcn88mXAqNgTOFOHQ==
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1

GET
H2 200 VLC3Hero-01.png
static1.anpoimages.com/wordpress/wp-content/uploads/2020/09/23/ 703 KB
704 KB 77ms
26ms Image
image/webp 2606:4700:10::6816:4485
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static1.anpoimages.com/wordpress/wp-content/uploads/2020/09/23/VLC3Hero-01.png?q=50&fit=contain&w=1500&h=&dpr=1.5
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4485 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9c969c534018935993ccb32e0057bb637ba4898ed5784b8a86302961e3f0e99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
cf-cache-status: HIT
age: 129251
cf-polished: origFmt=png, origSize=1059989
content-disposition: inline; filename="VLC3Hero-01.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 720084
x-request-id: c62iRn7TIbeQe0DL1K11-
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: 76f2409ecee6c7f9db703ebd3f6ce019bda6e8c84910626d39d7b4ab658b7ea3
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
access-control-allow-methods: GET, OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6fdd8b53fd689c01-FRA
expires: Mon, 17 Apr 2023 00:59:25 GMT

GET
H2 200 a-article.b4c2e531.css
www.androidpolice.com/public/build/ 199 KB
28 KB 171ms
171ms Stylesheet
text/css 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/public/build/a-article.b4c2e531.css

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

0f25eef1f15c5be98d251cc8b60a3cdaf0bb23672d313c8a62dd2037bbb7488e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:35 GMT
content-encoding: br
x-content-type-options: nosniff
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62589304-31cd7"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
expires: Tue, 18 Apr 2023 12:53:35 GMT

GET
H2 200 dfp.js Show response
www.androidpolice.com/public/build/ 36 B
509 B 105ms
105ms Script
application/javascript 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/public/build/dfp.js

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

ffc4b44e1b7402c08e5f2f702ca535e7e7083a684cda203dfdcb734cd5761aa6

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
x-content-type-options: nosniff
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62589304-24"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 valnet-header-ads.a8e17398.js Show response
www.androidpolice.com/public/build/ 3 KB
1 KB 99ms
96ms Script
application/javascript 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/public/build/valnet-header-ads.a8e17398.js

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

8b0d1446f412484a2a7d1abb46ddc5de128d8aaf11b1fe04ac729ee4830c5e5b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
x-content-type-options: nosniff
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62589304-afe"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 ck.5.js Show response
f.convertkit.com/ckjs/ 52 KB
14 KB 94ms
33ms Script
application/javascript 2606:4700::6812:ba39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://f.convertkit.com/ckjs/ck.5.js
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ba39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7b7fb37ec681a6a1bd507ce80613c7343fb3b394b29e21e7b11d6a6df933f68

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 19 Oct 2021 14:51:13 GMT
server: cloudflare
age: 5517
etag: W/"7f6a2b3f8f18a10fb2a520d097324cd7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 6fdd8b55687d6927-FRA
x-amz-request-id: EW9WSG3GVKAN8TPD
x-amz-id-2: wHRuFHONBHzBtt4CG9TbdUwsd0JO+C6dB2mEB0SphxGYlpIkaolG6eynMQ2rZ76+BAzdzmucRX0=
expires: Mon, 18 Apr 2022 16:53:36 GMT

GET
H2 200 adsninja.min.js Show response
www.androidpolice.com/public/build/ 48 KB
11 KB 101ms
99ms Script
application/javascript 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/public/build/adsninja.min.js?v=1647019562

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

05fde9258245fd1d1558ca071a747faedbd1a573c67e512d6b728cba8d6a37b8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
x-content-type-options: nosniff
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62589304-bf5d"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/valnet/ 44 KB
19 KB 35ms
8ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/valnet/op.js
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1d40f54cfc8d8edfd938608ca2eb84873935f28e1a8840ed61da9660fdb049c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: MZACbk3VKzmMBlK1dVnAW7xUaGXO_VH9
content-encoding: gzip
etag: "2ca4de1a34e7fb37e6735ba2bf6693f6"
age: 3478
x-cache: Hit from cloudfront
content-length: 18513
x-amz-meta-git_commit: 7b120a5
last-modified: Mon, 18 Apr 2022 04:28:57 GMT
server: AmazonS3
date: Mon, 18 Apr 2022 11:55:45 GMT
content-type: application/javascript
via: 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: _HuSc2YzUfqxii4IVhL5sdUZBL6bwSfP8jh_E9rVwSUK4JeuzBcNow==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 155 KB
53 KB 165ms
77ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8db46253e49e6fa2e93c512956b60ab63812fa36c38b7929061901fe3de8a842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54118
x-xss-protection: 0
server: cafe
etag: 8460303581243278876
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 12:53:36 GMT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ 44 KB
44 KB 79ms
35ms Script
text/javascript 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 3deee04e2d853c3ad7d85928d921d718cc63f9fc04c8923cb786e6a46d5c55f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:35 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-pop: DUS51-P2
content-type: text/javascript; charset=utf-8
x-amz-cf-id: UnWOT4tt11LIWXcn769dk_hAfKXNHHt4xItGbPJ2_EkXgriUglRGdw==

GET
H2 200 valnet-footer.873d1235.js Show response
www.androidpolice.com/public/build/ 47 KB
14 KB 102ms
100ms Script
application/javascript 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/public/build/valnet-footer.873d1235.js

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

926952e0833e0acb9dd02fdbbe59bb8be77f8e7571aaedc900649b9513500e8b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
x-content-type-options: nosniff
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62589304-bb6a"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 valnet-footer-article.2fb673ae.js Show response
www.androidpolice.com/public/build/ 5 KB
2 KB 102ms
100ms Script
application/javascript 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/public/build/valnet-footer-article.2fb673ae.js

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

0f4020071f4d6fbd6e07ddb16daf4859441c7454a0c733b019f7cb1adc8f4d49

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
x-content-type-options: nosniff
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62589304-1457"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 85009X1537243.skimlinks.js Show response
s.skimresources.com/js/ 42 KB
15 KB 71ms
18ms Script
application/octet-stream 151.139.128.11
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://s.skimresources.com/js/85009X1537243.skimlinks.js
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3ffeed0ceb0e14dfa1f0bd0fa79520b976f0ef6644190e09a2a1520feb76322

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
last-modified: Tue, 15 Mar 2022 10:51:30 GMT
server: AmazonS3
x-amz-request-id: A8BVXWYKKYZJTB37
etag: "8131ae354f9ba91af07374ab421be75a"
x-hw: 1650286416.cds208.am5.hn,1650286416.cds220.am5.c
content-type: application/octet-stream
cache-control: max-age=3600
accept-ranges: bytes
content-length: 15513
x-amz-id-2: 0kxxRqiGdYWvis9XeltQ6Pq2SyXa4hriVJax3td2wrMFou0nMu87Dl10m5UysR8wgfY+slSk6SA=

GET
H/1.1 200
OK count.js Show response
androidpolice.disqus.com/ 1 KB
2 KB 49ms
6ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://androidpolice.disqus.com/count.js

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 12
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Mon, 11 Apr 2022 19:06:38 GMT
Server: nginx
ETag: "62547c3e-367"
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
X-Amz-Cf-Pop: DFW3-C1
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: Ru_Vq-WyL-atLN-kAGhR0-KVytPL_WDKXW4uNSnyvvuIVKkPvCFqnA==

GET
H2 200 p.js Show response
cdn.parsely.com/keys/androidpolice.com/ 71 KB
25 KB 52ms
10ms Script
application/javascript 18.66.245.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/androidpolice.com/p.js
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.245.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-245-59.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 624d529e0da6719af2df6d25615df0c3a7b2dd28c015a731dd0341f0600c5d12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: public
date: Mon, 18 Apr 2022 03:58:10 GMT
content-encoding: gzip
last-modified: Wed, 23 Mar 2022 18:37:39 GMT
server: nginx
age: 32222
etag: W/"623b68f3-11da1"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 8d4901eb4989773bb579fc1597e54ea8.cloudfront.net (CloudFront)
cache-control: max-age=86400, public
x-amz-cf-pop: DUS51-P1
x-amz-cf-id: 43Kfor5PlmUH3tl6G1WyXnzI2R-xkuPTIUoG6jroq_93I4u1v_Hu6A==
expires: Tue, 19 Apr 2022 03:56:34 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 124ms
38ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2185
date: Mon, 18 Apr 2022 12:17:11 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 18 Apr 2022 14:17:11 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 177 KB
60 KB 142ms
53ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PQPCZ5S

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

768ae46ee32393ad013c514cd6708bef24fc9a66efb71b1f4b0e73b0a3a5a736

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61193
x-xss-protection: 0
last-modified: Mon, 18 Apr 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Apr 2022 12:53:36 GMT

GET
H/1.1 200
OK narrativ-pub.1.0.0.js Show response
static.narrativ.com/tags/ 38 KB
39 KB 51ms
10ms Script
application/octet-stream 18.66.248.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.narrativ.com/tags/narrativ-pub.1.0.0.js
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-54.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c2f1e02e54fe66adc0d5f1f06048c30bb7cdf2645b7e0fc48c881923868f5f27

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Sun, 17 Apr 2022 19:07:06 GMT
Via: 1.1 bf943aab70e585412f7a215fb0a10790.cloudfront.net (CloudFront)
Last-Modified: Wed, 30 Mar 2022 15:47:19 GMT
Server: AmazonS3
Age: 63991
ETag: "fa011ce702b3b9babaaf109dd7ad4d8f"
X-Cache: Hit from cloudfront
Content-Type: application/octet-stream
Connection: keep-alive
X-Amz-Cf-Pop: DUS51-P1
Content-Length: 39413
X-Amz-Cf-Id: blkPEcyZzhf86nf7j1_S60WGJlQPDBeFBdv1UXkioV8gXCpYhtqGSg==

GET
H2 200 v2yvlzsveWtgqGFXj2wU3ajphon_Qq9myt1bClE9dnFgPWVzuw4LojxURFEzFAfp8GOJdYROXlGZLTg Show response
scarfsmash.com/ 529 KB
92 KB 76ms
32ms Script
text/javascript 35.186.249.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://scarfsmash.com/v2yvlzsveWtgqGFXj2wU3ajphon_Qq9myt1bClE9dnFgPWVzuw4LojxURFEzFAfp8GOJdYROXlGZLTg

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.249.84 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

84.249.186.35.bc.googleusercontent.com

Software

Resource Hash

e3f1e8c4477a44fd69e054161ef70cf191245d93c3d0da92dcddc4f247cacfff

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; preload
content-encoding: br
x-datacenter: gce-europe-west1
etag: "8bd2bf98cc0bd647dc2c287eab1e89c67aa7a85f832ed4b6b524598d43a86787"
vary: Accept-Encoding, Accept-Language
x-hostname: fen-hoothoot-europe-west1-spot-97sw
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
date: Mon, 18 Apr 2022 12:53:36 GMT
x-buildnumber: 516110284
timing-allow-origin: *

GET
H2 200 269 Show response
a.ad.gt/api/v1/u/matches/ 7 KB
7 KB 685ms
336ms Script
application/javascript 52.32.125.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/269?url=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&ref=https%3A%2F%2Ft.co%2F
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.32.125.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-125-98.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 6a18ce19aa8cf074d7a5d3ee52e90ef242cfb5b280ddef98d0e0d5b3f44230e0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 18 Apr 2022 12:53:36 GMT
cross-origin-resource-policy: cross-origin
server: nginx/1.18.0
content-length: 6855
content-type: application/javascript

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 83 KB
29 KB 134ms
47ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6447b819f1671061eaef6eb9a388b162c8714aed75720e7e4a579f738e30cb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28592
x-xss-protection: 0
server: sffe
etag: "1190 / 193 of 1000 / last-modified: 1650280021"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 18 Apr 2022 12:53:36 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 135 KB
37 KB 44ms
8ms Script
application/javascript 143.204.95.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-188.fra50.r.cloudfront.net
Software: Server /
Resource Hash: 1909b2a83fd41494d94862c4323944d9d0aa1f1e653f252ea5a73fc5944308b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: 6RTeJ.t3xDSJXjTxhAMtPfr9IcIsozAE
content-encoding: gzip
etag: 4abd427e43cd6822329a2c05539e321f
age: 95
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 09TS5V8FVP8NQ9SDQHGM
date: Mon, 18 Apr 2022 12:52:44 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 b44e2902bb3501d47514e51618f1bda4.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: ip9LFZsQefKeWBprXbvth5QyhAwPufiU0l3ulUXi4SFnaN6yAfi5cQ==

GET
H2 200 ap-logo-full-colored-dark.2a8945fa.svg
www.androidpolice.com/public/build/images/ 4 KB
2 KB 97ms
97ms Image
image/svg+xml 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.androidpolice.com/public/build/images/ap-logo-full-colored-dark.2a8945fa.svg

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/public/build/a-article.b4c2e531.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

0375b396ee741813158bda96fabc3295611b9ca67cd367aa31193cf80dacfe95

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/public/build/a-article.b4c2e531.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
x-content-type-options: nosniff
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62589304-11de"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 Gilroy-Bold.3834bcd8.woff2
www.androidpolice.com/public/build/fonts/ 31 KB
31 KB 97ms
96ms Font
font/woff2 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/public/build/fonts/Gilroy-Bold.3834bcd8.woff2

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/public/build/a-article.b4c2e531.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e8fd802ce5042d308a2d650c3db8f60b2bd3b884f34d6ceabe0631a3a9e226f5

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.androidpolice.com/public/build/a-article.b4c2e531.css
Origin: https://www.androidpolice.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
x-content-type-options: nosniff
content-length: 31380
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "62589304-7a94"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
accept-ranges: bytes
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 icomoon.6b793360.woff
www.androidpolice.com/public/build/fonts/ 18 KB
18 KB 97ms
97ms Font
font/woff 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/public/build/fonts/icomoon.6b793360.woff

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/public/build/a-article.b4c2e531.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

6378f6326c6b8ed5ba7c9dd71718f4acfab15effd24a9c83974e4e8ea473879e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.androidpolice.com/public/build/a-article.b4c2e531.css
Origin: https://www.androidpolice.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
x-content-type-options: nosniff
content-length: 18096
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "62589304-46b0"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
accept-ranges: bytes
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 Gilroy-Medium.0ba01f1d.woff2
www.androidpolice.com/public/build/fonts/ 30 KB
31 KB 97ms
97ms Font
font/woff2 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/public/build/fonts/Gilroy-Medium.0ba01f1d.woff2

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/public/build/a-article.b4c2e531.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

9115bbf3b3dee88764e74ecdf31c2234ece91aa42a596a1d3ba11925662777ba

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.androidpolice.com/public/build/a-article.b4c2e531.css
Origin: https://www.androidpolice.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
x-content-type-options: nosniff
content-length: 31156
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "62589304-79b4"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
accept-ranges: bytes
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 8112 5 KB
5 KB 26ms
26ms Script
text/javascript 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]&x=600&y=338&cbuster=1650286416&pubUrlAuto=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&isDoublePreroll=1&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 442635fd9dd8454f6a6a52bba89a9ba2f98d4f97aefa02d6de453dc5b646639a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:35 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-pop: DUS51-P2
content-type: text/javascript; charset=utf-8
x-amz-cf-id: pqfZ1Bf29yYnsyC15l70MohYr9qaXJy74DEKqk0fBH8ulXHF2KX-gQ==

GET
H2 204 segments.js Show response
seg.ad.gt/api/v1/ 0
52 B 541ms
195ms Script
text/plain 34.213.63.176
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://seg.ad.gt/api/v1/segments.js?partner_id=269&url=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.213.63.176 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-213-63-176.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
server: nginx/1.20.0

GET
H/1.1 200
OK /
p1.parsely.com/plogger/ 43 B
257 B 420ms
101ms Image
image/gif 52.205.167.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p1.parsely.com/plogger/?rand=1650286416286&plid=94751698&idsite=androidpolice.com&url=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&urlref=https%3A%2F%2Ft.co%2F&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&sref=https%3A%2F%2Ft.co%2F&sts=1650286416283&slts=0&title=Chinese+hackers+are+using+VLC+media+player+to+launch+malware+attacks&date=Mon+Apr+18+2022+12%3A53%3A36+GMT%2B0000+(GMT)&action=pageview&pvid=91822313&u=pid%3D14b17f8a3cf6d1468740a4e2e2d991cf
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.167.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-167-202.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:36 GMT
Cache-Control: no-cache
Last-Modified: Monday, 18-Apr-2022 12:53:36 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 iab_consent_sdk.v1.0.js Show response
live.primis.tech/content/ClientDetections/ Frame 8112 19 KB
6 KB 22ms
21ms Script
application/javascript 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]&x=600&y=338&cbuster=1650286416&pubUrlAuto=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&isDoublePreroll=1&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:35 GMT
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 15:01:36 GMT
server: nginx
x-amz-cf-pop: DUS51-P2
etag: W/"5e441350-4be0"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public
x-amz-cf-id: TDdDlvllAPXfplioiFHXCRk6tXehAPfle632dYfaP0TOAMOE8q62Tg==
expires: Tue, 18 Apr 2023 12:53:35 GMT

GET
H2 200 DetectGDPR2.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame 8112 9 KB
3 KB 23ms
22ms Script
application/javascript 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR2.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]&x=600&y=338&cbuster=1650286416&pubUrlAuto=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&isDoublePreroll=1&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 154212eb976f7df7c79f5844fcb356740bcb6c51edacb2e8515108e2d7effa67

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:35 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:48 GMT
server: nginx
x-amz-cf-pop: DUS51-P2
etag: W/"6024fccc-228f"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public
x-amz-cf-id: v7_kVxlXZEfrEa-TFw1vInL2T4U7TFeod9sYNyJthTYXl2m0XavuQg==
expires: Tue, 18 Apr 2023 12:53:35 GMT

GET
H2 200 DetectGDPR.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame 8112 8 KB
3 KB 23ms
23ms Script
application/javascript 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]&x=600&y=338&cbuster=1650286416&pubUrlAuto=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&isDoublePreroll=1&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 5bb08412d18881e3fc69fdb44226bfc6f66a77d45dfff3f10b98a100c09bc970

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:35 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:48 GMT
server: nginx
x-amz-cf-pop: DUS51-P2
etag: W/"6024fccc-1ef8"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public
x-amz-cf-id: Y-Tx1wgVBTJTbxXGutWu8xpPhl6Huin68bWxZk_2P_mrtlFjvIr4Kw==
expires: Tue, 18 Apr 2023 12:53:35 GMT

GET
H2 200 hls.0.12.4_3.min.js Show response
live.primis.tech/content/video/hls/ Frame 8112 258 KB
72 KB 22ms
22ms Script
application/javascript 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]&x=600&y=338&cbuster=1650286416&pubUrlAuto=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&isDoublePreroll=1&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a20010b26bce05ea3cfc83cf3a162b7c16b5d2fa2bcf2253b0394b0eb322347a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:35 GMT
content-encoding: gzip
last-modified: Wed, 23 Mar 2022 12:48:36 GMT
server: nginx
x-amz-cf-pop: DUS51-P2
etag: W/"623b1724-409bc"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public
x-amz-cf-id: cvVykid_CQYaDgoJBvv05bKZYsfP99WqsRZyWxHXZ56dczqJnZk2mA==
expires: Tue, 18 Apr 2023 12:53:35 GMT

GET
H2 200 prebidVid.5.18.0_11.min.js Show response
live.primis.tech/content/prebid/ Frame 8112 490 KB
491 KB 43ms
42ms Script
application/javascript 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_11.min.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]&x=600&y=338&cbuster=1650286416&pubUrlAuto=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&isDoublePreroll=1&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 8dad17c7c62057440ce13ba42120968005b66d0d7125df6b3086e8588fded21e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
last-modified: Mon, 28 Mar 2022 06:22:56 GMT
server: nginx
x-amz-cf-pop: DUS51-P2
etag: "62415440-7a683"
x-cache: Miss from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
content-length: 501379
x-amz-cf-id: 08PlRF-nOdogEj2OoY_XF_4riH5-fKb9LR1TCdoxl0yS4ooyczhg9w==
expires: Tue, 18 Apr 2023 12:53:36 GMT

GET
H2 200 liveVideo.php Show response
live.primis.tech/live/ Frame 8112 530 KB
531 KB 71ms
71ms Script
text/html 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30342D31385F31357D7B7331363734393939317D7B4335377D7B5359584174636D566E4C5739795A313933643363755957356B636D39705A48427662476C6A5A53356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583630307D7B593333387D7B66317D7B4C31313433337DFEFE&userIpAddr=2a03%3A1b20%3A6%3Af011%3A%3A6e&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F100.0.4896.75+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=40&c2pWaitTime=5&isSinglePageFloatSupport=0&csuuid=625d5f503d373&debugInfo=16749991_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=16749991&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2a4dzjowrqnk&secondaryContent=&x=600&y=338&pubUrl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=0&flow_bottomOffset=0&impGap=1&flow_width=340&flow_height=192&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=11433&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=ap-reg-org_www.androidpolice.com
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=108500&subId=[AP-Reg-Org]&x=600&y=338&cbuster=1650286416&pubUrlAuto=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&isDoublePreroll=1&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 072d79a68f4d26fa98cb86e05d9214b0c8c749bd4ed0a660bc8695842133ca20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: DUS51-P2
x-amz-cf-id: whVxeS8uX47-YcLV-4qZZ_f1jqQmNJbVLmzOiQMk2-hNjA_1xLtiaQ==
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8

GET
H2 200 ap-logo-full-white.dcd167c8.svg
www.androidpolice.com/public/build/images/ 5 KB
2 KB 98ms
97ms Image
image/svg+xml 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.androidpolice.com/public/build/images/ap-logo-full-white.dcd167c8.svg

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/public/build/a-article.b4c2e531.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

daac16a8dcbf772343d560088f23516e8235ab8c3450cae85cc1c61ad4aa6db2

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/public/build/a-article.b4c2e531.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
x-content-type-options: nosniff
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Apr 2022 21:32:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62589304-1262"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, max-age=31536000, public
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
expires: Tue, 18 Apr 2023 12:53:36 GMT

POST
H2 200 / Show response
r.skimresources.com/api/ 205 B
370 B 70ms
22ms XHR
application/json 35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/85009X1537243.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.59.101 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

c66255eb60dbcde1c689b13106d077f62deaa59e9378299d22877b5530f55e22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
strict-transport-security: max-age=31536000
content-type: application/json
access-control-allow-origin: https://www.androidpolice.com
vary: Accept-Encoding
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

GET
H2 206 robots.txt
t.skimresources.com/api/v2/ Frame 162D 0
102 B 120ms
45ms Image
text/plain 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.5838110022306084
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 47.67.201.35.bc.googleusercontent.com
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 google
server: Python/3.7 aiohttp/3.5.4
alt-svc: clear
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 px.gif
p.skimresources.com/ 43 B
244 B 95ms
20ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=0.9968803412257976
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: clear
content-length: 43
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
102 B 95ms
21ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=0.9968803412257976
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: clear
content-length: 43
content-type: image/gif

OPTIONS
H2 200 /
events.release.narrativ.com/api/v0/publishers/2412/pub_info/ Frame 0
0 314ms
104ms Preflight
text/html 3.228.106.126
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://events.release.narrativ.com/api/v0/publishers/2412/pub_info/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.228.106.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-228-106-126.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: access-control-allow-credentials,x-requested-with
Access-Control-Request-Method: GET
Origin: https://www.androidpolice.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-headers: access-control-allow-credentials, x-requested-with
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://www.androidpolice.com
allow: HEAD, OPTIONS, GET
content-length: 0
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 12:53:36 GMT
server: nginx/1.20.2
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin
x-bam-build-version: 63c21d9982831d134ab44164cd70784f89423817
x-bam-env: release
x-robots-tag: none

GET
H2 200 / Show response
events.release.narrativ.com/api/v0/publishers/2412/pub_info/ 185 B
455 B 102ms
102ms XHR
application/json 3.228.106.126
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://events.release.narrativ.com/api/v0/publishers/2412/pub_info/

Requested by

Host: static.narrativ.com
URL: https://static.narrativ.com/tags/narrativ-pub.1.0.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.228.106.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-228-106-126.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

c16fe63d5e6c3d1acc9b2aedec440d98db4ebd7ea1bdfe9f26aab74e7be91a7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://www.androidpolice.com/hackers-vlc-malware/
Access-Control-Allow-Credentials: true
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-bam-build-version: 63c21d9982831d134ab44164cd70784f89423817
date: Mon, 18 Apr 2022 12:53:36 GMT
server: nginx/1.20.2
x-bam-env: release
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.androidpolice.com
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-robots-tag: none
content-length: 185

GET
H2 200 b-7b120a5-0a477631.js Show response
tagan.adlightning.com/valnet/ 73 KB
28 KB 9ms
9ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/valnet/b-7b120a5-0a477631.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 46e15ddd3f3583786961d72eb1a81b34bc9dad89240a461dcf02b43c6aa9e9c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 02:36:09 GMT
content-encoding: gzip
age: 3061048
x-cache: Hit from cloudfront
content-length: 28013
x-amz-meta-git_commit: 7b120a5
last-modified: Wed, 11 Aug 2021 20:29:14 GMT
server: AmazonS3
etag: "4675e7fa49e7c0ac9234b8fdf094591d"
x-amz-version-id: 7LhAmE_DVksgARINqWh9rINHREPkIDVQ
via: 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: YyVHTmKPQZEq05e9D3WeOu0S5iBezUd0pAdcr_BLaYO9K3SjmjtLfw==

GET
H2 200 bl-39123b0-a4978625.js Show response
tagan.adlightning.com/valnet/ 122 KB
37 KB 8ms
8ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/valnet/bl-39123b0-a4978625.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e9369b1246a6b2dcc7768899b1887d3b16991218f3732a629db9f55d6d78faa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 04:49:18 GMT
content-encoding: gzip
age: 29058
x-cache: Hit from cloudfront
content-length: 37836
x-amz-meta-git_commit: 39123b0
last-modified: Mon, 18 Apr 2022 04:28:04 GMT
server: AmazonS3
etag: "8ca4dffaf1d687783eb07fd02802bb9a"
x-amz-version-id: reaRH1lNCGi7YWHXf7MdprxfijFYPqG8
via: 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: b7akl8Lm6g3rNHgq7QxF2o9OQYpsC8h-iRuUDGdDZwvD9L38tPTaHw==

GET
H/1.1 200
OK count-data.js Show response
androidpolice.disqus.com/ 925 B
1 KB 124ms
124ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://androidpolice.disqus.com/count-data.js?2=https%3A%2F%2Fwww.androidpolice.com%2Facer-chromebook-514-cb514-2ht-review%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Famazon-luna-hands-on%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fanalogue-pocket-review%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fandroid-tv-13-could-reduce-power-bandwidth-consumption-smart-tv%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fclubhouse-in-room-gaming%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Feverything-new-in-googles-latest-pixel-feature-drop%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fgalaxy-watch4-wearos-tutorial-skip%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fhow-to-install-netflix-mobile-games-on-android%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fhow-to-stream-mlb-opening-day%2F

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b93847bd3e772bf892656b4d330d6ef31c5fe45e0dc36b6e013e269179842288

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:36 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary: Accept-Encoding
Cache-Control: public, max-age=600
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Type: application/javascript; charset=UTF-8
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 925
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK count-data.js Show response
androidpolice.disqus.com/ 1 KB
2 KB 132ms
117ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://androidpolice.disqus.com/count-data.js?2=https%3A%2F%2Fwww.androidpolice.com%2Fiqoo-9-pro-review%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fnvidia-shield-pro-2019-review%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Foddict-twig-pro-earbuds-review%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fsamsung-expert-raw-creators-explain-behind-the-scenes-of-app-making%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fsamsung-galaxy-s21-fe-is-150-off-right-now%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fsamsung-galaxy-tab-s8-ultra-review%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fsamsungs-newest-chromebook-for-school-packs-a-mighty-display-in-a-modest-body%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fsony-ht-a7000-sound-bar-review%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fthe-android-police-podcast-is-back%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Ftwitter-edit-button-interface-first-look%2F

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4d55a5de2de1619c7f59562b161f71c2446c671f6380ec56cbf62f08e6ed67b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:36 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary: Accept-Encoding
Cache-Control: public, max-age=600
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Type: application/javascript; charset=UTF-8
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 1166
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK count-data.js Show response
androidpolice.disqus.com/ 513 B
1 KB 22ms
7ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://androidpolice.disqus.com/count-data.js?2=https%3A%2F%2Fwww.androidpolice.com%2Fweekend-poll-which-rumored-gadget-are-you-most-excited-to-see-at-google-io%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fwhatsapp-easier-to-share-your-profile-with-others%2F&2=https%3A%2F%2Fwww.androidpolice.com%2Fwindows-11-android-apps-review%2F

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

483a7f118083f3e8a3dd158b2cd95fb6cb420486d0ee4ab2a0876bb78d0ba11f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:36 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 3270
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary: Accept-Encoding
Cache-Control: public, max-age=600
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Type: application/javascript; charset=UTF-8
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 513
X-XSS-Protection: 1; mode=block

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 2 KB
2 KB 10ms
10ms XHR
application/json 143.204.95.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3741&u=https%3A%2F%2Fwww.androidpolice.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-188.fra50.r.cloudfront.net
Software: Server /
Resource Hash: d26722e46b6160f5002ed50941243b07040e2b9b84481688c7256d4fb742684d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 11:42:12 GMT
via: 1.1 b44e2902bb3501d47514e51618f1bda4.cloudfront.net (CloudFront)
server: Server
age: 4283
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.androidpolice.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
content-length: 1961
x-amz-cf-id: 4uKEw7jJDwcsyJY1VDDkNCm1X7phTfbIT-gETsKpkFOr4YROcaI8ow==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 24ms
8ms XHR
application/javascript 143.204.95.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-188.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: khsXo6Z3HSo5bHNWbmb1eMp88IHhxPc.
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 42212
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 17 Mar 2022 02:21:48 GMT
server: AmazonS3
date: Mon, 18 Apr 2022 01:30:36 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 ba77f90aac0ddbc2c4c2c02062fac762.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: Emn3ZQT8Fw5BVTYNsmbWyBhjywxSwbjBezdZFlk11wsBL3v1bsOj9A==

POST
H2 200 page Show response
t.skimresources.com/api/v2/ 22 B
344 B 45ms
45ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/page

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/85009X1537243.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 22

POST
H2 200 link Show response
t.skimresources.com/api/v2/ 22 B
114 B 47ms
47ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/link

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/85009X1537243.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
warning: 299 - "Deprecated API"
alt-svc: clear
content-length: 22

GET
H2 200 acv.json Show response
scarfsmash.com/ 210 KB
46 KB 65ms
21ms Fetch
application/json 35.186.249.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://scarfsmash.com/acv.json

Requested by

Host: scarfsmash.com
URL: https://scarfsmash.com/v2yvlzsveWtgqGFXj2wU3ajphon_Qq9myt1bClE9dnFgPWVzuw4LojxURFEzFAfp8GOJdYROXlGZLTg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.249.84 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

84.249.186.35.bc.googleusercontent.com

Software

Resource Hash

6e75948ee66bf6e7da9235ee5cecbda03fa7f592a3f08193757202be43d6cb38

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; preload
content-encoding: br
last-modified: Fri, 15 Apr 2022 19:31:28 GMT
x-datacenter: gce-europe-west1
date: Mon, 18 Apr 2022 12:53:36 GMT
vary: Accept-Encoding, Origin
x-hostname: fen-hoothoot-europe-west1-spot-97sw
content-type: application/json
access-control-allow-origin: https://www.androidpolice.com
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
x-buildnumber: 516110284
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
accept-ranges: bytes

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 66ms
7ms Image
image/gif 2600:9000:2156:600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 16:14:35 GMT
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0996.cloudfront.net (CloudFront)
age: 22019942
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: FmoFTjTAbtBOIZL1aFUcWa1yW6PJn2-s0zSsp2Jl8F8sZqO0besDlg==

POST
H2 200 publisher:getClientId Show response
ampcid.google.com/v1/ 74 B
536 B 147ms
45ms XHR
application/json 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.androidpolice.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 94
x-xss-protection: 0

GET
H2 200 pubads_impl_2022041201.js Show response
securepubads.g.doubleclick.net/gpt/ 369 KB
126 KB 104ms
33ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041201.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

ae1662349ff25bf23f2d8c4d4affd74d2531892eac8dabfd7a05d80459c36583

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:51:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 140
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127945
x-xss-protection: 0
last-modified: Tue, 12 Apr 2022 08:36:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 18 Apr 2023 12:51:16 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 329 B
797 B 123ms
41ms XHR
application/json 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.androidpolice.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

7ea26c2e155afa821d8a157303a6dc302c9d1740b36ae5313f0ece87a60c1e8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 161
x-xss-protection: 0
expires: Mon, 18 Apr 2022 12:53:36 GMT

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204060102/ 302 KB
108 KB 66ms
65ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204060102/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8382598503519971&plah=www.androidpolice.com&bust=31067063

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

344437e4071c5e832f8c1c0d53b7de623d956c8e9b3330b6393a73d55f268bd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110295
x-xss-protection: 0
server: cafe
etag: 8108447729010256826
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 18 Apr 2022 12:53:36 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220413/r20190131/ Frame 9D49 10 KB
5 KB 120ms
36ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220413/r20190131/zrt_lookup.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

340b20f9ff6d073c2fea911631d8a6e13af185d983cbe842ddca27df91d0f295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 57261
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4398
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 17 Apr 2022 20:59:15 GMT
etag: 14837630671339829333
expires: Sun, 01 May 2022 20:59:15 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ats.js Show response
ats.rlcdn.com/ 110 KB
38 KB 35ms
8ms Script
application/x-javascript 143.204.98.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ats.rlcdn.com/ats.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-49.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 07da28929f6d4cb8894de074ff1ae095860bf6686c7bb3024168c6c8e5e65ad8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: VE.TmwhV1._nzA5UkJnv.qeHE6SJ9zlu
content-encoding: gzip
etag: W/"d03ceb6300ba5d767156d2d186bfc621"
age: 33975
x-amz-server-side-encryption: AES256
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:eu-west-1:469675294282:build/ATSLibrary-prod:d9620690-a522-4865-bdcf-c40a5e58864a
x-cache: Hit from cloudfront
x-amz-meta-codebuild-content-md5: 229018ce14d22cf5d355aa4c24ac99ff
last-modified: Thu, 07 Apr 2022 09:05:05 GMT
server: AmazonS3
date: Mon, 18 Apr 2022 03:27:22 GMT
vary: Accept-Encoding
x-amz-meta-codebuild-content-sha256: 37cf43d799bffc4fdad3431bef2fdbc097a3382eab6b0735d08d25e96b4565dc
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0996.cloudfront.net (CloudFront)
cache-control: must-revalidate,public,max-age=86400
x-amz-cf-pop: FRA50-C1
content-type: application/x-javascript
x-amz-cf-id: TUfo5WU7AH0I3F_48WYnwecNCtDE5d63imMLQxiiXnm0tf-pHOzAXw==

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 53 KB
17 KB 59ms
7ms Script
application/javascript 104.89.31.187
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.31.187 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-31-187.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
last-modified: Tue, 01 Jun 2021 17:06:57 GMT
server: Apache
etag: "d398-5c3b75e9ebb41-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17087
expires: Mon, 18 Apr 2022 13:08:36 GMT

GET
H2 200 269 Show response
id.halo.ad.gt/api/v1/partner/ 6 KB
3 KB 523ms
171ms Script
text/javascript 35.85.185.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.halo.ad.gt/api/v1/partner/269?url=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&ref=https%3A%2F%2Ft.co%2F
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.85.185.37 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-85-185-37.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 4b3f9cfb0906d42c830920a7a3421e88209843ed315abea5069b32ccd2b23a1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
origin-trial
server: nginx/1.20.0
content-type: text/javascript; charset=UTF-8

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 40 KB
11 KB 45ms
9ms Script
text/javascript 46.105.202.126
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

46.105.202.126 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

9476350068dbd8b61373906f6d9dba49ed31ed5d64d6ee2d48da082c44a447dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
x-cacheable: Matched cache
x-cdn-pop-ip: 137.74.120.0/27
date: Mon, 18 Apr 2022 12:50:32 GMT
content-type: text/javascript;charset=utf-8
cache-control: max-age=3600
x-cdn-pop: sbg
content-disposition: attachment;filename="id5-api.js"
accept-ranges: bytes
content-length: 11181
x-request-id: 920553357

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
66 KB 54ms
53ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6Y5Q4PR4RC&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PQPCZ5S

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

718ec297d21980282f853ebe81a67e1cce9c6fce3c4770d81bf092172bd21ad1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67149
x-xss-protection: 0
expires: Mon, 18 Apr 2022 12:53:36 GMT

GET
H2

200

web-vitals.iife.js Show response
unpkg.com/web-vitals@2.1.4/dist/
Redirect Chain

https://unpkg.com/web-vitals/dist/web-vitals.iife.js
https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.iife.js

4 KB
2 KB

20ms
19ms

Script
application/javascript

2606:4700::6810:7eaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.iife.js

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Server

2606:4700::6810:7eaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ad3e1ebf36f4d5375c097486e514befc0294cf035eb492965b32a3274e6fed0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7555255
fly-request-id: 01FSX6GHGPB2EH0VVPC2K82F2X
content-encoding: br
vary: Accept-Encoding
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"114c-NCNEyA/dMQ5L7XGqd2v2QNXHero"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6fdd8b5a2cda9956-FRA

Redirect headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01G0YBNPRVVB8QC2RQ693DND3N-fra
server: cloudflare
age: 124
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
location: /web-vitals@2.1.4/dist/web-vitals.iife.js
cache-control: public, s-maxage=600, max-age=60
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6fdd8b5778b09956-FRA
access-control-allow-origin: *

GET
H2 200 8uhibhcqnt Show response
www.clarity.ms/tag/ 710 B
1 KB 280ms
164ms Script
application/x-javascript 2620:1ec:27::cafe:1784
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/8uhibhcqnt?ref=gtm2
Requested by: Host: t.co
URL: https://t.co/rtD3aeKMSb
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:27::cafe:1784 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: a75813b4201c02796e8facc83473c8434ba838e9d3da66eef6e9bc2d1ac14b9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
x-powered-by: ASP.NET
x-azure-ref: 0UF9dYgAAAAD9MJBHTpacSpKmmcR/rpaASVNUMzBFREdFMDIxMQA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
expires: -1
cache-control: no-cache, no-store
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

POST
H2 200 api Show response
ls.skimresources.com/ 2 B
350 B 105ms
43ms XHR
application/json 34.120.117.212
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ls.skimresources.com/api

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/85009X1537243.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.117.212 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

212.117.120.34.bc.googleusercontent.com

Software

Python/3.8 aiohttp/3.6.3 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type: application/json

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.8 aiohttp/3.6.3
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 2

OPTIONS
H2 206 api
ls.skimresources.com/ Frame 0
0 119ms
40ms Preflight
text/plain 34.120.117.212
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ls.skimresources.com/api
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.117.212 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 212.117.120.34.bc.googleusercontent.com
Software: Python/3.8 aiohttp/3.6.3 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.androidpolice.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.androidpolice.com
access-control-max-age: 1728000
alt-svc: clear
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 18 Apr 2022 12:53:36 GMT
server: Python/3.8 aiohttp/3.6.3
via: 1.1 google

GET
H2 200 primisslate.css
live.primis.tech/content/video/css/ 18 KB
18 KB 43ms
43ms Stylesheet
text/css 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/css/primisslate.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 616f41fbbcf44ba72bb9c97132871526164c81d78f56a15e04ece1a44eb5606a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
last-modified: Wed, 09 Feb 2022 07:06:30 GMT
server: nginx
x-amz-cf-pop: DUS51-P2
etag: "620367f6-465a"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 18010
x-amz-cf-id: Efn6_vTQloa1_2Pc2oSz4eUQgeeglQx8l84U9YsWhCmRMH49OfwyKg==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 8112 135 KB
37 KB 8ms
8ms Script
application/javascript 143.204.95.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30342D31385F31357D7B7331363734393939317D7B4335377D7B5359584174636D566E4C5739795A313933643363755957356B636D39705A48427662476C6A5A53356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583630307D7B593333387D7B66317D7B4C31313433337DFEFE&userIpAddr=2a03%3A1b20%3A6%3Af011%3A%3A6e&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F100.0.4896.75+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=40&c2pWaitTime=5&isSinglePageFloatSupport=0&csuuid=625d5f503d373&debugInfo=16749991_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=16749991&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2a4dzjowrqnk&secondaryContent=&x=600&y=338&pubUrl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=0&flow_bottomOffset=0&impGap=1&flow_width=340&flow_height=192&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=11433&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=ap-reg-org_www.androidpolice.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-188.fra50.r.cloudfront.net
Software: Server /
Resource Hash: 1909b2a83fd41494d94862c4323944d9d0aa1f1e653f252ea5a73fc5944308b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: 6RTeJ.t3xDSJXjTxhAMtPfr9IcIsozAE
content-encoding: gzip
etag: 4abd427e43cd6822329a2c05539e321f
age: 95
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 09TS5V8FVP8NQ9SDQHGM
date: Mon, 18 Apr 2022 12:52:44 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 b44e2902bb3501d47514e51618f1bda4.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: lndD77OSOtubPWCwcTli678M3HiMA8x7bAzx0b_3EyKz2BmTTyeL0Q==

GET
H2 200 css
fonts.googleapis.com/ 1 KB
933 B 139ms
49ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins&display=swap

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e6ac25d541d15d00d8ac79cbb7e6f917732a768e2a187f5cf1ce2c255c7cec07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 18 Apr 2022 11:35:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 18 Apr 2022 12:53:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Apr 2022 12:53:37 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 61E4 15 KB
6 KB 52ms
9ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=82959
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Mon, 18 Apr 2022 12:53:36 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Tue, 19 Apr 2022 11:56:15 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2

200

liveCS.php Show response
live.primis.tech/live/ Frame 2367
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D94%26advUuid%3D%24...
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D94%26advUuid%3D%24...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=94&advUuid=901fa428-bf16-11ec-a358-1d7abbad0206

0
332 B

24ms
24ms

Document
text/html

2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=94&advUuid=901fa428-bf16-11ec-a358-1d7abbad0206
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 0
cache-control: no-store
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 12:53:36 GMT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
pragma: no-cache
server: nginx
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
x-amz-cf-id: xQtUTkOUF36mB1GjyQ2I_sJom6u4KadOhsBVF2ncL1nl6cV9bgKgWQ==
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront

Redirect headers

Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
Content-Type: text/plain
Date: Mon, 18 Apr 2022 12:53:37 GMT
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=94&advUuid=901fa428-bf16-11ec-a358-1d7abbad0206
Server: nginx
X-fe: 116

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 7B88 43 B
305 B 121ms
50ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D98%26advUuid%3D
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/18.0.0 /
Resource Hash: e963e7196beb9123059ec3534b042ebcd1ef0a470fa568bfbebfeab2f33c4fda

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-length: 56
content-type: text/html
date: Mon, 18 Apr 2022 12:53:37 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: OXGW/18.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame 9EF0 2 KB
1 KB 113ms
15ms Document
text/html 2a0c:5c81:5095:0:225:90ff:fefa:245d
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5095:0:225:90ff:fefa:245d London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: f9cb9f7bd06d68d6a2cd9c9f52d0e49a3199a57a7bc6ce9bc22f881af21d8004

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www.androidpolice.com
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 896
Content-Type: text/html; charset=UTF-8
Date: Mon, 18 Apr 2022 12:53:36 GMT
Server: Adtelligent
X-Robots-Tag: noindex

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 8112 34 KB
6 KB 67ms
67ms XHR
application/json 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNlUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMDt3NSUlRaZcZGViXmYkMmVwM2FyNDYlODx1MmplOTx5OTpyMxZ2nWQ2MTM1Y2RwMDU0NmNwMwt0ODpkNwU0Lz1jNCZ2nWRsY29hqGVhqF9cZD0kODA3NDM2JaZcZF9wo250ZW50X2Ryp2M9Q3VmqG9gnXccozpeqGuyK0quoGF4rSgTMwEeVWk0pzEyM0EeoWFenW5aK2y0K21cozUzqzyxX2NioaRyoaRsqGy0oGU9Q3VmqG9gnXccozpeqGuyK0quoGF4rSgTMwEeVWk0pzEyM0EeoWFenW5aK2y0K21cozUzqzyxX2NioaRyoaRsZHVlYXRco249MwxmJzRyYaVaSW5zo3JgYXRco249Jat9NwAjJax9MmM4JaB1YyVloD1bqHRjplUmQSUlRvUlRaq3ql5uozRlo2yxpG9fnWNyLzNioSUlRzuuY2gypaMgqzkwLW1uoHqupzUyMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMwJEMmAmNDJEMmEmODVGMmEmNTqEN0I3MmMkMmYmNmM0MmxmOTM5MmE3RDqCNDMmNTM3N0Q3QwUmNTx1ODQkNmQ2MmZENTY2RTRDNTpmOTp5NUEmMTM5MmM2NDMmNwM3NTU5NTpmNTZCNwM2RDM5NmA1QTQ4NDI3NwYlNDp2QmZBNUE1MmM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwMjMmA3RDqCNTxmMmMmMmt3RDqCNwYmMTqEN0I0QmMkMmEmNDMmMmM3REZFRxUznXNBpHA9MCZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lYTAmJTNBMWIlMCUmQTYyM0FzMDEkJTNBJTNBNzUzqXNypyVBPU1irzyfoGEyMxY1LwAeJTI4V2yhZG93plgOVCfkMC4jJTNCK1qcowY0JTNCK3t2NCUlOSgBpHBfZVqyYxgcqCUlRwUmNl4mNvfyMwuLSFRNTCUlQlgfnWgyK0qyY2giJTI5K0Nbpz9gZSUlRwEjMC4jLwQ4OTYhNmUeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZwp3V1nWQ9NwI1ZDVzNTAmZDM3MlZwYaVmqGVlPTE2NTAlODY0MTY5MmYzZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MA==
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30342D31385F31357D7B7331363734393939317D7B4335377D7B5359584174636D566E4C5739795A313933643363755957356B636D39705A48427662476C6A5A53356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583630307D7B593333387D7B66317D7B4C31313433337DFEFE&userIpAddr=2a03%3A1b20%3A6%3Af011%3A%3A6e&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F100.0.4896.75+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=40&c2pWaitTime=5&isSinglePageFloatSupport=0&csuuid=625d5f503d373&debugInfo=16749991_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=16749991&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2a4dzjowrqnk&secondaryContent=&x=600&y=338&pubUrl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=0&flow_bottomOffset=0&impGap=1&flow_width=340&flow_height=192&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=11433&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=ap-reg-org_www.androidpolice.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 59a16e2c5c3e0462cd3e8cd364d0de38b9fe2c4cc7a333873e3b98a4fa4fdf7b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-store
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-P2
content-type: application/json; charset=utf-8
content-length: 5263
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
x-amz-cf-id: 00MHvzEJ5zDID8gvufFVakorljNN25IYTHcfjKoJYG4jcIBx7oulPA==

GET
H2 200 logo_11433.png
video.primis.tech/uploads/video/users/logo/30875/ 1 KB
2 KB 39ms
8ms Image
image/png 63.250.60.64
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/video/users/logo/30875/logo_11433.png?cbuster=1631179290
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.60.64 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 2d982a78b1da56ba84ff4f57aad9715cef56b27e56f4ed18f5b831a0f4d7d2e6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 735196fd5afd6302b77cda2a15be051e.cloudfront.net (CloudFront)
last-modified: Thu, 09 Sep 2021 09:21:30 GMT
server: Tengine
x-amz-cf-pop: BRU50-C1
etag: "8aa2d39c821a27affdb7f7a98e4b58a2"
content-type: image/png
access-control-allow-origin: *
expires: Mon, 02 May 2022 12:53:36 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 1239
x-amz-cf-id: 1jraA2IMCbDOmk-Q29d0POAN8WtGaYWxRl1yZT_5Bi85amtoWhZoyg==
x-proxy-cache: HIT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
356 B 50ms
50ms Image
text/html 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTUjJaNypaZypyRcoWU9MTY1MDI4NwQkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA4NTAjJaN0YT0jJat9NwAjJax9MmM4JaZcZF9jYXNmRG9gYWyhPXq3ql5uozRlo2yxpG9fnWNyLzNioSZmqWJJZD1upC1lZWpgo3JaX3q3ql5uozRlo2yxpG9fnWNyLzNioSZxZWJ1Z0yhZz9loWF0nW9hPSZcp0FjpD0jJaJcPTZDNwx3NwY1NTM3NDYkNmQ3MmqDNmM2QwMkN0I1NDMjN0Q3QwY0MmImMDMlMmIlRDMjMmQlRDMkMmt1RwMkMmU3RDqCNmMmMTM2MmpmNDM5MmxmOTMkN0Q3QwQmMmUmNmqEN0I1MmU5NTt0MTp0NwM2RDU2NxU0QmU3Mmx3OTVBMmEmOTMmNwQmMmYmNmU1OTU3MmU2QwYmNxQmOTpjNUE0ODQlNmY2MwQ3NxM2QTVBNTMmNTZBNwImMwMjM0Q3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmYmMDMjN0Q3QwU5MmMmMmM4N0Q3QwY2MmE3RDqCNEMmMTMkMmQmMmMmN0RGRUZFJzRcYWyxPSZ1p2VlSXBBZGRlPTJuMDMyM0EkYwIjJTNBNvUmQWYjMTEyM0EyM0E2ZSZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMDAhMC40ODx2Lwp1JTIjU2FzYXJcJTJGNTM3LwM2JzNmqXVcZD02MwVxNWY1MDNxMmpmJzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2NTAlODY0MTY5MwAzqWyxPVNyn2yhZG9TUGkurWVlNwI1ZDVzNTA1MTp4MCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phYW5xpz9cZHBioGywZS5wo20yMxZbYWNeZXJmLXZfYl1gYWk3YXJyJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-pop: DUS51-P2
content-type: text/html; charset=UTF-8
x-amz-cf-id: UIsHA0Pv__ux8SQnsvPT5iSDbLOTYFguCzV9S0jyHKptBVc69lrUUA==

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 8112 43 B
220 B 150ms
8ms Image
image/gif 35.158.225.181
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=sekindo&gdpr=1&gdpr_consent=
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.225.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-225-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:37 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 8112
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D
https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=93&advUuid=0d40b5f9-427c-4b8f-b38e-29ec89dd29f1

0
332 B

24ms
24ms

Image
text/html

2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=93&advUuid=0d40b5f9-427c-4b8f-b38e-29ec89dd29f1
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-pop: DUS51-P2
content-type: text/html; charset=utf-8
x-amz-cf-id: Ls8Cdv5a-1oCSKR_Dlr471h2QAfxB9s32i0HjUAQJrTG5jO6PVLGdg==

Redirect headers

location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=93&advUuid=0d40b5f9-427c-4b8f-b38e-29ec89dd29f1
date: Mon, 18 Apr 2022 12:53:36 GMT
server: _
content-length: 0

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 8112
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=192962&cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D99%26advUuid%3D
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D99%26advUuid%3D&s=192962&C=1
https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=99&advUuid=Yl1fUAXpC-7TJacXbW-QhgAABFkAAAIB

0
334 B

23ms
23ms

Image
text/html

2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=99&advUuid=Yl1fUAXpC-7TJacXbW-QhgAABFkAAAIB
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-pop: DUS51-P2
content-type: text/html; charset=utf-8
x-amz-cf-id: M0MdwvTFGrMKpZk0wtIYbaej5YwzZ_kIXnQPDd-kXcx2MKp9LKBzdw==

Redirect headers

Pragma: no-cache
Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=99&advUuid=Yl1fUAXpC-7TJacXbW-QhgAABFkAAAIB
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 334
Expires: Mon, 18 Apr 2022 12:53:37 GMT

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 8112
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3Dhttps%253A%252F%252Fsync.intentiq.com%252Fprofiles_engine%252FProfilesEngineServl...
https://eb2.3lift.com/getuid?ld=1&gdpr=1&cmp_cs=&us_privacy=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3Dhttps%253A%252F%252Fsync.intentiq.com%252Fprofile...
https://live.primis.tech/live/liveCS.php?source=external&pixel=https%3A%2F%2Fsync.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26mi%3D10%26dpi%3D259151345%26pcid%3D4717929926806...

0
334 B

25ms
24ms

Image
text/html

2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&pixel=https%3A%2F%2Fsync.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26mi%3D10%26dpi%3D259151345%26pcid%3D4717929926806835954726&advId=121&advUuid=4717929926806835954726
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-pop: DUS51-P2
content-type: text/html; charset=utf-8
x-amz-cf-id: L8wUxe0WMsAGqCt_zA5Gll3w2yxNEX44KKAZuPMTCrlp_FDQj8G40Q==

Redirect headers

location: https://live.primis.tech/live/liveCS.php?source=external&pixel=https%3A%2F%2Fsync.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26mi%3D10%26dpi%3D259151345%26pcid%3D4717929926806835954726&advId=121&advUuid=4717929926806835954726
date: Mon, 18 Apr 2022 12:53:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 8112 0
239 B 43ms
11ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=primis
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type: image/gif

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 8112
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D105%26advUuid%3D%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Flive.primis.tech%252Flive%252FliveCS.php%253Fsource%253Dexternal%2526csuuid%253D625d5f503d373%2526pixel%253D%2526advId%253D105%2526ad...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=105&advUuid=7389662982991471923

0
333 B

25ms
25ms

Image
text/html

2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=105&advUuid=7389662982991471923
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-pop: DUS51-P2
content-type: text/html; charset=utf-8
x-amz-cf-id: f1mvIqHT_mJN9Gl4lynkr2_BRcIccjA8CV9wVYGLrvu7Psd1jyjtAQ==

Redirect headers

Pragma: no-cache
Date: Mon, 18 Apr 2022 12:53:37 GMT
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 782e6e26-36d9-4087-b701-104fd4074192
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=625d5f503d373&pixel=&advId=105&advUuid=7389662982991471923
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

verify
60687.publishers.tremorhub.com/pubsync/ Frame 8112
Redirect Chain

https://60687.publishers.tremorhub.com/pubsync?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3Dhttps%253A%252F%252Fsync.intentiq.com%...
https://60687.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3Dhttps%253A%252F%252Fsync.intent...

43 B
182 B

101ms
101ms

Image
image/gif

2600:1f18:612b:4200:fed4:35ed:3821:843c
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://60687.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3Dhttps%253A%252F%252Fsync.intentiq.com%252Fprofiles_engine%252FProfilesEngineServlet%253Fat%253D20%2526mi%253D10%2526dpi%253D%2B584182936%2526pcid%253D%5Btvid%5D%26advId%3D126%26advUuid%3D%5Btvid%5D
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 2600:1f18:612b:4200:fed4:35ed:3821:843c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

Redirect headers

location: pubsync/verify?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3Dhttps%253A%252F%252Fsync.intentiq.com%252Fprofiles_engine%252FProfilesEngineServlet%253Fat%253D20%2526mi%253D10%2526dpi%253D%2B584182936%2526pcid%253D%5Btvid%5D%26advId%3D126%26advUuid%3D%5Btvid%5D
date: Mon, 18 Apr 2022 12:53:37 GMT
server: Apache-Coyote/1.1
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'

GET
H2 200 vid6135cdc05473c284871654.jpg
video.primis.tech/uploads/cn7/video/users/converted/30875/video_6135c3ae46289537299997/ 14 KB
14 KB 14ms
13ms Image
image/jpeg 63.250.60.64
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn7/video/users/converted/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.jpg?cbuster=1630916037
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.60.64 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 63f40bc64828be3f87721479e2a3dc1ca58fc088087021e85d17954ef95d9deb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
via: 1.1 cfa647edefc0769e715b9781478b0626.cloudfront.net (CloudFront)
last-modified: Mon, 06 Sep 2021 08:15:12 GMT
server: Tengine
x-amz-cf-pop: FRA60-P4
etag: "172ddec951692c6d3109b238118cae9c"
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 02 May 2022 12:53:36 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 14073
x-amz-cf-id: H78RxQ48EP80hPrK8J4P2pFcpW-3fIcSfroggrmH2QOw7ZXp0UhWDg==
x-proxy-cache: HIT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 8112 260 KB
22 KB 87ms
86ms XHR
application/json 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNlUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMDt3NSUlRaZcZGViXmYkMmVwM2FyNDYlODx1MmplOTx5OTpyMxZ2nWQ2MTM1Y2RwMDU0NmNwMwt0ODpkNwU0Lz1jNCZ2nWRsY29hqGVhqF9cZD0kODA3NDM2JaZcZF9wo250ZW50X2Ryp2M9Q3VmqG9gnXccozpeqGuyK0quoGF4rSgTMwEeVWk0pzEyM0EeoWFenW5aK2y0K21cozUzqzyxX2NioaRyoaRsqGy0oGU9Q3VmqG9gnXccozpeqGuyK0quoGF4rSgTMwEeVWk0pzEyM0EeoWFenW5aK2y0K21cozUzqzyxX2NioaRyoaRsZHVlYXRco249MwxmJzRyYaVaSW5zo3JgYXRco249Jat9NTAjJax9MwtkJaB1YyVloD1bqHRjplUmQSUlRvUlRaq3ql5uozRlo2yxpG9fnWNyLzNioSUlRzuuY2gypaMgqzkwLW1uoHqupzUyMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMwJEMmAmNDJEMmEmODVGMmEmNTqEN0I3MmMkMmYmNmM0MmxmOTM5MmE3RDqCNDMmNTM3N0Q3QwUmNTx1ODQkNmQ2MmZENTY2RTRDNTpmOTp5NUEmMTM5MmM2NDMmNwM3NTU5NTpmNTZCNwM2RDM5NmA1QTQ4NDI3NwYlNDp2QmZBNUE1MmM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwMjMmA3RDqCNTxmMmMmMmt3RDqCNwYmMTqEN0I0QmMkMmEmNDMmMmM3REZFRxUznXNBpHA9MCZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lYTAmJTNBMWIlMCUmQTYyM0FzMDEkJTNBJTNBNzUzqXNypyVBPU1irzyfoGEyMxY1LwAeJTI4V2yhZG93plgOVCfkMC4jJTNCK1qcowY0JTNCK3t2NCUlOSgBpHBfZVqyYxgcqCUlRwUmNl4mNvfyMwuLSFRNTCUlQlgfnWgyK0qyY2giJTI5K0Nbpz9gZSUlRwEjMC4jLwQ4OTYhNmUeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZwp3V1nWQ9NwI1ZDVzNTAmZDM3MlZwYaVmqGVlPTE2NTAlODY0MTY5NTAzZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MA==
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30342D31385F31357D7B7331363734393939317D7B4335377D7B5359584174636D566E4C5739795A313933643363755957356B636D39705A48427662476C6A5A53356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583630307D7B593333387D7B66317D7B4C31313433337DFEFE&userIpAddr=2a03%3A1b20%3A6%3Af011%3A%3A6e&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F100.0.4896.75+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=40&c2pWaitTime=5&isSinglePageFloatSupport=0&csuuid=625d5f503d373&debugInfo=16749991_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=16749991&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2a4dzjowrqnk&secondaryContent=&x=600&y=338&pubUrl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=0&flow_bottomOffset=0&impGap=1&flow_width=340&flow_height=192&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=11433&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=ap-reg-org_www.androidpolice.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: abb98339ec7c9f02553339d938dad9af771257631486dca1cddba19f79d8880b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-store
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-P2
content-type: application/json; charset=utf-8
content-length: 21725
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
x-amz-cf-id: bEJCKE2laYrRYAjLlR-3WhfPNdhPGhC3oCT-pLVYZP5boXCH9aD38w==

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 8112 122 KB
11 KB 91ms
91ms XHR
application/json 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNlUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMDt3NSUlRaZcZGViXmYkMmVwM2FyNDYlODx1MmplOTx5OTpyMxZ2nWQ2MTM1Y2RwMDU0NmNwMwt0ODpkNwU0Lz1jNCZ2nWRsY29hqGVhqF9cZD0kODA3NDM2JaZcZF9wo250ZW50X2Ryp2M9Q3VmqG9gnXccozpeqGuyK0quoGF4rSgTMwEeVWk0pzEyM0EeoWFenW5aK2y0K21cozUzqzyxX2NioaRyoaRsqGy0oGU9Q3VmqG9gnXccozpeqGuyK0quoGF4rSgTMwEeVWk0pzEyM0EeoWFenW5aK2y0K21cozUzqzyxX2NioaRyoaRsZHVlYXRco249MwxmJzRyYaVaSW5zo3JgYXRco249Jat9MmQjJax9MTxkJaB1YyVloD1bqHRjplUmQSUlRvUlRaq3ql5uozRlo2yxpG9fnWNyLzNioSUlRzuuY2gypaMgqzkwLW1uoHqupzUyMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMwJEMmAmNDJEMmEmODVGMmEmNTqEN0I3MmMkMmYmNmM0MmxmOTM5MmE3RDqCNDMmNTM3N0Q3QwUmNTx1ODQkNmQ2MmZENTY2RTRDNTpmOTp5NUEmMTM5MmM2NDMmNwM3NTU5NTpmNTZCNwM2RDM5NmA1QTQ4NDI3NwYlNDp2QmZBNUE1MmM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwMjMmA3RDqCNTxmMmMmMmt3RDqCNwYmMTqEN0I0QmMkMmEmNDMmMmM3REZFRxUznXNBpHA9MCZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lYTAmJTNBMWIlMCUmQTYyM0FzMDEkJTNBJTNBNzUzqXNypyVBPU1irzyfoGEyMxY1LwAeJTI4V2yhZG93plgOVCfkMC4jJTNCK1qcowY0JTNCK3t2NCUlOSgBpHBfZVqyYxgcqCUlRwUmNl4mNvfyMwuLSFRNTCUlQlgfnWgyK0qyY2giJTI5K0Nbpz9gZSUlRwEjMC4jLwQ4OTYhNmUeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZwp3V1nWQ9NwI1ZDVzNTAmZDM3MlZwYaVmqGVlPTE2NTAlODY0MTY5NTEzZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MA==
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30342D31385F31357D7B7331363734393939317D7B4335377D7B5359584174636D566E4C5739795A313933643363755957356B636D39705A48427662476C6A5A53356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583630307D7B593333387D7B66317D7B4C31313433337DFEFE&userIpAddr=2a03%3A1b20%3A6%3Af011%3A%3A6e&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F100.0.4896.75+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=40&c2pWaitTime=5&isSinglePageFloatSupport=0&csuuid=625d5f503d373&debugInfo=16749991_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=16749991&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2a4dzjowrqnk&secondaryContent=&x=600&y=338&pubUrl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=0&flow_bottomOffset=0&impGap=1&flow_width=340&flow_height=192&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=11433&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=ap-reg-org_www.androidpolice.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 75919955645a9682fe4bee98b1315198fef7ba09b5d6a6e67b78221fad6f0b72

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-store
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-P2
content-type: application/json; charset=utf-8
content-length: 11218
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
x-amz-cf-id: wscIckmzrRkrg2SgJhYgLWP8v-AuEHb7ppoqpOjP8r5Nx-DLP5M_pQ==

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 8112 42 KB
6 KB 51ms
51ms XHR
application/json 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNlUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMDt3NSUlRaZcZGViXmYkMmVwM2FyNDYlODx1MmplOTx5OTpyMxZ2nWQ2MTM1Y2RwMDU0NmNwMwt0ODpkNwU0Lz1jNCZ2nWRsY29hqGVhqF9cZD0kODA3NDM2JaZcZF9wo250ZW50X2Ryp2M9Q3VmqG9gnXccozpeqGuyK0quoGF4rSgTMwEeVWk0pzEyM0EeoWFenW5aK2y0K21cozUzqzyxX2NioaRyoaRsqGy0oGU9Q3VmqG9gnXccozpeqGuyK0quoGF4rSgTMwEeVWk0pzEyM0EeoWFenW5aK2y0K21cozUzqzyxX2NioaRyoaRsZHVlYXRco249MwxmJzRyYaVaSW5zo3JgYXRco249Jat9NTAjJax9MwtkJaB1YyVloD1bqHRjplUmQSUlRvUlRaq3ql5uozRlo2yxpG9fnWNyLzNioSUlRzuuY2gypaMgqzkwLW1uoHqupzUyMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMwJEMmAmNDJEMmEmODVGMmEmNTqEN0I3MmMkMmYmNmM0MmxmOTM5MmE3RDqCNDMmNTM3N0Q3QwUmNTx1ODQkNmQ2MmZENTY2RTRDNTpmOTp5NUEmMTM5MmM2NDMmNwM3NTU5NTpmNTZCNwM2RDM5NmA1QTQ4NDI3NwYlNDp2QmZBNUE1MmM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwMjMmA3RDqCNTxmMmMmMmt3RDqCNwYmMTqEN0I0QmMkMmEmNDMmMmM3REZFRxUznXNBpHA9MCZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lYTAmJTNBMWIlMCUmQTYyM0FzMDEkJTNBJTNBNzUzqXNypyVBPU1irzyfoGEyMxY1LwAeJTI4V2yhZG93plgOVCfkMC4jJTNCK1qcowY0JTNCK3t2NCUlOSgBpHBfZVqyYxgcqCUlRwUmNl4mNvfyMwuLSFRNTCUlQlgfnWgyK0qyY2giJTI5K0Nbpz9gZSUlRwEjMC4jLwQ4OTYhNmUeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZwp3V1nWQ9NwI1ZDVzNTAmZDM3MlZwYaVmqGVlPTE2NTAlODY0MTY5NTEzZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MA==
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30342D31385F31357D7B7331363734393939317D7B4335377D7B5359584174636D566E4C5739795A313933643363755957356B636D39705A48427662476C6A5A53356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583630307D7B593333387D7B66317D7B4C31313433337DFEFE&userIpAddr=2a03%3A1b20%3A6%3Af011%3A%3A6e&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F100.0.4896.75+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=40&c2pWaitTime=5&isSinglePageFloatSupport=0&csuuid=625d5f503d373&debugInfo=16749991_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=16749991&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2a4dzjowrqnk&secondaryContent=&x=600&y=338&pubUrl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=0&flow_bottomOffset=0&impGap=1&flow_width=340&flow_height=192&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=11433&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=ap-reg-org_www.androidpolice.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 7f1aff18e0220f2872b307e783eb430317fbee8e32ac24dedba5bea3f9b89a05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-store
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-P2
content-type: application/json; charset=utf-8
content-length: 5593
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
x-amz-cf-id: 7v9m9ZgGvVCL2mSUukWorIef5AAXPr6neVSCv0OwRv71vSoG0nkRvw==

POST
H2 200 publisher:getClientId Show response
ampcid.google.de/v1/ 3 B
465 B 162ms
51ms XHR
application/json 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.androidpolice.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H2 200 session.html Show response
events.release.narrativ.com/api/v0/ Frame 46EB 713 B
1 KB 307ms
106ms Document
text/html 3.228.106.126
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://events.release.narrativ.com/api/v0/session.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.228.106.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-228-106-126.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

2dfb55c8cf1231157cf22e07888a514d894fb5605b2922e3ae0a231961929c86

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: private, max-age=7776000, must-revalidate, proxy-revalidate
content-length: 713
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 12:53:37 GMT
server: nginx/1.20.2
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-bam-build-version: 63c21d9982831d134ab44164cd70784f89423817
x-bam-env: release
x-robots-tag: none

OPTIONS
H2 200 PBJS
c2shb.pubgw.yahoo.com/admax/bid/partners/ Frame 0
0 66ms
9ms Preflight 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://www.androidpolice.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://www.androidpolice.com
access-control-max-age: 600
age: 0
content-length: 0
date: Mon, 18 Apr 2022 12:53:37 GMT
server: ATS/9.1.0.33

POST
H/1.1 204
No Content 318113 Show response
search.spotxchange.com/openrtb/2.3/dados/ Frame 8112 0
1 KB 199ms
36ms XHR
application/json 185.94.180.124
SPOTX-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://search.spotxchange.com/openrtb/2.3/dados/318113?src_sys=prebid
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_11.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 185.94.180.124 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 18 Apr 2022 12:53:37 GMT
X-SpotX-Timing-Transform: 0.000314
X-SpotX-Timing-SpotMarket: 0.004045
X-SpotX-Timing-Page-Mux: 0.000273
X-SpotX-Timing-Page-Require: 0.000355
X-fe: 040
Connection: keep-alive
X-SpotX-Timing-Page-Cookie: 0.000024
X-SpotX-Timing-Page: 0.020273
Pragma: no-cache
X-SpotX-Timing-Page-Context: 0.000356
Last-Modified: Mon, 18 Apr 2022 12:53:37 GMT
Server: nginx
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
X-SpotX-Timing-SpotMarket-Primary: 0.004045
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://www.androidpolice.com
X-SpotX-Timing-Page-Misc: 0.014890
X-SpotX-Timing-Page-Exception: 0.000001
X-SpotX-Timing-SpotMarket-Secondary: 0.000000
X-SpotX-Timing-Page-URI: 0.000015
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 8112 173 B
405 B 130ms
9ms XHR
application/json 18.196.159.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_11.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.159.207 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-159-207.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: ec18402893a21599c176380ba7c61edc2704117b770f9660d013feac23b8074e

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
content-encoding: gzip
x-prebid: pbs-java/1.86.0
content-type: application/json
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 166
expires: 0

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ Frame 8112 0
198 B 111ms
94ms XHR
text/plain 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_11.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.androidpolice.com
date: Mon, 18 Apr 2022 12:53:37 GMT
access-control-allow-credentials: true
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame 8112 19 B
727 B 120ms
86ms XHR
application/json 18.156.156.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=5.18.0&referrer=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&tmax=3000&gdpr=true

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_11.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.156.156.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-156-167.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
accept-ch: sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 8112 0
120 B 1161ms
159ms XHR
text/plain 204.237.133.116
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_11.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.237.133.116 West Chester, United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.androidpolice.com
date: Mon, 18 Apr 2022 12:53:38 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 / Show response
geo.privacymanager.io/ 30 B
594 B 42ms
9ms Fetch
application/json 18.66.248.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: ats.rlcdn.com
URL: https://ats.rlcdn.com/ats.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-107.dus51.r.cloudfront.net
Software: /
Resource Hash: e257df7266563e157bb7df93fd09c6d13afb1c9554468b21c7378e09a94d3250

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 17 Apr 2022 14:33:46 GMT
via: 1.1 4c692717a0e85914a993c3aa5c8a2ef6.cloudfront.net (CloudFront), 1.1 c31ad517510d586c0f2aa3c5dbc40b06.cloudfront.net (CloudFront)
age: 80391
x-amzn-requestid: f1e27d54-7166-414b-aaa1-5a5bf6b417a0
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-625c254a-3c48507b03970c7d0a440b13;Sampled=0
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-P3, DUS51-P1
x-amz-apigw-id: QurDnELJjoEFXXQ=
content-length: 30
x-amz-cf-id: xKq5791wrlQorvaxybzdIMzTC7431DaiLiLqAZFZ2catH7qRGEUNPA==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 93ms
46ms Ping
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-6Y5Q4PR4RC&gtm=2oe4d0&_p=1702481750&sr=1600x1200&_z=ccd.IBB&ul=en-us&cid=1589532412.1650286417&_s=1&dl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&dr=https%3A%2F%2Ft.co%2F&dt=Chinese%20hackers%20are%20using%20VLC%20media%20player%20to%20launch%20malware%20attacks&sid=1650286416&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6Y5Q4PR4RC&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 clarity.js Show response
f.clarity.ms/s/0.6.34/ 53 KB
23 KB 374ms
102ms Script
application/javascript 20.84.22.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://f.clarity.ms/s/0.6.34/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/8uhibhcqnt?ref=gtm2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.84.22.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
content-encoding: br
etag: "1d84ac37b962954"
last-modified: Thu, 07 Apr 2022 21:07:26 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
content-length: 23150
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2 200 269 Show response
p.ad.gt/api/v1/p/ 32 KB
10 KB 523ms
174ms Script
application/javascript 34.210.126.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/p/269?au_id=AU1D-0100-001650286417-FFKNOTDX-3H3N
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/269?url=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&ref=https%3A%2F%2Ft.co%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.210.126.15 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-210-126-15.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 8b025d662daffd60182ba7a8c9e02a5ce11a2377512196ee55a1148e2da83269

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
content-encoding: gzip
last-modified: Fri, 15 Apr 2022 13:40:18 GMT
server: nginx/1.18.0
etag: W/"1650030018.0-32512-2713389681"
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=43200
expires: Tue, 19 Apr 2022 00:53:37 GMT

GET
H2 200 haloid Show response
id.halo.ad.gt/api/v1/ 6 KB
3 KB 171ms
171ms Script
text/javascript 35.85.185.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.halo.ad.gt/api/v1/haloid
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/269?url=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&ref=https%3A%2F%2Ft.co%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.85.185.37 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-85-185-37.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: c5d5e7f685c3bb91e84b94b6738310b8e2de4056b4668c42131ec64b3f014e40

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
content-encoding: gzip
origin-trial
server: nginx/1.20.0
content-type: text/javascript; charset=UTF-8

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&adnxs_id=$UID
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&adnxs_id=7389662982991471923

43 B
473 B

395ms
170ms

Image
image/gif

44.239.49.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&adnxs_id=7389662982991471923
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 44.239.49.199 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-49-199.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
cache-control: public, max-age=43200
server: nginx/1.20.0
content-type: image/gif
expires: Tue, 19 Apr 2022 00:53:37 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 18 Apr 2022 12:53:37 GMT
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: ac527f48-5e2a-42e8-90be-fbe1958a89f1
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&adnxs_id=7389662982991471923
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&gpdr=0&ttd_puid=AU1D-0100-001650286417-FFKNOTDX-3H3N
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&gpdr=0&ttd_puid=AU1D-0100-001650286417-FFKNOTDX-3H3N
https://ids.ad.gt/api/v1/t_match?tdid=792d858a-f40f-4998-80b0-9589a3aa6526&id=AU1D-0100-001650286417-FFKNOTDX-3H3N

43 B
468 B

329ms
170ms

Image
image/gif

44.239.49.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=792d858a-f40f-4998-80b0-9589a3aa6526&id=AU1D-0100-001650286417-FFKNOTDX-3H3N
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 44.239.49.199 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-49-199.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
cache-control: public, max-age=43200
server: nginx/1.20.0
content-type: image/gif
expires: Tue, 19 Apr 2022 00:53:37 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ids.ad.gt/api/v1/t_match?tdid=792d858a-f40f-4998-80b0-9589a3aa6526&id=AU1D-0100-001650286417-FFKNOTDX-3H3N
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 259

GET
H2

200

UCookieSetPug
image2.pubmatic.com/AdServer/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001650286417-FFKNOTDX-3H3N
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001650286417-FFKNOTDX-3H3N

0
93 B

15ms
14ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001650286417-FFKNOTDX-3H3N
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:36 GMT
content-encoding: gzip
server: nginx
cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-type: text/html; charset=utf-8

Redirect headers

location: https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001650286417-FFKNOTDX-3H3N
date: Mon, 18 Apr 2022 06:11:35 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

g_match
ids.ad.gt/api/v1/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001650286417-FFKNOTDX-3H3N
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm=&google_sc=&google_ula=450542624&id=AU1D-0100-001650286417-FFKNOTDX-3H3N&google_tc=
https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&google_gid=CAESEBuuhYK8SRbXe23a1-5tK5A&google_cver=1&google_ula=450542624,0

43 B
470 B

403ms
334ms

Image
image/gif

44.239.49.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&google_gid=CAESEBuuhYK8SRbXe23a1-5tK5A&google_cver=1&google_ula=450542624,0
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 44.239.49.199 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-49-199.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
cache-control: public, max-age=43200
server: nginx/1.20.0
content-type: image/gif
expires: Tue, 19 Apr 2022 00:53:37 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&google_gid=CAESEBuuhYK8SRbXe23a1-5tK5A&google_cver=1&google_ula=450542624,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 357
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001650286417-FFKNOTDX-3H3N
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY1MDI4NjQxNy1GRktOT1REWC0zSDNO

170 B
188 B

50ms
50ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY1MDI4NjQxNy1GRktOT1REWC0zSDNO

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY1MDI4NjQxNy1GRktOT1REWC0zSDNO
date: Mon, 18 Apr 2022 12:53:37 GMT
server: nginx/1.20.0
content-length: 473
content-type: text/html; charset=utf-8

GET
H3 200 cm
u.openx.net/w/1.0/ 43 B
75 B 86ms
51ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001650286417-FFKNOTDX-3H3N%26auid%3DAU1D-0100-001650286417-FFKNOTDX-3H3N
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/18.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
content-encoding: gzip
server: OXGW/18.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK us
sync.go.sonobi.com/ 0
478 B 75ms
13ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&uid=[UID]

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

202

unruly
ids.ad.gt/api/v1/
Redirect Chain

https://sync.1rx.io/usersync/audigent/0?dspret=1&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Funruly%3Fid%3DAU1D-0100-001650286417-FFKNOTDX-3H3N%26unruly_id%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync/audigent/0?zcc=1&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Funruly%3Fid%3DAU1D-0100-001650286417-FFKNOTDX-3H3N%26unruly_id%3D%5BRX_UUID%5D&cb=1650286417260
https://ids.ad.gt/api/v1/unruly?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&unruly_id=OPTOUT

43 B
385 B

335ms
169ms

Image
image/gif

44.239.49.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/unruly?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&unruly_id=OPTOUT
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 44.239.49.199 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-49-199.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
cache-control: public, max-age=43200
server: nginx/1.20.0
content-type: image/gif
expires: Tue, 19 Apr 2022 00:53:37 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
server: Tengine
etag: OPTOUT
content-type: text/html
location: https://ids.ad.gt/api/v1/unruly?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&unruly_id=OPTOUT
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET
H2

200

mediamath_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.mathtag.com/sync/img?redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmediamath_match%3Fuser_id%3D%5BMM_UUID%5D%26id%3DAU1D-0100-001650286417-FFKNOTDX-3H3N
https://ids.ad.gt/api/v1/mediamath_match?user_id=f457625d-5f52-4800-98df-ad5f597ab011&id=AU1D-0100-001650286417-FFKNOTDX-3H3N

43 B
381 B

171ms
171ms

Image
image/gif

44.239.49.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/mediamath_match?user_id=f457625d-5f52-4800-98df-ad5f597ab011&id=AU1D-0100-001650286417-FFKNOTDX-3H3N
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Server: 44.239.49.199 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-49-199.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
cache-control: public, max-age=43200
server: nginx/1.20.0
content-type: image/gif
expires: Tue, 19 Apr 2022 00:53:37 GMT

Redirect headers

Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: MT3 4335 2c68c00 master ord-pixel-x33 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ids.ad.gt/api/v1/mediamath_match?user_id=f457625d-5f52-4800-98df-ad5f597ab011&id=AU1D-0100-001650286417-FFKNOTDX-3H3N
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 18 Apr 2022 12:53:36 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 8112 6 KB
3 KB 8ms
8ms XHR
application/javascript 143.204.95.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-188.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: khsXo6Z3HSo5bHNWbmb1eMp88IHhxPc.
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 42213
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 17 Mar 2022 02:21:48 GMT
server: AmazonS3
date: Mon, 18 Apr 2022 01:30:36 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 ba77f90aac0ddbc2c4c2c02062fac762.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: zpoaOUm2NBjan7mvx4bs5HUL-KU7Wvwr32Xb1NE3_yKHd1gaXC5H2w==

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v19/ 8 KB
8 KB 125ms
39ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v19/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.androidpolice.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 13 Apr 2022 19:30:15 GMT
x-content-type-options: nosniff
age: 408202
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:17:03 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 13 Apr 2023 19:30:15 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 46ms
46ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1702481750&t=pageview&_s=1&dl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Chinese%20hackers%20are%20using%20VLC%20media%20player%20to%20launch%20malware%20attacks&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IADAAEABAAQCAC~&jid=544843052&gjid=1066919197&cid=1589532412.1650286417&tid=UA-6275685-2&_gid=421336185.1650286417&_r=1&_slc=1&cd1=1003197&cd2=steve-huff&cd3=&cd4=Applications&cd5=Applications&cd6=regular&cd7=0&cd8=all&cd9=&cd10=&cd11=false&cd12=native&cd13=article&cd14=1003197&cd15=steve-huff&cd16=&cd17=stephen-schenck&cd18=regular&cd19=all&cd20=false&cd21=0&cd22=false&cd23=native&cd24=desktop&cd25=185.213.155.166&cd26=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F100.0.4896.75%20Safari%2F537.36&cd27=20-24&cd28=20220408&cd29=&cd30=news&cd31=Applications&cd32=%7CNews%7CApplications%7CVLC%7Chacking%7Cmalware%7C&cd33=N&cd34=showAds&cd35=false&cd36=content-all&cd38=software&cd39=News&cd40=Short-Term&z=1106114820

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 v2mbo_5Qc5norFLevC6f7o1HlizZr4kjBrNjTCfJDIAWmg2CZWDgTETVLFF7Qb0mBs0KLogXQwKcHtGCPxHfOgA Show response
scarfsmash.com/ 209 B
341 B 22ms
22ms Fetch
application/json 35.186.249.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://scarfsmash.com/v2mbo_5Qc5norFLevC6f7o1HlizZr4kjBrNjTCfJDIAWmg2CZWDgTETVLFF7Qb0mBs0KLogXQwKcHtGCPxHfOgA

Requested by

Host: scarfsmash.com
URL: https://scarfsmash.com/v2yvlzsveWtgqGFXj2wU3ajphon_Qq9myt1bClE9dnFgPWVzuw4LojxURFEzFAfp8GOJdYROXlGZLTg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.249.84 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

84.249.186.35.bc.googleusercontent.com

Software

Resource Hash

312b9a7650f099cdaf7377c792b6ae450b241d4da9b568e13266e51099564ab4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
access-control-allow-methods: POST, OPTIONS
x-datacenter: gce-europe-west1
date: Mon, 18 Apr 2022 12:53:37 GMT
vary: Accept-Encoding, Origin
x-hostname: fen-hoothoot-europe-west1-spot-97sw
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-buildnumber: 516110284
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length: 209
expires: Mon, 18 Apr 2022 12:53:36 GMT

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame EBB8 0
397 B 598ms
86ms Document
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=544989&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 0
Date: Mon, 18 Apr 2022 12:53:37 GMT
Etag: 50f209c69f7487b0
Server: VertaMedia 1.0

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame 62D8 0
397 B 597ms
86ms Document
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=550070&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 0
Date: Mon, 18 Apr 2022 12:53:37 GMT
Etag: 50f209c69f7487b0
Server: VertaMedia 1.0

GET
H/1.1

200
OK

csync Show response
sync.console.adtarget.com.tr/ Frame 12F9
Redirect Chain

https://creativecdn.com/cm-notify?pi=admatic
https://creativecdn.com/cm-notify?pi=admatic&tc=1
https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=ew60bgDoqUNrWDTTXGAN&pi=admatic&tc=1

0
407 B

529ms
87ms

Document
text/plain

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=ew60bgDoqUNrWDTTXGAN&pi=admatic&tc=1
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 0
Date: Mon, 18 Apr 2022 12:53:37 GMT
Etag: 50f209c69f7487b0
Server: VertaMedia 1.0

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Mon, 18 Apr 2022 12:53:37 GMT Mon, 18 Apr 2022 12:53:37 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=ew60bgDoqUNrWDTTXGAN&pi=admatic&tc=1
pragma: no-cache

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 7A3E 15 KB
6 KB 10ms
8ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307406%26extuid%3D%24%7BUID%7D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=82958
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Mon, 18 Apr 2022 12:53:37 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Tue, 19 Apr 2022 11:56:15 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 pbsync.html Show response
js.adscale.de/ Frame F314 3 KB
2 KB 56ms
7ms Document
text/html 2600:9000:2156:2a00:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:2a00:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c82fab08e93db8934a27f5b26ddf48c8a013a92a21ea15b7fa8b675b0d866040

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3763
cache-control: max-age=7200
content-encoding: gzip
content-type: text/html
date: Mon, 18 Apr 2022 11:50:55 GMT
etag: W/"9f4e83cc82a56a2a6e9851eeee2f9f34"
last-modified: Sat, 16 Apr 2022 21:12:38 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
x-amz-cf-id: Ih2N_dsoje7HOIaWdoiSfXmguicCrj4uMtAsAO7flNrOyq_CI4PaMw==
x-amz-cf-pop: FRA50-C1
x-amz-version-id: cUMJ92_cM.fGK97cbtJ7sMBlXBuzGylx
x-cache: Hit from cloudfront

GET
H2 200 cookie Show response
cm.adform.net/ Frame A86B 43 B
106 B 63ms
20ms Document
image/gif 37.157.4.39
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.4.39 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 43
content-type: image/gif
date: Mon, 18 Apr 2022 12:53:37 GMT
server: nginx

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame DDB8 0
397 B 594ms
87ms Document
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=502624&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 0
Date: Mon, 18 Apr 2022 12:53:37 GMT
Etag: 50f209c69f7487b0
Server: VertaMedia 1.0

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame 9EF0 0
397 B 596ms
87ms Image
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=550214&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: VertaMedia 1.0
Etag: 50f209c69f7487b0
Content-Length: 0

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame 9EF0 0
397 B 596ms
88ms Image
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=306708&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: VertaMedia 1.0
Etag: 50f209c69f7487b0
Content-Length: 0

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame 9EF0 43 B
331 B 682ms
86ms Image
image/gif 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?redir=
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: VertaMedia 1.0
Etag: 50f209c69f7487b0
Content-Length: 43
Content-Type: image/gif

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 61E4 0
42 B 512ms
15ms Script
text/plain 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=96748509&p=159196&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=1&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D625d5f503d373%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
content-length: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
446 B 57ms
19ms XHR
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-6275685-2&cid=1589532412.1650286417&jid=544843052&gjid=1066919197&_gid=421336185.1650286417&_u=IADAAEAAAAQCAC~&z=889778005

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 18 Apr 2022 12:53:37 GMT
content-type: text/plain
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
474 B 477ms
333ms Image
image/gif 44.239.49.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001650286417-FFKNOTDX-3H3N&halo_id=02018hqkt607jv2yg08xizqr0bwpa1w0evvljv1k7cm961o8b5po0ntek210qskvk40trr7270wqxik90zq3u2c12pa5j31k0gxf118nmsj90fzd0bt1elzfjf1hl5r1i1kkc2jl
Requested by: Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.239.49.199 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-49-199.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
cache-control: public, max-age=43200
server: nginx/1.20.0
content-type: image/gif
expires: Tue, 19 Apr 2022 00:53:37 GMT

GET
H2 304 session.gif
events.release.narrativ.com/api/v0/ 0
396 B 104ms
104ms Image 3.228.106.126
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://events.release.narrativ.com/api/v0/session.gif?uid_bam=1771981548340665493&cache_buster=1650286417362

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.228.106.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-228-106-126.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin: *
x-bam-build-version: 63c21d9982831d134ab44164cd70784f89423817
date: Mon, 18 Apr 2022 12:53:37 GMT
server: nginx/1.20.2
x-robots-tag: none
x-bam-env: release
strict-transport-security: max-age=63072000; includeSubDomains; preload

POST
H2 201 / Show response
events.release.narrativ.com/api/v0/publishers/2412/impressions/page_impression/ 2 B
468 B 106ms
106ms XHR
application/json 3.228.106.126
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://events.release.narrativ.com/api/v0/publishers/2412/impressions/page_impression/?uid_bam=1771981548340665493

Requested by

Host: static.narrativ.com
URL: https://static.narrativ.com/tags/narrativ-pub.1.0.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.228.106.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-228-106-126.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://www.androidpolice.com/hackers-vlc-malware/
Access-Control-Allow-Credentials: true
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

x-bam-build-version: 63c21d9982831d134ab44164cd70784f89423817
date: Mon, 18 Apr 2022 12:53:37 GMT
server: nginx/1.20.2
x-bam-env: release
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.androidpolice.com
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-robots-tag: none
content-length: 2

POST
H/1.1 200
OK / Show response
api.narrativ.com/api/v0/publishers/2412/smart_links/ 190 B
523 B 118ms
117ms XHR
application/json 54.236.193.207
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.narrativ.com/api/v0/publishers/2412/smart_links/

Requested by

Host: static.narrativ.com
URL: https://static.narrativ.com/tags/narrativ-pub.1.0.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.236.193.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-236-193-207.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

585ba2e57fc8fcc73e0fb77c7a0b8a11bac98f17c9233d5ecfe5b59bc5d88ddf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Accept: application/json
Referer: https://www.androidpolice.com/hackers-vlc-malware/
Access-Control-Allow-Credentials: true
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

Date: Mon, 18 Apr 2022 12:53:37 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Server: nginx/1.20.2
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.androidpolice.com
Connection: keep-alive
X-Robots-Tag: noindex, follow
Content-Length: 190

OPTIONS
H2 200 /
events.release.narrativ.com/api/v0/publishers/2412/impressions/page_impression/ Frame 0
0 102ms
102ms Preflight
text/html 3.228.106.126
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://events.release.narrativ.com/api/v0/publishers/2412/impressions/page_impression/?uid_bam=1771981548340665493

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.228.106.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-228-106-126.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: access-control-allow-credentials,content-type,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.androidpolice.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-headers: access-control-allow-credentials, content-type, x-requested-with
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://www.androidpolice.com
allow: OPTIONS, POST
content-length: 0
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 12:53:37 GMT
server: nginx/1.20.2
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin
x-bam-build-version: 63c21d9982831d134ab44164cd70784f89423817
x-bam-env: release
x-robots-tag: none

OPTIONS
H/1.1 200
OK /
api.narrativ.com/api/v0/publishers/2412/smart_links/ Frame 0
0 416ms
102ms Preflight
text/html 54.236.193.207
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.narrativ.com/api/v0/publishers/2412/smart_links/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.236.193.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-236-193-207.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: access-control-allow-credentials,content-type,x-requested-with
Access-Control-Request-Method: POST
Origin: https://www.androidpolice.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Access-Control-Allow-Headers: access-control-allow-credentials, content-type, x-requested-with
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
Access-Control-Allow-Origin: https://www.androidpolice.com
Access-Control-Max-Age: 86400
Allow: POST, OPTIONS
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: nginx/1.20.2
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Vary: Origin
X-Robots-Tag: noindex, follow

POST
H2 200 v2ijvpvbh00oj1EwEuQwP3DZwfhF1RvaZIcGUjzOp9s0j6FrlgT3mgUnsrS5L01-LKEkT3JXRli-hyOkfGx-nKQ Show response
scarfsmash.com/ 2 KB
805 B 21ms
21ms Fetch
application/json 35.186.249.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://scarfsmash.com/v2ijvpvbh00oj1EwEuQwP3DZwfhF1RvaZIcGUjzOp9s0j6FrlgT3mgUnsrS5L01-LKEkT3JXRli-hyOkfGx-nKQ

Requested by

Host: scarfsmash.com
URL: https://scarfsmash.com/v2yvlzsveWtgqGFXj2wU3ajphon_Qq9myt1bClE9dnFgPWVzuw4LojxURFEzFAfp8GOJdYROXlGZLTg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.249.84 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

84.249.186.35.bc.googleusercontent.com

Software

Resource Hash

295941492338af0acc646044f4ad42adc96e631ae2bc38066d7cbbb79e6fd87b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
content-encoding: gzip
x-datacenter: gce-europe-west1
date: Mon, 18 Apr 2022 12:53:37 GMT
vary: Accept-Encoding, Origin
x-hostname: fen-hoothoot-europe-west1-spot-97sw
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.androidpolice.com
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
x-buildnumber: 516110284
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length: 764

GET
H2

200

uu Show response
ih.adscale.de/ Frame F314
Redirect Chain

https://ih.adscale.de/uu?cbfn=receive&t=1650286417
https://ih.adscale.de/uu?cbfn=receive&t=1650286417&nut&uu=e5c668e31ea84d1f9f80ad285d6f4583

44 B
213 B

8ms
8ms

Script
text/javascript

18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/uu?cbfn=receive&t=1650286417&nut&uu=e5c668e31ea84d1f9f80ad285d6f4583
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 1fa491f5c8a044e852f26a4748b74422b23c8b1050e2c1d2f401aa99462c7a4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
content-length: 44
content-type: text/javascript;charset=ISO-8859-1

Redirect headers

location: https://ih.adscale.de/uu?cbfn=receive&t=1650286417&nut&uu=e5c668e31ea84d1f9f80ad285d6f4583
date: Mon, 18 Apr 2022 12:53:37 GMT
content-length: 0

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 153ms
64ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-6275685-2&cid=1589532412.1650286417&jid=544843052&_u=IADAAEAAAAQCAC~&z=1471464890

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 150ms
65ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-6275685-2&cid=1589532412.1650286417&jid=544843052&_u=IADAAEAAAAQCAC~&z=1471464890

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 userconnect.js Show response
js.adscale.de/ Frame F314 11 KB
4 KB 8ms
8ms Script
application/javascript 2600:9000:2156:2a00:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/userconnect.js
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:2a00:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca38ab561201a1a68867f61d4fb3df9682756c8927fe80f047624e7ef662f0f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: Tl9mRjjV4xk.ybogbbDHglLCbhsQACnS
content-encoding: br
last-modified: Sat, 16 Apr 2022 21:12:38 GMT
server: AmazonS3
age: 6058
etag: W/"988fbfb6c270a6080f89deb043243858"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
cache-control: max-age=7200
date: Mon, 18 Apr 2022 11:12:40 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: R2UrVrvTJlCSJvDH6MFrIQzKT_K6eNpacSDO47pbMuje9j3uibwYGg==

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame F314 0
419 B 549ms
86ms Image
text/plain 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307565&extuid=e5c668e31ea84d1f9f80ad285d6f4583
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: VertaMedia 1.0
Etag: dbb4b7ae1e04524d
Content-Length: 0

GET
H2 200 userconnect Show response
ih.adscale.de/ Frame F314 149 B
224 B 10ms
9ms Script
application/javascript 18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/userconnect?ssl=1&sid=0&cbfn=stroeerCoreConnect&ts=1650286417450&umd=false&gdpr=0&gdpr_version=2&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 3516496d97f72bf509cf5d6902b5deebf53355ccb21127dc777d265cd96ca2d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
content-length: 149
content-type: application/javascript

GET
H2 200 map Show response
ih.adscale.de/ Frame 1E2D 3 KB
3 KB 9ms
9ms Document
text/html 18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 47fa5c66f03d068c31d3725d55e48e5bf7db9c21aed436b7ef92c98a697cdbdb

Request headers

Referer: https://js.adscale.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 2604
content-type: text/html;charset=ISO-8859-1
date: Mon, 18 Apr 2022 12:53:37 GMT

GET
H2 200 match.js Show response
js.adscale.de/ Frame 1E2D 4 KB
2 KB 8ms
8ms Script
application/javascript 2600:9000:2156:2a00:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/match.js
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:2a00:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 45767d3452a56be0180eed18ff44acd5e688dc5bbde2b77e1da29b326a180416

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: xIt8XQEt8.Qs7gZ6cTeH_29LJ6qDO2nL
content-encoding: gzip
last-modified: Sat, 16 Apr 2022 21:12:38 GMT
server: AmazonS3
age: 6058
etag: W/"ff7cce9128150bd82f1a709c03692e3d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
cache-control: max-age=7200
date: Mon, 18 Apr 2022 11:12:40 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: VVevXkWMt0LZbe8rbcHETy-O-kDkkE_1TmN0hs8Va8aB3ePLkdApQA==

GET
H2

200

img
ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/ Frame 1E2D
Redirect Chain

https://bbnaut.ibillboard.com/match/AdScale?partneruid=e5c668e31ea84d1f9f80ad285d6f4583&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg%3Ftpid%...
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=101&tpuid=BBID-01-03250004175712454-16580088

49 B
463 B

9ms
9ms

Image
image/gif

18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=101&tpuid=BBID-01-03250004175712454-16580088
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: nginx
Transfer-Encoding: chunked
p3p: CP="CUR ADM DEV OUR STP PRE DSP NOI COR NID"
Location: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=101&tpuid=BBID-01-03250004175712454-16580088
Cache-Control: private, max-age=3600
Access-Control-Allow-Credentials: true
Connection: close

GET
H2 200 ConsentManager,Sticky2 Show response
scarfsmash.com/v2hlbidxWZHVIHVe5BMAav4EOB2paPyqNmg6LW0zsRuq-jXXuhx5aKRzQ9dB5t1p77QO33e2v8mvpzb_duXbY/ 276 KB
80 KB 27ms
27ms Script
text/javascript 35.186.249.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://scarfsmash.com/v2hlbidxWZHVIHVe5BMAav4EOB2paPyqNmg6LW0zsRuq-jXXuhx5aKRzQ9dB5t1p77QO33e2v8mvpzb_duXbY/ConsentManager,Sticky2

Requested by

Host: scarfsmash.com
URL: https://scarfsmash.com/v2yvlzsveWtgqGFXj2wU3ajphon_Qq9myt1bClE9dnFgPWVzuw4LojxURFEzFAfp8GOJdYROXlGZLTg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.249.84 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

84.249.186.35.bc.googleusercontent.com

Software

Resource Hash

f50f06ac57aa3db04b5928db1c838b00f200b57f7f80c2e54963edfe918ed196

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Origin: https://www.androidpolice.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; preload
content-encoding: br
x-datacenter: gce-europe-west1
etag: "ccacd0786f07bfd1f418005977eec4b663dc90175833a88ce398d54fdefca34f"
vary: Accept-Encoding, Accept-Language, Origin
x-hostname: fen-hoothoot-europe-west1-spot-97sw
content-type: text/javascript; charset=utf-8
access-control-allow-origin: https://www.androidpolice.com
cache-control: private, must-revalidate, max-age=21600
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
x-buildnumber: 516110284
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
date: Mon, 18 Apr 2022 12:53:37 GMT

GET
H3 200 css2
fonts.googleapis.com/ 7 KB
653 B 99ms
51ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@300;600;700&display=swap

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

86620b292691b6d6621e00a6439123afe65ac8317a6c48ddcad68a1c85bbe606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 18 Apr 2022 11:21:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 18 Apr 2022 12:53:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Apr 2022 12:53:37 GMT

GET
H2 200 MTUsMjA3MGNhNTc5NGIw
images.getadmiral.com/ 763 B
1 KB 88ms
40ms Image
image/png 2606:4700:3037::ac43:c1e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.getadmiral.com/MTUsMjA3MGNhNTc5NGIw

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/hackers-vlc-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::ac43:c1e6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2880fbb26ad5becd41ec25a5c37da351ac77225bbf30d5a9ab8accf5728591cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-buildnumber: 515379129
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 763
server: cloudflare
x-datacenter: gce-europe-west1
etag: "2c607cb7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uU9U3qfJULXRllk9DO6YxcHs%2FuElRTfrdIlsNayZst%2BSycbSZWyDjq9GstA97w%2Bvr1tYoQG0RwgSpBh1G%2BL9WcFqGu4GpEMNSx9pjaWrAlak3WgYgKm82JCN%2BYIMpRISlJ2gtM2e11S7VyDzTbbhp2YTz2w%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: private, must-revalidate, max-age=3600
x-hostname: button
cf-ray: 6fdd8b5e8e29695d-FRA

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 1E2D
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=183592&cb=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D63%26tpuid%3D__UID__&uid=fe341246438db1d68dccf02f5...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=Yl1fUAXpC.7TJacXbW.QhgAA%261113

49 B
555 B

9ms
9ms

Image
image/gif

18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=Yl1fUAXpC.7TJacXbW.QhgAA%261113
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Mon, 18 Apr 2022 12:53:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=Yl1fUAXpC.7TJacXbW.QhgAA%261113
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 310
Expires: Mon, 18 Apr 2022 12:53:37 GMT

GET
H3 200 UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v8/ 37 KB
37 KB 88ms
41ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v8/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@300;600;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.androidpolice.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 13 Apr 2022 18:02:08 GMT
x-content-type-options: nosniff
age: 413489
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37716
x-xss-protection: 0
last-modified: Wed, 23 Feb 2022 17:42:15 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Apr 2023 18:02:08 GMT

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
52 B 528ms
169ms Script
text/plain 44.240.45.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=au1t-f33b39933470facd20639181ad2bb843&url=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&code=%27none%27
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/valnet/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.240.45.112 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-240-45-112.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:38 GMT
server: nginx/1.20.0

GET
H3 200 ecommerce.js Show response
www.google-analytics.com/plugins/ua/ 1 KB
763 B 39ms
39ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ecommerce.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:04:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2934
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 738
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 18 Apr 2022 13:04:43 GMT

GET
H3 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:50:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 196
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1129
x-xss-protection: 0
last-modified: Thu, 30 Dec 2021 12:48:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 18 Apr 2022 13:50:21 GMT

GET
H2 200 segments Show response
seg.ad.gt/api/v1/ 21 B
224 B 514ms
176ms XHR
application/json 34.213.63.176
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://seg.ad.gt/api/v1/segments?url=https%253A%252F%252Fwww.androidpolice.com%252Fhackers-vlc-malware%252F&partner_id=269&tagger_id=au1t-f33b39933470facd20639181ad2bb843&au_id=AU1D-0100-001650286417-FFKNOTDX-3H3N
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/269?au_id=AU1D-0100-001650286417-FFKNOTDX-3H3N
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.213.63.176 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-213-63-176.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 2f65b37814d674a38e2813bcb3fd9590d449087dfb30420deec70327fef7d1cc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin: https://www.androidpolice.com
date: Mon, 18 Apr 2022 12:53:38 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.20.0
vary: Origin
content-type: application/json

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
107 B 544ms
200ms XHR
text/plain 52.32.125.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/269?au_id=AU1D-0100-001650286417-FFKNOTDX-3H3N
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.32.125.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-125-98.us-west-2.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type: text/plain

Response headers

access-control-allow-origin: https://www.androidpolice.com
date: Mon, 18 Apr 2022 12:53:38 GMT
server: nginx/1.18.0
vary: Origin

POST
H2 200 v2mbo_5Qc5norFLevC6f7o1HlizZr4kjBrNjTCfJDIAWmg2CZWDgTETVLFF7Qb0mBs0KLogXQwKcHtGCPxHfOgA Show response
scarfsmash.com/ 254 B
292 B 34ms
34ms Fetch
application/json 35.186.249.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://scarfsmash.com/v2mbo_5Qc5norFLevC6f7o1HlizZr4kjBrNjTCfJDIAWmg2CZWDgTETVLFF7Qb0mBs0KLogXQwKcHtGCPxHfOgA

Requested by

Host: scarfsmash.com
URL: https://scarfsmash.com/v2yvlzsveWtgqGFXj2wU3ajphon_Qq9myt1bClE9dnFgPWVzuw4LojxURFEzFAfp8GOJdYROXlGZLTg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.249.84 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

84.249.186.35.bc.googleusercontent.com

Software

Resource Hash

7b28e862e09e23941b995612f4529779d94d918e8c9a5d3cf1d18657dda85189

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
access-control-allow-methods: POST, OPTIONS
x-datacenter: gce-europe-west1
date: Mon, 18 Apr 2022 12:53:37 GMT
vary: Accept-Encoding, Origin
x-hostname: fen-hoothoot-europe-west1-spot-97sw
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-buildnumber: 516110284
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length: 254
expires: Mon, 18 Apr 2022 12:53:36 GMT

POST
H2 204 collect Show response
f.clarity.ms/ 0
74 B 92ms
92ms XHR
text/plain 20.84.22.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://f.clarity.ms/collect
Requested by: Host: f.clarity.ms
URL: https://f.clarity.ms/s/0.6.34/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.84.22.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin: https://www.androidpolice.com
date: Mon, 18 Apr 2022 12:53:37 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2

200

img
ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/ Frame 1E2D
Redirect Chain

https://track.adform.net/serving/cookie/match/?party=9&uid=5815c490ed3dd65326730e11f2227174bdb455b6632e329a684ccf10317b7eed&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df54...
https://track.adform.net/serving/cookie/match/?CC=1&party=9&uid=5815c490ed3dd65326730e11f2227174bdb455b6632e329a684ccf10317b7eed&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a...
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=42&gdpr=0&tpuid=3887939266147751660

49 B
566 B

9ms
9ms

Image
image/gif

18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=42&gdpr=0&tpuid=3887939266147751660
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
server: nginx
location: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=42&gdpr=0&tpuid=3887939266147751660
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 1E2D
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=17&p=32&cp=adscale&url=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D40%26tpuid%3D%40%40CRITEO_USERID%40%40&u...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=3954445a-0b39-46c4-91c5-0efaa65fa778&gdpr=0

49 B
588 B

13ms
13ms

Image
image/gif

18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=3954445a-0b39-46c4-91c5-0efaa65fa778&gdpr=0
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:37 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:35 GMT
server: Kestrel
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=3954445a-0b39-46c4-91c5-0efaa65fa778&gdpr=0
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1301736
content-length: 0
expires: Mon, 18 Apr 2022 00:00:00 GMT

POST
H2 204 collect Show response
f.clarity.ms/ 0
25 B 284ms
284ms XHR
text/plain 20.84.22.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://f.clarity.ms/collect
Requested by: Host: f.clarity.ms
URL: https://f.clarity.ms/s/0.6.34/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.84.22.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin: https://www.androidpolice.com
date: Mon, 18 Apr 2022 12:53:37 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 1E2D
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=26&redir=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D39%26tpuid%3D%5BMM_UUID%5D&uid=b4d5719d2649f3e77f8b14c0...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=f457625d-5f52-4800-98df-ad5f597ab011&gdpr=0&gdpr_consent=

49 B
611 B

10ms
9ms

Image
image/gif

18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=f457625d-5f52-4800-98df-ad5f597ab011&gdpr=0&gdpr_consent=
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:38 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Mon, 18 Apr 2022 12:53:38 GMT
Server: MT3 4335 2c68c00 master ord-pixel-x19 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=f457625d-5f52-4800-98df-ad5f597ab011&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 18 Apr 2022 12:53:37 GMT

GET
H2

200

img
ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/ Frame 1E2D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_sc&uid=90f097368445d894119f99e5a97e20c301c1cd72d2d6da37f9c1c1d0aff39ea5&tpid=38&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd...
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?uid=90f097368445d894119f99e5a97e20c301c1cd72d2d6da37f9c1c1d0aff39ea5&tpid=38&gdpr=0&tpuid=CAESEIAhbJWZV8UDZ_6YLKh2WrM...

49 B
629 B

10ms
9ms

Image
image/gif

18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?uid=90f097368445d894119f99e5a97e20c301c1cd72d2d6da37f9c1c1d0aff39ea5&tpid=38&gdpr=0&tpuid=CAESEIAhbJWZV8UDZ_6YLKh2WrM&google_cver=1
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:38 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:38 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?uid=90f097368445d894119f99e5a97e20c301c1cd72d2d6da37f9c1c1d0aff39ea5&tpid=38&gdpr=0&tpuid=CAESEIAhbJWZV8UDZ_6YLKh2WrM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 424
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

img
ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/ Frame 1E2D
Redirect Chain

https://adscale-emea.adnxs.com/getuid?https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f54316a6df548d2159ef88%2F1650286417469%2F0%2Fimg%3Ftpid%3D75%26tpuid%3D%24UID&gdpr=0
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=75&tpuid=7389662982991471923&gdpr=0

49 B
639 B

10ms
10ms

Image
image/gif

18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=75&tpuid=7389662982991471923&gdpr=0
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:38 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Mon, 18 Apr 2022 12:53:38 GMT
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 866.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: f6dfebbf-aff4-4c9b-b921-ff03b8060e2e
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/img?tpid=75&tpuid=7389662982991471923&gdpr=0
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

js Show response
ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/ Frame 1E2D
Redirect Chain

https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=3002c21ea4f8379b91fafda45c62c753e9a70868bf284b487510f3983248ed0e&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f543...
https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=3002c21ea4f8379b91fafda45c62c753e9a70868bf284b487510f3983248ed0e&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F8fd5c8cec5f543...
https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/js?tpid=48&tpuid=a65462d315c203f2ccfdb52aa9f210f2

44 B
583 B

12ms
11ms

Script
text/javascript

18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/js?tpid=48&tpuid=a65462d315c203f2ccfdb52aa9f210f2
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: f9bd12e6397dfdd0a68abf19b2aab828c52394fbf8810483f9d2103430d8c06d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:38 GMT
p3p: CP=NOI PSA OUR
content-length: 44
content-type: text/javascript

Redirect headers

Date: Mon, 18 Apr 2022 12:53:38 GMT
Server: nginx
Vary: Accept
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://ih.adscale.de/sium/8fd5c8cec5f54316a6df548d2159ef88/1650286417469/0/js?tpid=48&tpuid=a65462d315c203f2ccfdb52aa9f210f2
Connection: close
Content-Type: text/plain; charset=utf-8
Content-Length: 147

POST
H2 200 visit Show response
app.convertkit.com/forms/1275831/ 7 B
657 B 441ms
441ms Fetch
application/json 2606:4700::6812:c039
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.convertkit.com/forms/1275831/visit

Requested by

Host: f.convertkit.com
URL: https://f.convertkit.com/ckjs/ck.5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:c039 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 18 Apr 2022 12:53:39 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-xss-protection: 1; mode=block
x-request-id: 214eedca-aec3-4650-8cb5-9f3142a93edf
x-runtime: 0.010123
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: ALLOWALL
etag: W/"aee408847d35e44e99430f0979c3357b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 7200
access-control-allow-methods: POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-download-options: noopen
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
cf-ray: 6fdd8b65bb53917c-FRA

OPTIONS
H2 200 visit
app.convertkit.com/forms/1275831/ Frame 0
0 487ms
429ms Preflight 2606:4700::6812:c039
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.convertkit.com/forms/1275831/visit
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c039 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.androidpolice.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: *
access-control-expose-headers
access-control-max-age: 7200
cf-cache-status: DYNAMIC
cf-ray: 6fdd8b630e39917c-FRA
date: Mon, 18 Apr 2022 12:53:38 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding

POST
H2 200 sium
ih.adscale.de/ Frame 1E2D 0
0 9ms
9ms Fetch
application/json 18.194.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/sium
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/match.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Referer: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://ih.adscale.de
date: Mon, 18 Apr 2022 12:53:38 GMT
access-control-allow-credentials: true
access-control-allow-headers: x-openrtb-version
content-length: 0
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json

GET
H2 200 pixel.png Show response
www.androidpolice.com/ 103 B
441 B 96ms
95ms XHR
image/png 44.196.161.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.androidpolice.com/pixel.png?params=---{%22group%22:%22browseclip_imp%22,%22device%22:%22desktop%22,%22ids%22:[{%22id%22:%221003341%22,%22position%22:%22sidebar-pinned-listing-page-article-1%22},{%22id%22:%221003334%22,%22position%22:%22sidebar-pinned-listing-page-article-2%22},{%22id%22:%221003336%22,%22position%22:%22sidebar-pinned-listing-page-article-3%22},{%22id%22:%221003335%22,%22position%22:%22sidebar-pinned-listing-page-article-4%22},{%22id%22:%221003333%22,%22position%22:%22sidebar-pinned-listing-page-article-5%22},{%22id%22:%221003331%22,%22position%22:%22sidebar-pinned-listing-page-article-6+%22},{%22id%22:%221003262%22,%22position%22:%22sidebar-pinned-listing-page-article-6+%22},{%22id%22:%221003320%22,%22position%22:%22sidebar-pinned-listing-page-article-6+%22},{%22id%22:%221003127%22,%22position%22:%22sidebar-pinned-listing-page-article-6+%22},{%22id%22:%221003322%22,%22position%22:%22sidebar-pinned-listing-page-article-6+%22},{%22id%22:%221003237%22,%22position%22:%22sidebar-pinned-listing-page-article-6+%22},{%22id%22:%221002579%22,%22position%22:%22sidebar-pinned-listing-page-article-6+%22},{%22id%22:%221002999%22,%22position%22:%22sentinel-article-sidebarSticky-1%22},{%22id%22:%221003336%22,%22position%22:%22sentinel-article-sidebarSticky-2%22},{%22id%22:%221003265%22,%22position%22:%22sentinel-article-sidebarSticky-3%22},{%22id%22:%221002908%22,%22position%22:%22sentinel-article-relatedContent-1%22},{%22id%22:%221003115%22,%22position%22:%22sentinel-article-relatedContent-2%22},{%22id%22:%221002811%22,%22position%22:%22sentinel-article-relatedContent-3%22},{%22id%22:%221003127%22,%22position%22:%22sentinel-article-relatedContent-4%22},{%22id%22:%221003316%22,%22position%22:%22sentinel-article-relatedContent-5%22},{%22id%22:%221003286%22,%22position%22:%22sentinel-article-relatedContent-6+%22},{%22id%22:%221003252%22,%22position%22:%22sentinel-article-relatedContent-6+%22},{%22id%22:%221002844%22,%22position%22:%22sentinel-article-relatedContent-6+%22},{%22id%22:%221002604%22,%22position%22:%22sentinel-article-relatedContent-6+%22},{%22id%22:%221001143%22,%22position%22:%22sentinel-article-nextArticle%22}],%22eventType%22:%22impression%22}---&rdm=0.9527539278098156

Requested by

Host: www.androidpolice.com
URL: https://www.androidpolice.com/public/build/valnet-footer.873d1235.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.196.161.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-161-176.compute-1.amazonaws.com

Software

nginx /

Resource Hash

d4ed5bd20c3036042165e91001bd91497551164b0e34c76cb8a6eb15c33f3c15

Security Headers

Name	Value
Content-Security-Policy	default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:38 GMT
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 24 Oct 2019 21:53:00 GMT
server: nginx
etag: "5db21d3c-67"
x-frame-options: SAMEORIGIN
content-type: image/png
x-xss-protection: 1; mode=block
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
content-length: 103
x-content-type-options: nosniff

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=D9F8A82D2A7D4A28B9441D8CD537E7D9&RedC=c.clarity.ms&MXFR=0EE475E512F369663DC1646F16F36743
https://c.clarity.ms/c.gif?CtsSyncId=D9F8A82D2A7D4A28B9441D8CD537E7D9&MUID=1C16A8E6A8576BE71376B96CA93C6A6F

42 B
369 B

26ms
26ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=D9F8A82D2A7D4A28B9441D8CD537E7D9&MUID=1C16A8E6A8576BE71376B96CA93C6A6F
Protocol: H2
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:37 GMT
last-modified: Fri, 18 Mar 2022 19:39:54 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "8120eaf0ff3ad81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:38 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F61915FCFCA344D1A8972D4CA96B8DF4 Ref B: FRAEDGE1506 Ref C: 2022-04-18T12:53:38Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=D9F8A82D2A7D4A28B9441D8CD537E7D9&MUID=1C16A8E6A8576BE71376B96CA93C6A6F
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2 200 chunklist_480.m3u8 Show response
video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/ 2 KB
2 KB 24ms
9ms XHR
application/vnd.apple.mpegurl 63.250.60.64
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/chunklist_480.m3u8
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.60.64 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 5091b7a94587298e3dd03fd1b65e2e25ccdac74b50f863b937f1cbdf6cd4f1ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:38 GMT
via: 1.1 cfa647edefc0769e715b9781478b0626.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
content-length: 1730
last-modified: Mon, 06 Sep 2021 08:19:09 GMT
server: Tengine
etag: "9cb0e1eb97190cc10082f62f3e76bf27"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: A5MryaHxYYveo63jnkhI7kdr2PZL3Z1rJi8l0ijGkidibJrz-lyOgw==
expires: Mon, 02 May 2022 12:53:38 GMT

GET
H2 200 w_480_00000.ts Show response
video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/ 260 KB
260 KB 15ms
14ms XHR
video/mp2t 63.250.60.64
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/w_480_00000.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.60.64 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 9bb4ae2fca6846a5b868ac0c39b2a40aa47fdfaa47c08ae263df7ab0d0f42400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:38 GMT
via: 1.1 0e3d5915b30e289999d244786c9a2560.cloudfront.net (CloudFront)
x-amz-cf-pop: BRU50-C1
content-length: 266020
last-modified: Mon, 06 Sep 2021 08:19:10 GMT
server: Tengine
etag: "db146e1bf05452dffb3af1cf92611da8"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: G8MKXiqrajddJC10AFaK2_6cnufr6Drk5CrnsFveoPiURZg_GO5KiQ==
expires: Mon, 02 May 2022 12:53:38 GMT

GET
BLOB 200
OK 8acc9c57-c521-4ed2-ad6d-fac5be4d42c6
https://www.androidpolice.com/ 67 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.androidpolice.com/8acc9c57-c521-4ed2-ad6d-fac5be4d42c6
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3e57eb372e8b405c816875571e184854b2846261c7477c6c9bdb7782faa1a30

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Length: 68465
Content-Type: text/javascript

GET
H2 200 w_480_00001.ts Show response
video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/ 220 KB
221 KB 7ms
7ms XHR
video/mp2t 63.250.60.64
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/w_480_00001.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.60.64 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 9471fcb6a2b246f9c071b322b7bf1eb81986b04c7f195cc592375512fc764ab4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:39 GMT
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
content-length: 225788
last-modified: Mon, 06 Sep 2021 08:19:10 GMT
server: Tengine
etag: "7bbc2093b749ca9fe099809780edb1cf"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: 0FnKH3yIJgt5MQWqHgksWtZdr0ykGTq5tP0LiWVnGICkGo5ak_XY0w==
expires: Mon, 02 May 2022 12:53:39 GMT

GET
H2 200 w_480_00002.ts Show response
video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/ 232 KB
233 KB 8ms
8ms XHR
video/mp2t 63.250.60.64
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/w_480_00002.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.60.64 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 35b7de4f69f748fae0535137551a16455c0564d4b6622b559eabac561b301b09

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:39 GMT
via: 1.1 9099794184e0cace0bb57c49a112df52.cloudfront.net (CloudFront)
x-amz-cf-pop: BRU50-C1
content-length: 238008
last-modified: Mon, 06 Sep 2021 08:19:10 GMT
server: Tengine
etag: "12949733758901f97e1c7708208e6c9a"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: UrunmeSqcUazOYiW1Lpny3urIgnhWA6x4vbHvtBi_SlyZaBbgzHtbA==
expires: Mon, 02 May 2022 12:53:39 GMT

GET
H2 200 w_480_00003.ts Show response
video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/ 318 KB
318 KB 13ms
13ms XHR
video/mp2t 63.250.60.64
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/w_480_00003.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.60.64 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 65cb2d19e0e09cde90592edd13f83b8926ed880f735eee8253d29e9743d808fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:39 GMT
via: 1.1 b008895ea3b659b7dfd773d182993c34.cloudfront.net (CloudFront)
x-amz-cf-pop: BRU50-C1
content-length: 325240
last-modified: Mon, 06 Sep 2021 08:19:10 GMT
server: Tengine
etag: "283e37da1e220c1e5426efa6863a736e"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: hzJcn7rLOL92ldBAjbqBdYwBzbheHuITus-JSHKucq1XppXRHGR06Q==
expires: Mon, 02 May 2022 12:53:39 GMT

GET
H2 200 w_480_00004.ts Show response
video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/ 337 KB
338 KB 8ms
7ms XHR
video/mp2t 63.250.60.64
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/w_480_00004.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.60.64 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 12df3397684c6fc71404652d4f790486dbef21f1aa261b1da8c4cf7608de7d01

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:39 GMT
via: 1.1 cfa647edefc0769e715b9781478b0626.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
content-length: 345544
last-modified: Mon, 06 Sep 2021 08:19:10 GMT
server: Tengine
etag: "267a96f774ffc801a4213ea042b9c894"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: dpfjrA34vdhne9aPLkg4K_mr2LvALs13oWKLEFASZqWiFF4M59oR4Q==
expires: Mon, 02 May 2022 12:53:39 GMT

GET
H2 200 w_480_00005.ts Show response
video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/ 387 KB
388 KB 11ms
10ms XHR
video/mp2t 63.250.60.64
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn7/video/users/hls/30875/video_6135c3ae46289537299997/vid6135cdc05473c284871654.mp4/w_480_00005.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.60.64 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 8498a03651732407cfbbd2d6affe07365f4b947041088061fc1d6019d7d04ac2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:39 GMT
via: 1.1 d75767e25d58a643b0b793855f4459c8.cloudfront.net (CloudFront)
x-amz-cf-pop: BRU50-C1
content-length: 396492
last-modified: Mon, 06 Sep 2021 08:19:10 GMT
server: Tengine
etag: "ef807990b87fd1783dad67b37eed33c0"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: HnURTjj-F_qyDIYrquaf3fwenngvAdf-jQCBW-cDmc1opUWLxFxNZw==
expires: Mon, 02 May 2022 12:53:39 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 3000 281 B
554 B 31ms
8ms Document
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_11.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 18 Apr 2022 12:53:39 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame CED0 1 KB
1 KB 9ms
9ms Document
text/html 76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=true&
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_11.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: 4a034d73fc59fa2b8b67f47d51f260e570df4f7a9416f48e380793f1836e4e19

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 461
content-type: text/html; charset=utf-8
date: Mon, 18 Apr 2022 12:53:39 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 502F 15 KB
6 KB 7ms
7ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156595&gdpr=1&gdpr_consent=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_11.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=82956
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Mon, 18 Apr 2022 12:53:39 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Tue, 19 Apr 2022 11:56:15 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame CED0 70 B
264 B 32ms
31ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:39 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CED0
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=1&cmp_cs=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDcxNzkyOTkyNjgwNjgzNTk1NDcyNg%3D%3D

170 B
188 B

48ms
48ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDcxNzkyOTkyNjgwNjgzNTk1NDcyNg%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDcxNzkyOTkyNjgwNjgzNTk1NDcyNg%3D%3D
date: Mon, 18 Apr 2022 12:53:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame CED0 170 B
188 B 48ms
48ms Image
image/png 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CED0
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDcxNzkyOTkyNjgwNjgzNTk1NDcyNg%3D%3D

170 B
188 B

49ms
49ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDcxNzkyOTkyNjgwNjgzNTk1NDcyNg%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDcxNzkyOTkyNjgwNjgzNTk1NDcyNg%3D%3D
date: Mon, 18 Apr 2022 12:53:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 setuid
px.ads.linkedin.com/ Frame CED0 0
708 B 241ms
177ms Image
text/plain 2620:1ec:22::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4717929926806835954726&dbredirect=true&gdpr=1&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:22::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:38 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: C062E9EE0C26468AABE174B25DADE92D Ref B: VIEEDGE3319 Ref C: 2022-04-18T12:53:39Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXc7T/OV7YPm6H9x2zjpQ==

GET
H2

200

xuid
eb2.3lift.com/ Frame CED0
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/4717929926806835954726?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-WJ7KWHpE2oRkldSzyQ.YtFmI5jZcDS29iDbB56f0Aw--~A&dongle=0883

37 B
355 B

11ms
11ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-WJ7KWHpE2oRkldSzyQ.YtFmI5jZcDS29iDbB56f0Aw--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Mon, 18 Apr 2022 12:53:39 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-WJ7KWHpE2oRkldSzyQ.YtFmI5jZcDS29iDbB56f0Aw--~A&dongle=0883
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame CED0 43 B
220 B 9ms
8ms Image
image/gif 35.158.225.181
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=triplelift&user_id=4717929926806835954726&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.225.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-225-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:39 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 c.gif
c.bing.com/ Frame CED0 42 B
339 B 30ms
29ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=4717929926806835954726&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:39 GMT
etag: "8120eaf0ff3ad81:0"
last-modified: Fri, 18 Mar 2022 19:39:54 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 661E2760EFC54B8A8415317B2774DC22 Ref B: FRAEDGE1506 Ref C: 2022-04-18T12:53:39Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame CED0
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=4717929926806835954726
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=4717929926806835954726&dcc=t

0
0

101ms
101ms

Image
text/html

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=4717929926806835954726&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&
Protocol: HTTP/1.1
Server: 209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Mon, 18 Apr 2022 12:53:39 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 7CJSKB57A59AEFMQ2RH6
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=4717929926806835954726&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame CED0
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

37 B
139 B

8ms
8ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=true&
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 12:53:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma: no-cache
Date: Mon, 18 Apr 2022 12:53:39 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 95
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3000 32 KB
10 KB 7ms
6ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 2fc129edf90bfd24d24041d2b2441c833d93370fed52981b7bc0a21b90137afe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Mon, 18 Apr 2022 12:53:39 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=37089
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9539
Expires: Mon, 18 Apr 2022 23:11:48 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 3000 284 B
536 B 34ms
8ms Image
image/jpg 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?gdpr=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type: image/jpg

POST
H2 204 collect Show response
f.clarity.ms/ 0
48 B 92ms
91ms XHR
text/plain 20.84.22.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://f.clarity.ms/collect
Requested by: Host: f.clarity.ms
URL: https://f.clarity.ms/s/0.6.34/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.84.22.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin: https://www.androidpolice.com
date: Mon, 18 Apr 2022 12:53:40 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 47ms
47ms Ping
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-6Y5Q4PR4RC&gtm=2oe4d0&_p=1702481750&sr=1600x1200&_z=ccd.IBB&ul=en-us&cid=1589532412.1650286417&dl=https%3A%2F%2Fwww.androidpolice.com%2Fhackers-vlc-malware%2F&dr=https%3A%2F%2Ft.co%2F&dt=Chinese%20hackers%20are%20using%20VLC%20media%20player%20to%20launch%20malware%20attacks&sid=1650286416&sct=1&seg=0&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6Y5Q4PR4RC&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:42 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.androidpolice.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect Show response
f.clarity.ms/ 0
48 B 91ms
90ms XHR
text/plain 20.84.22.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://f.clarity.ms/collect
Requested by: Host: f.clarity.ms
URL: https://f.clarity.ms/s/0.6.34/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.84.22.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.androidpolice.com/hackers-vlc-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin: https://www.androidpolice.com
date: Mon, 18 Apr 2022 12:53:44 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2 200 liveView.php
live.primis.tech/live/ 0
356 B 24ms
24ms Image
text/html 2600:9000:2315:d000:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTI1JaNypaZypyRcoWU9MTY1MDI4NwQkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA4NTAjJaN0YT0jJat9NwAjJax9MmM4JaZcZF9jYXNmRG9gYWyhPXq3ql5uozRlo2yxpG9fnWNyLzNioSZmqWJJZD1upC1lZWpgo3JaX3q3ql5uozRlo2yxpG9fnWNyLzNioSZxZWJ1Z0yhZz9loWF0nW9hPSZcp0FjpD0jJaVmZXJJpEFxZHI9MzEjMlUmQTFvMwAyM0E2JTNBZwAkMSUmQSUmQTZyJaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwEjMC4jLwQ4OTYhNmUyMwBTYWZupzxyMxY1MmphMmYzY3N1qWyxPTYlNWQ1ZwUjM2QmNmMzY29hqGVhqEZcoGVJZD0jJz1yZGyuUGkurUkcp3RJZD0jJz1yZGyuTGymqEyxPTAzZHVlPTtjMCZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0jJzNwpGE9MCZwY3BuQ29hp2VhqD0zY2J1p3Rypw0kNwUjMwt2NDI0OTM4JaVcZD1TZWgcozRiU1BfYXyypwYlNWQ1ZwUjNTE3ODAzpHVvVXJfPWu0qHBmJTNBJTJGJTJGq3q3LzFhZHJinWRjo2kcY2UhY29gJTJGnGFwn2Vlpl12oGMgoWFfq2FlZSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQ=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:d000:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.androidpolice.com/hackers-vlc-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Apr 2022 12:53:44 GMT
via: 1.1 672ccfdef8d96b8bfc26646386cb4488.cloudfront.net (CloudFront)
server: nginx
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-pop: DUS51-P2
content-type: text/html; charset=UTF-8
x-amz-cf-id: oWZHjsIaNe43KcWFGjm7q2TqZSvBCJSkCI3C0CfGjeiKpaFrAl16TA==

Verdicts & Comments Add Verdict or Comment

183 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

86 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.3lift.com/sync	1970-01-20 04:34:22	Name: sync Value: CgoIoQEQpbrx5YMwCgoIgQIQpbrx5YMwCgoI4gEQpbrx5YMwCgoI5gEQpbrx5YMwCgoIhwIQpbrx5YMwCgkICRCluvHlgzAKCQg6EKW68eWDMAoJCAsQpbrx5YMwCgoIjAIQpbrx5YMwCgkIXxCluvHlgzA=
.t.co/	1970-01-20 11:55:00	Name: muc Value: 787b72f3-b771-4d56-87a4-59341cf3b641
www.androidpolice.com/	1969-12-31 23:59:59	Name: incomingTraffic Value: https%3A%2F%2Ft.co%2F
www.androidpolice.com/	1969-12-31 23:59:59	Name: viewType Value: organic
.convertkit.com/	1970-01-20 02:24:48	Name: __cf_bm Value: 4WZ_3ALmKrXR8HvplsVEimS2mKBJmZ5Edt.WzyZMDuE-1650286416-0-AeKP3DEzD6vkSHZygrpujXXrtCx2JQA6yfr6kUDEi4vtOf+fX6X7pGdRQz+P4evXEKq6LDuf5cky4uthfleEozm5ri9caQulj8KGJWM/nAyZ
.androidpolice.com/	1970-01-20 02:24:48	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://www.androidpolice.com/hackers-vlc-malware/%22%2C%22sref%22:%22https://t.co/%22%2C%22sts%22:1650286416283%2C%22slts%22:0}
.androidpolice.com/	1970-01-20 11:54:10	Name: _parsely_visitor Value: {%22id%22:%22pid=14b17f8a3cf6d1468740a4e2e2d991cf%22%2C%22session_count%22:1%2C%22last_session_ts%22:1650286416283}
www.clarity.ms/	1970-01-20 11:10:22	Name: CLID Value: 0eeca84a94394171ad18fa41bc7daed6.20220418.20230418
.ad.gt/	1970-01-20 02:26:12	Name: au_idmatch Value: eyJhcG4iOiAxNjUwMjg2NDE2NjQ4LCAidHRkIjogMTY1MDI4NjQxNjY0OCwgInB1YiI6IDE2NTAyODY0MTY2NDgsICJhZHgiOiAxNjUwMjg2NDE2NjQ4LCAiaGFsbyI6IDE2NTAyODY0MTY2NDgsICJnb28iOiAxNjUwMjg2NDE2NjQ4LCAib3BlbngiOiAxNjUwMjg2NDE2NjQ4LCAic29uIjogMTY1MDI4NjQxNjY0OCwgInVucnVseSI6IDE2NTAyODY0MTY2NDgsICJtZWRpYW1hdGgiOiAxNjUwMjg2NDE2NjQ4LCAicHBudCI6IDE2NTAyODY0MTY2NDgsICJiZWVzIjogMTY1MDI4NjQxNjY0OCwgInRhYm9vbGEiOiAxNjUwMjg2NDE2NjQ4LCAic21hcnQiOiAxNjUwMjg2NDE2NjQ4LCAicnViIjogMTY1MDI4NjQxNjY0OCwgImltcHIiOiAxNjUwMjg2NDE2NjQ4LCAiYWRvIjogMTY1MDI4NjQxNjY0OH0=
.3lift.com/	1970-01-20 04:34:22	Name: tluid Value: 4717929926806835954726
.casalemedia.com/	1970-01-20 11:10:22	Name: CMID Value: Yl1fUAXpC.7TJacXbW.QhgAA
.casalemedia.com/	1970-01-20 04:34:22	Name: CMPS Value: 3271
.adnxs.com/	1970-01-20 04:34:22	Name: uuid2 Value: 7389662982991471923
.spotxchange.com/	1970-01-20 11:10:22	Name: audience Value: 901fa428-bf16-11ec-a358-1d7abbad0206
.casalemedia.com/	1970-01-20 04:34:22	Name: CMPRO Value: 1113
.casalemedia.com/	1970-01-20 02:26:12	Name: CMST Value: Yl1fUWJdX1EA
.androidpolice.com/	1970-01-20 19:55:58	Name: _ga_6Y5Q4PR4RC Value: GS1.1.1650286416.1.0.1650286416.0
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_1d Value: AU1D-0100-001650286417-FFKNOTDX-3H3N
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_apn Value: 1650286417157
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_ttd Value: 1650286417157
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_pub Value: 1650286417157
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_adx Value: 1650286417157
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_halo Value: 1650286417157
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_goo Value: 1650286417157
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_openx Value: 1650286417157
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_son Value: 1650286417157
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_unruly Value: 1650286417157
.androidpolice.com/	1970-01-20 11:10:22	Name: _au_last_seen_mediamath Value: 1650286417157
.adsrvr.org/	1970-01-20 11:10:22	Name: TDID Value: 792d858a-f40f-4998-80b0-9589a3aa6526
.androidpolice.com/	1970-01-20 02:24:50	Name: AMP_TOKEN Value: %24NOT_FOUND
.androidpolice.com/	1970-01-20 19:55:58	Name: _ga Value: GA1.2.1589532412.1650286417
.androidpolice.com/	1970-01-20 02:26:12	Name: _gid Value: GA1.2.421336185.1650286417
.androidpolice.com/	1970-01-20 02:24:46	Name: _gat Value: 1
.tremorhub.com/	1970-01-20 11:10:43	Name: tvid Value: 88a542dc001b4395bd4923fc9fd38a0e
.narrativ.com/	1970-01-20 15:33:53	Name: uid_bam Value: 1771981548340665493
.adsrvr.org/	1970-01-20 11:10:22	Name: TDCPM Value: CAEYBSABKAIyCwjky9v5pdHQOhAFOAE.
www.androidpolice.com/	1970-01-20 02:26:12	Name: _lr_geo_location Value: DE
.creativecdn.com/	1970-01-20 11:10:22	Name: u Value: ew60bgDoqUNrWDTTXGAN
.creativecdn.com/	1970-01-20 11:10:22	Name: ts Value: 1650286417
.androidpolice.com/	1970-01-21 04:41:34	Name: _awl Value: 2.1650286417.0.5-a67513e069cc672b482650f1bfcf20d4-6763652d6575726f70652d7765737431-0
.adscale.de/	1970-01-20 11:07:02	Name: uu Value: e5c668e31ea84d1f9f80ad285d6f4583
.doubleclick.net/	1970-01-20 11:46:22	Name: IDE Value: AHWqTUkcL_-RFPa0plfOmdNZ6LrwyCglADke_psKSV0XvpCK0JodS6zApPV4r98SsAU
.ibillboard.com/	1970-01-20 11:10:22	Name: ibbid Value: BBID-01-03250004175712454-16580088
.androidpolice.com/	1970-01-20 11:10:22	Name: _clck Value: 51we0l\|1\|f0q\|0
.ad.gt/	1970-01-20 19:55:58	Name: last_seenunruly Value: 1650286417592
.ad.gt/	1970-01-20 19:55:58	Name: au_id Value: AU1D-0100-001650286417-FFKNOTDX-3H3N
.ad.gt/	1970-01-20 19:55:58	Name: last_seentd Value: 1650286417592
.ad.gt/	1970-01-20 19:55:58	Name: first_seentd Value: 1650286417592
.ad.gt/	1970-01-20 19:55:58	Name: last_seenadnxs Value: 1650286417593
.ad.gt/	1970-01-20 19:55:58	Name: first_seenadnxs Value: 1650286417593
.ad.gt/	1970-01-20 19:55:58	Name: last_seeng_hosted Value: 1650286417593
.ad.gt/	1970-01-20 19:55:58	Name: g_hosted Value:
.androidpolice.com/	1970-01-21 04:41:34	Name: _admrla Value: 2.0-a67513e0-69cc-672b-4826-50f1bfcf20d4
.mathtag.com/	1970-01-20 11:50:41	Name: uuid Value: f457625d-5f52-4800-98df-ad5f597ab011
.adform.net/	1970-01-20 03:07:58	Name: C Value: 1
.adform.net/	1970-01-20 03:51:10	Name: uid Value: 3887939266147751660
.ad.gt/	1970-01-20 19:55:58	Name: last_seenhaloid Value: 1650286417593
.ad.gt/	1970-01-20 19:55:58	Name: first_seenhaloid Value: 1650286417593
.ad.gt/	1970-01-20 19:55:58	Name: last_seenadx Value: 1650286417593
.ad.gt/	1970-01-20 19:55:58	Name: first_seenadx Value: 1650286417593
.androidpolice.com/	1970-01-20 02:26:12	Name: _clsk Value: 170bg7y\|1650286417842\|1\|1\|f.clarity.ms/collect
.criteo.com/	1970-01-20 11:46:22	Name: uid Value: 3954445a-0b39-46c4-91c5-0efaa65fa778
.console.adtarget.com.tr/	1970-01-20 03:54:03	Name: a544989 Value: ${USER_ID}
.console.adtarget.com.tr/	1970-01-20 03:54:03	Name: a550070 Value: ${USER_ID}
.console.adtarget.com.tr/	1970-01-20 03:54:03	Name: a502624 Value: ${USER_ID}
.console.adtarget.com.tr/	1970-01-20 03:54:03	Name: a307080 Value: ew60bgDoqUNrWDTTXGAN
.console.adtarget.com.tr/	1970-01-20 03:54:03	Name: a550214 Value: ${USER_ID}
.console.adtarget.com.tr/	1970-01-20 03:54:03	Name: a306708 Value: ${USER_ID}
.ad.gt/	1970-01-20 19:55:58	Name: last_seenmediamath Value: 1650286417872
.console.adtarget.com.tr/	1970-01-20 03:54:03	Name: vmuid Value: dbb4b7ae1e04524d
.console.adtarget.com.tr/	1970-01-20 03:54:03	Name: a307565 Value: e5c668e31ea84d1f9f80ad285d6f4583
.adscale.de/	1970-01-20 11:07:02	Name: cct Value: 1650286418214
.m6r.eu/	1970-01-20 02:24:50	Name: test Value: true
.m6r.eu/	1970-01-20 04:34:22	Name: cct Value: 1650286418356
.m6r.eu/	1970-01-20 04:34:22	Name: id Value: a65462d315c203f2ccfdb52aa9f210f2
.ih.adscale.de/	1970-01-20 11:07:02	Name: tu Value: 4#2721351961#48~a65462d315c203f2ccfdb52aa9f210f2~458412~0~0#101~BBID-01-03250004175712454-16580088~458412~0~0#38~CAESEIAhbJWZV8UDZ_6YLKh2WrM~458412~0~0#39~f457625d-5f52-4800-98df-ad5f597ab011~458412~0~0#40~3954445a-0b39-46c4-91c5-0efaa65fa778~458412~0~0#42~3887939266147751660~458412~0~0#75~7389662982991471923~458412~0~0#63~Yl1fUAXpC.7TJacXbW.QhgAA&1113~458412~0~0
.c.bing.com/	1970-01-20 11:46:22	Name: SRM_B Value: 1C16A8E6A8576BE71376B96CA93C6A6F
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 11:46:22	Name: MUID Value: 1C16A8E6A8576BE71376B96CA93C6A6F
.c.clarity.ms/	1970-01-20 02:24:47	Name: ANONCHK Value: 0
.bing.com/	1970-01-20 11:46:22	Name: MUID Value: 3E3F3074ABB86F072B1E21FEAAD36E3F
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 19:56:40	Name: bcookie Value: "v=2&8cfa3f18-c3e8-4b88-8264-2ae70f47523c"
.linkedin.com/	1970-01-20 19:39:13	Name: li_gc Value: MTswOzE2NTAyODY0MTk7MjswMjFHI251Dcwsuri7wcJvHaXjOgwwq4X42OABXYTLyvPVvA==
.linkedin.com/	1970-01-20 02:26:12	Name: lidc Value: "b=TGST04:s=T:r=T:a=T:p=T:g=2697:u=1:x=1:i=1650286419:t=1650372819:v=2:sig=AQGqobwiTJTpgthg0UEN5A-IvWhBa5K8"
.yahoo.com/	1970-01-20 11:10:44	Name: A3 Value: d=AQABBFNfXWICEFSdu7QOD0EKP-YT-lEsxqgFEgEBAQGwXmJnYgAAAAAA_eMAAA&S=AQAAAvPjRg5WWXjvh8QwQw4JHQU

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

60687.publishers.tremorhub.com
a.ad.gt
ads.pubmatic.com
adscale-emea.adnxs.com
ampcid.google.com
ampcid.google.de
androidpolice.disqus.com
api.narrativ.com
app.convertkit.com
ats.rlcdn.com
b1sync.zemanta.com
bbnaut.ibillboard.com
c.amazon-adsystem.com
c.bing.com
c.clarity.ms
c2shb.pubgw.yahoo.com
cdn.id5-sync.com
cdn.parsely.com
cm.adform.net
cm.g.doubleclick.net
creativecdn.com
csync.loopme.me
dis.criteo.com
eb2.3lift.com
eus.rubiconproject.com
events.release.narrativ.com
f.clarity.ms
f.convertkit.com
flip.it
fonts.googleapis.com
fonts.gstatic.com
geo.privacymanager.io
googleads.g.doubleclick.net
hbopenbid.pubmatic.com
id.halo.ad.gt
ids.ad.gt
ih.adscale.de
image2.pubmatic.com
image6.pubmatic.com
images.getadmiral.com
js.adscale.de
live.primis.tech
ls.skimresources.com
match.adsrvr.org
p.ad.gt
p.skimresources.com
p1.parsely.com
pagead2.googlesyndication.com
pixel.rubiconproject.com
pixels.ad.gt
pr-bh.ybp.yahoo.com
prebid-server.rubiconproject.com
px.ads.linkedin.com
r.skimresources.com
s.amazon-adsystem.com
s.console.adtarget.com.tr
s.skimresources.com
scarfsmash.com
search.spotxchange.com
secure.adnxs.com
secure.cdn.fastclick.net
securepubads.g.doubleclick.net
seg.ad.gt
ssum-sec.casalemedia.com
ssum.casalemedia.com
static.adsafeprotected.com
static.narrativ.com
static1.anpoimages.com
stats.g.doubleclick.net
sync.1rx.io
sync.console.adtarget.com.tr
sync.go.sonobi.com
sync.mathtag.com
sync.search.spotxchange.com
t.co
t.skimresources.com
tagan.adlightning.com
tlx.3lift.com
token.rubiconproject.com
track.adform.net
tracking.m6r.eu
u.openx.net
unpkg.com
video.primis.tech
www.androidpolice.com
www.clarity.ms
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
104.244.42.197
104.89.31.187
108.157.4.36
142.250.186.98
143.204.95.188
143.204.98.122
143.204.98.49
15.197.193.217
151.139.128.11
178.162.133.149
178.250.2.151
18.156.156.167
18.194.231.56
18.196.159.207
18.66.245.59
18.66.248.107
18.66.248.54
185.184.8.90
185.33.220.242
185.64.189.110
185.94.180.124
185.94.180.125
194.213.62.37
198.47.127.19
199.232.192.134
20.84.22.197
204.237.133.116
209.54.176.128
213.19.147.44
216.200.232.249
216.58.212.162
23.205.235.133
23.227.139.243
23.35.236.201
23.35.236.247
23.88.75.189
2600:1f18:612b:4200:fed4:35ed:3821:843c
2600:9000:2156:2a00:f:4f64:8940:93a1
2600:9000:2156:600:8:48e:53c0:93a1
2600:9000:2315:d000:1a:5235:f980:93a1
2606:4700:10::6816:4485
2606:4700:3037::ac43:c1e6
2606:4700::6810:7eaf
2606:4700::6812:ba39
2606:4700::6812:c039
2620:1ec:22::14
2620:1ec:27::cafe:1784
2620:1ec:c11::200
2a00:1450:4001:803::2002
2a00:1450:4001:810::200a
2a00:1450:4001:812::2002
2a00:1450:4001:813::200e
2a00:1450:4001:829::2008
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2003
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::200e
2a00:1450:4001:831::2004
2a00:1450:4001:831::200e
2a00:1450:400c:c00::9c
2a05:d018:d29:3601:ceb4:b945:274f:b273
2a0c:5c81:5095:0:225:90ff:fefa:245d
3.228.106.126
34.120.117.212
34.210.126.15
34.213.63.176
35.158.225.181
35.186.249.84
35.190.59.101
35.190.91.160
35.201.67.47
35.244.159.8
35.85.185.37
37.157.4.39
37.252.173.228
44.196.161.176
44.239.49.199
44.240.45.112
46.105.202.126
52.142.114.2
52.205.167.202
52.28.203.152
52.32.125.98
54.236.193.207
63.250.60.64
64.74.236.63
69.173.144.165
72.251.244.141
76.223.111.18
0375b396ee741813158bda96fabc3295611b9ca67cd367aa31193cf80dacfe95
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
05fde9258245fd1d1558ca071a747faedbd1a573c67e512d6b728cba8d6a37b8
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
072d79a68f4d26fa98cb86e05d9214b0c8c749bd4ed0a660bc8695842133ca20
07da28929f6d4cb8894de074ff1ae095860bf6686c7bb3024168c6c8e5e65ad8
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0f25eef1f15c5be98d251cc8b60a3cdaf0bb23672d313c8a62dd2037bbb7488e
0f4020071f4d6fbd6e07ddb16daf4859441c7454a0c733b019f7cb1adc8f4d49
12df3397684c6fc71404652d4f790486dbef21f1aa261b1da8c4cf7608de7d01
154212eb976f7df7c79f5844fcb356740bcb6c51edacb2e8515108e2d7effa67
1909b2a83fd41494d94862c4323944d9d0aa1f1e653f252ea5a73fc5944308b0
1d40f54cfc8d8edfd938608ca2eb84873935f28e1a8840ed61da9660fdb049c8
1fa491f5c8a044e852f26a4748b74422b23c8b1050e2c1d2f401aa99462c7a4e
2880fbb26ad5becd41ec25a5c37da351ac77225bbf30d5a9ab8accf5728591cf
295941492338af0acc646044f4ad42adc96e631ae2bc38066d7cbbb79e6fd87b
2ad3e1ebf36f4d5375c097486e514befc0294cf035eb492965b32a3274e6fed0
2d982a78b1da56ba84ff4f57aad9715cef56b27e56f4ed18f5b831a0f4d7d2e6
2dfb55c8cf1231157cf22e07888a514d894fb5605b2922e3ae0a231961929c86
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f65b37814d674a38e2813bcb3fd9590d449087dfb30420deec70327fef7d1cc
2fc129edf90bfd24d24041d2b2441c833d93370fed52981b7bc0a21b90137afe
312b9a7650f099cdaf7377c792b6ae450b241d4da9b568e13266e51099564ab4
340b20f9ff6d073c2fea911631d8a6e13af185d983cbe842ddca27df91d0f295
344437e4071c5e832f8c1c0d53b7de623d956c8e9b3330b6393a73d55f268bd1
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
3516496d97f72bf509cf5d6902b5deebf53355ccb21127dc777d265cd96ca2d8
35b7de4f69f748fae0535137551a16455c0564d4b6622b559eabac561b301b09
3deee04e2d853c3ad7d85928d921d718cc63f9fc04c8923cb786e6a46d5c55f4
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
442635fd9dd8454f6a6a52bba89a9ba2f98d4f97aefa02d6de453dc5b646639a
45767d3452a56be0180eed18ff44acd5e688dc5bbde2b77e1da29b326a180416
46e15ddd3f3583786961d72eb1a81b34bc9dad89240a461dcf02b43c6aa9e9c7
47fa5c66f03d068c31d3725d55e48e5bf7db9c21aed436b7ef92c98a697cdbdb
483a7f118083f3e8a3dd158b2cd95fb6cb420486d0ee4ab2a0876bb78d0ba11f
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4a034d73fc59fa2b8b67f47d51f260e570df4f7a9416f48e380793f1836e4e19
4b3f9cfb0906d42c830920a7a3421e88209843ed315abea5069b32ccd2b23a1c
4d55a5de2de1619c7f59562b161f71c2446c671f6380ec56cbf62f08e6ed67b0
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5091b7a94587298e3dd03fd1b65e2e25ccdac74b50f863b937f1cbdf6cd4f1ab
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
585ba2e57fc8fcc73e0fb77c7a0b8a11bac98f17c9233d5ecfe5b59bc5d88ddf
59a16e2c5c3e0462cd3e8cd364d0de38b9fe2c4cc7a333873e3b98a4fa4fdf7b
5bb08412d18881e3fc69fdb44226bfc6f66a77d45dfff3f10b98a100c09bc970
616f41fbbcf44ba72bb9c97132871526164c81d78f56a15e04ece1a44eb5606a
624d529e0da6719af2df6d25615df0c3a7b2dd28c015a731dd0341f0600c5d12
6378f6326c6b8ed5ba7c9dd71718f4acfab15effd24a9c83974e4e8ea473879e
63f40bc64828be3f87721479e2a3dc1ca58fc088087021e85d17954ef95d9deb
65cb2d19e0e09cde90592edd13f83b8926ed880f735eee8253d29e9743d808fa
68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17
6a18ce19aa8cf074d7a5d3ee52e90ef242cfb5b280ddef98d0e0d5b3f44230e0
6e75948ee66bf6e7da9235ee5cecbda03fa7f592a3f08193757202be43d6cb38
718ec297d21980282f853ebe81a67e1cce9c6fce3c4770d81bf092172bd21ad1
75919955645a9682fe4bee98b1315198fef7ba09b5d6a6e67b78221fad6f0b72
768ae46ee32393ad013c514cd6708bef24fc9a66efb71b1f4b0e73b0a3a5a736
7b28e862e09e23941b995612f4529779d94d918e8c9a5d3cf1d18657dda85189
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7ea26c2e155afa821d8a157303a6dc302c9d1740b36ae5313f0ece87a60c1e8f
7f1aff18e0220f2872b307e783eb430317fbee8e32ac24dedba5bea3f9b89a05
8498a03651732407cfbbd2d6affe07365f4b947041088061fc1d6019d7d04ac2
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86620b292691b6d6621e00a6439123afe65ac8317a6c48ddcad68a1c85bbe606
8b025d662daffd60182ba7a8c9e02a5ce11a2377512196ee55a1148e2da83269
8b0d1446f412484a2a7d1abb46ddc5de128d8aaf11b1fe04ac729ee4830c5e5b
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8dad17c7c62057440ce13ba42120968005b66d0d7125df6b3086e8588fded21e
8db46253e49e6fa2e93c512956b60ab63812fa36c38b7929061901fe3de8a842
8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7
9115bbf3b3dee88764e74ecdf31c2234ece91aa42a596a1d3ba11925662777ba
926952e0833e0acb9dd02fdbbe59bb8be77f8e7571aaedc900649b9513500e8b
9471fcb6a2b246f9c071b322b7bf1eb81986b04c7f195cc592375512fc764ab4
9476350068dbd8b61373906f6d9dba49ed31ed5d64d6ee2d48da082c44a447dc
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9bb4ae2fca6846a5b868ac0c39b2a40aa47fdfaa47c08ae263df7ab0d0f42400
9e9369b1246a6b2dcc7768899b1887d3b16991218f3732a629db9f55d6d78faa
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a20010b26bce05ea3cfc83cf3a162b7c16b5d2fa2bcf2253b0394b0eb322347a
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952
a75813b4201c02796e8facc83473c8434ba838e9d3da66eef6e9bc2d1ac14b9e
abb98339ec7c9f02553339d938dad9af771257631486dca1cddba19f79d8880b
ae1662349ff25bf23f2d8c4d4affd74d2531892eac8dabfd7a05d80459c36583
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3e57eb372e8b405c816875571e184854b2846261c7477c6c9bdb7782faa1a30
b7b7fb37ec681a6a1bd507ce80613c7343fb3b394b29e21e7b11d6a6df933f68
b93847bd3e772bf892656b4d330d6ef31c5fe45e0dc36b6e013e269179842288
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c16fe63d5e6c3d1acc9b2aedec440d98db4ebd7ea1bdfe9f26aab74e7be91a7e
c2f1e02e54fe66adc0d5f1f06048c30bb7cdf2645b7e0fc48c881923868f5f27
c5d5e7f685c3bb91e84b94b6738310b8e2de4056b4668c42131ec64b3f014e40
c66255eb60dbcde1c689b13106d077f62deaa59e9378299d22877b5530f55e22
c82fab08e93db8934a27f5b26ddf48c8a013a92a21ea15b7fa8b675b0d866040
c9c969c534018935993ccb32e0057bb637ba4898ed5784b8a86302961e3f0e99
ca38ab561201a1a68867f61d4fb3df9682756c8927fe80f047624e7ef662f0f3
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d26722e46b6160f5002ed50941243b07040e2b9b84481688c7256d4fb742684d
d4ed5bd20c3036042165e91001bd91497551164b0e34c76cb8a6eb15c33f3c15
d6447b819f1671061eaef6eb9a388b162c8714aed75720e7e4a579f738e30cb6
daac16a8dcbf772343d560088f23516e8235ab8c3450cae85cc1c61ad4aa6db2
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e257df7266563e157bb7df93fd09c6d13afb1c9554468b21c7378e09a94d3250
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3f1e8c4477a44fd69e054161ef70cf191245d93c3d0da92dcddc4f247cacfff
e6ac25d541d15d00d8ac79cbb7e6f917732a768e2a187f5cf1ce2c255c7cec07
e8fd802ce5042d308a2d650c3db8f60b2bd3b884f34d6ceabe0631a3a9e226f5
e963e7196beb9123059ec3534b042ebcd1ef0a470fa568bfbebfeab2f33c4fda
ec18402893a21599c176380ba7c61edc2704117b770f9660d013feac23b8074e
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3ffeed0ceb0e14dfa1f0bd0fa79520b976f0ef6644190e09a2a1520feb76322
f50f06ac57aa3db04b5928db1c838b00f200b57f7f80c2e54963edfe918ed196
f9bd12e6397dfdd0a68abf19b2aab828c52394fbf8810483f9d2103430d8c06d
f9cb9f7bd06d68d6a2cd9c9f52d0e49a3199a57a7bc6ce9bc22f881af21d8004
fbe72bd9c443125dbadb506dd1059c8e95d959617c383b87f7e03cbdf39bc98b
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
ffc4b44e1b7402c08e5f2f702ca535e7e7083a684cda203dfdcb734cd5761aa6

www.androidpolice.com Open in urlscan Pro 44.196.161.176 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

194 Requests

85 %HTTPS

29 %IPv6

56 Domains

92 Subdomains

76 IPs

9 Countries

5157 kBTransfer

8942 kBSize

86 Cookies

14 Outgoing links

Page URL History

Redirected requests

194 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.androidpolice.com Open in urlscan Pro
44.196.161.176 Public Scan

Screenshot
Live screenshot

Full Image

194
Requests

85 %
HTTPS

29 %
IPv6

56
Domains

92
Subdomains

76
IPs

9
Countries

5157 kB
Transfer

8942 kB
Size

86
Cookies

194 HTTP transactions
0 data transactions