nakedsecurity.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42e3 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Submission: On September 08 via manual (September 8th 2022, 10:23:23 pm UTC) from US — Scanned from DE

Summary HTTP 109 Redirects Links 46 Behaviour Indicators

Summary

This website contacted 32 IPs in 7 countries across 28 domains to perform 109 HTTP transactions. The main IP is 2a04:fa87:fffd::c000:42e3, located in Ireland and belongs to AUTOMATTIC, US. The main domain is nakedsecurity.sophos.com. The Cisco Umbrella rank of the primary domain is 218460.
TLS certificate: Issued by R3 on August 10th 2022. Valid for: 3 months.

This is the only time nakedsecurity.sophos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
20	2a04:fa87:fff... 2a04:fa87:fffd::c000:42e3	2635 (AUTOMATTIC) (AUTOMATTIC)
16	23.75.243.91 23.75.243.91	16625 (AKAMAI-AS) (AKAMAI-AS)
25	192.0.123.248 192.0.123.248	2635 (AUTOMATTIC) (AUTOMATTIC)
2 6	2a00:1450:400... 2a00:1450:4001:80e::2008	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a02:26f0:10e... 2a02:26f0:10e::6860:5bba	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	199.232.136.157 199.232.136.157	54113 (FASTLY) (FASTLY)
1	162.159.152.17 162.159.152.17	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	52.54.24.90 52.54.24.90	14618 (AMAZON-AES) (AMAZON-AES)
1	52.222.177.228 52.222.177.228	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::4000	10310 (YAHOO-1) (YAHOO-1)
1	52.2.80.154 52.2.80.154	14618 (AMAZON-AES) (AMAZON-AES)
1	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f10... 2a03:2880:f107:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
2	2620:1ec:27::... 2620:1ec:27::cafe:1774	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
1	96.16.149.96 96.16.149.96	16625 (AKAMAI-AS) (AKAMAI-AS)
1	108.138.17.87 108.138.17.87	16509 (AMAZON-02) (AMAZON-02)
2 2	2a00:1450:400... 2a00:1450:400c:c06::9a	15169 (GOOGLE) (GOOGLE)
2 3	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
2 6	52.222.214.8 52.222.214.8	16509 (AMAZON-02) (AMAZON-02)
1	18.66.97.46 18.66.97.46	16509 (AMAZON-02) (AMAZON-02)
2 2	52.213.154.120 52.213.154.120	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2	20.84.22.197 20.84.22.197	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1 2	20.234.93.27 20.234.93.27	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
109	32

20 2a04:fa87:fffd::c000:42e3 (Ireland)

ASN2635 (AUTOMATTIC, US)

nakedsecurity.sophos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 23.75.243.91 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-75-243-91.deploy.static.akamaitechnologies.com

www.sophos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 192.0.123.248 (Los Angeles, United States)

ASN2635 (AUTOMATTIC, US)
PTR: polldaddy.com

polldaddy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10e::6860:5bba (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.152.17 (None, )

ASN13335 (CLOUDFLARENET, US)

a.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.54.24.90 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-24-90.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.177.228 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-177-228.ham50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.2.80.154 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-80-154.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f107:83:face:b00c:0:25de (Vienna, Austria)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:27::cafe:1774 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.16.149.96 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-149-96.deploy.static.akamaitechnologies.com

img03.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.17.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-17-87.fra56.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c06::9a (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.222.214.8 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-8.fra56.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.46 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-46.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.213.154.120 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-154-120.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.84.22.197 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

f.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.234.93.27 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	sophos.com nakedsecurity.sophos.com — Cisco Umbrella Rank: 218460 www.sophos.com — Cisco Umbrella Rank: 131554	560 KB
25	polldaddy.com polldaddy.com — Cisco Umbrella Rank: 39530	14 KB
7	company-target.com 2 redirects segments.company-target.com — Cisco Umbrella Rank: 2581 api.company-target.com — Cisco Umbrella Rank: 8494	4 KB
6	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 787 f.clarity.ms — Cisco Umbrella Rank: 6813 c.clarity.ms — Cisco Umbrella Rank: 1178	26 KB
4	google-analytics.com 2 redirects ssl.google-analytics.com — Cisco Umbrella Rank: 427	17 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 894 www.linkedin.com — Cisco Umbrella Rank: 847 px4.ads.linkedin.com — Cisco Umbrella Rank: 6869	3 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 4933	7 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 664 c.bing.com — Cisco Umbrella Rank: 408	13 KB
3	google.de www.google.de — Cisco Umbrella Rank: 3469	674 B
3	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 19	915 B
3	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 73 stats.g.doubleclick.net — Cisco Umbrella Rank: 188	2 KB
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 846	1019 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 111	388 B
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 638	7 KB
2	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 2308 insight.adsrvr.org — Cisco Umbrella Rank: 908	3 KB
2	quora.com a.quora.com — Cisco Umbrella Rank: 9836 q.quora.com — Cisco Umbrella Rank: 4319	15 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 208	111 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 3365 pixel.wp.com — Cisco Umbrella Rank: 2898	3 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 141	105 KB
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 885	98 B
1	demandbase.com scripts.demandbase.com — Cisco Umbrella Rank: 16494	16 KB
1	en25.com img03.en25.com — Cisco Umbrella Rank: 34192	3 KB
1	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1672	631 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 870	353 B
1	t.co t.co — Cisco Umbrella Rank: 600	336 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 159	16 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 996	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1614	3 KB
109	28

	Domain	Requested by
25	polldaddy.com	nakedsecurity.sophos.com polldaddy.com
20	nakedsecurity.sophos.com	nakedsecurity.sophos.com
16	www.sophos.com	nakedsecurity.sophos.com
6	segments.company-target.com	2 redirects nakedsecurity.sophos.com
4	ssl.google-analytics.com	2 redirects nakedsecurity.sophos.com
4	tags.srv.stackadapt.com	nakedsecurity.sophos.com tags.srv.stackadapt.com
3	www.google.de	nakedsecurity.sophos.com
3	www.google.com	2 redirects nakedsecurity.sophos.com
3	bat.bing.com	nakedsecurity.sophos.com bat.bing.com
2	c.clarity.ms	1 redirects
2	f.clarity.ms	www.clarity.ms
2	match.prod.bidr.io	2 redirects
2	stats.g.doubleclick.net	2 redirects
2	www.clarity.ms	bat.bing.com www.clarity.ms
2	px.ads.linkedin.com	2 redirects
2	www.facebook.com	nakedsecurity.sophos.com
2	s.yimg.com	nakedsecurity.sophos.com s.yimg.com
2	connect.facebook.net	nakedsecurity.sophos.com connect.facebook.net
2	www.googletagmanager.com	nakedsecurity.sophos.com www.googletagmanager.com
1	c.bing.com	1 redirects
1	insight.adsrvr.org	js.adsrvr.org
1	id.rlcdn.com	nakedsecurity.sophos.com
1	api.company-target.com	scripts.demandbase.com
1	scripts.demandbase.com	nakedsecurity.sophos.com
1	pixel.wp.com	nakedsecurity.sophos.com
1	img03.en25.com	nakedsecurity.sophos.com
1	sp.analytics.yahoo.com	nakedsecurity.sophos.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	analytics.twitter.com	nakedsecurity.sophos.com
1	t.co	nakedsecurity.sophos.com
1	px4.ads.linkedin.com	nakedsecurity.sophos.com
1	www.linkedin.com	1 redirects
1	www.googleadservices.com	www.googletagmanager.com
1	q.quora.com	nakedsecurity.sophos.com
1	js.adsrvr.org	www.googletagmanager.com
1	a.quora.com	nakedsecurity.sophos.com
1	static.ads-twitter.com	nakedsecurity.sophos.com
1	snap.licdn.com	nakedsecurity.sophos.com
1	stats.wp.com	nakedsecurity.sophos.com
109	39

This site contains links to these domains. Also see Links.

Domain
www.sophos.com
home.sophos.com
www.facebook.com
twitter.com
www.linkedin.com
reddit.com
cheatsheetseries.owasp.org
sites.google.com
www.instagram.com
aws.amazon.com
wpvip.com

Subject Issuer	Validity	Valid
nakedsecurity.sophos.com R3	`2022-08-10` - `2022-11-08`	3 months	crt.sh
www.sophos.com GlobalSign Extended Validation CA - SHA256 - G3	`2022-01-05` - `2023-02-06`	a year	crt.sh
*.polldaddy.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-12` - `2022-11-14`	2 years	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2022-06-11` - `2023-07-12`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2022-09-03` - `2023-03-03`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-06-18` - `2022-09-16`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-08-22`	a year	crt.sh
quora.com R3	`2022-07-10` - `2022-10-08`	3 months	crt.sh
*.srv.stackadapt.com Amazon	`2021-11-09` - `2022-12-07`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-09-05` - `2022-10-26`	2 months	crt.sh
*.quora.com R3	`2022-08-21` - `2022-11-19`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2022-02-27` - `2023-02-27`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-08-09` - `2023-02-01`	6 months	crt.sh
*.en25.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-17` - `2023-07-18`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2022-08-17` - `2023-09-18`	a year	crt.sh
*.company-target.com Amazon	`2022-08-01` - `2023-08-30`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2021-10-20` - `2022-09-26`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
a.clarity.ms Microsoft Azure TLS Issuing CA 02	`2022-06-07` - `2023-06-02`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Frame ID: 41F6DC5683ADFA7FEFCEA498324EEACA
Requests: 106 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&upid=ql4fc2b&upv=1.1.0
Frame ID: F27E7CFBE41741572F80B7E675FFFEC3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

How scammers abuse Google Search’s open redirect feature – Naked Security

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Page Statistics

109
Requests

94 %
HTTPS

37 %
IPv6

28
Domains

39
Subdomains

32
IPs

7
Countries

941 kB
Transfer

2272 kB
Size

45
Cookies

46 Outgoing links

These are links going to different origins than the main page.

URL: https://www.sophos.com/

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products
Title: Products

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/free-tools.aspx
Title: Free Tools

Search URL Search Domain Scan URL

URL: https://home.sophos.com/en-us.aspx
Title: Free Sophos Home

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/next-gen-firewall.aspx
Title: XG Firewall Next-Gen Firewall

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/intercept-x.aspx
Title: Intercept X Next-Gen Endpoint

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/cloud-optix.aspx
Title: Sophos Cloud Optix

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/sophos-central.aspx
Title: Sophos Central

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/mobile-control.aspx
Title: Sophos Mobile

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/server-security.aspx
Title: Intercept X for Server

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/secure-wifi.aspx
Title: Secure Wi-Fi

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/phish-threat.aspx
Title: Phish Threat

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/safeguard-encryption.aspx
Title: SafeGuard Encryption

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/sophos-email.aspx
Title: Secure Email

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/unified-threat-management.aspx
Title: SG UTM

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/secure-web-gateway.aspx
Title: Secure Web Gateway

Search URL Search Domain Scan URL

URL: https://home.sophos.com/
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/free-tools.aspx
Title: Free Security Tools

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/free-trials.aspx
Title: Free Trials

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/demos.aspx
Title: Product Demos

Search URL Search Domain Scan URL

URL: https://www.facebook.com/share.php?u=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&title=How+scammers+abuse+Google+Search%E2%80%99s+open+redirect+feature

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=How+scammers+abuse+Google+Search%E2%80%99s+open+redirect+feature+https%3A%2F%2Fnakedsecurity.sophos.com%2F%3Fp%3D496373

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&title=How+scammers+abuse+Google+Search%E2%80%99s+open+redirect+feature

Search URL Search Domain Scan URL

URL: https://reddit.com/submit/?url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&title=How+scammers+abuse+Google+Search%E2%80%99s+open+redirect+feature

Search URL Search Domain Scan URL

URL: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
Title: open redirect

Search URL Search Domain Scan URL

URL: https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect
Title: doesn’t consider open redirects to be a security issue

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/phish-threat.aspx
Title: Sophos Phish Threat

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/next-gen-firewall.aspx
Title: XG Firewall

Search URL Search Domain Scan URL

URL: https://twitter.com/nakedsecurity
Title: @NakedSecurity on Twitter

Search URL Search Domain Scan URL

URL: https://www.instagram.com/nakedsecurity/
Title: @NakedSecurity on Instagram

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/free-tools/sophos-xg-firewall-home-edition.aspx
Title: Sophos Firewall Home Edition Boost your home network security.

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx
Title: Sophos Scan & Clean Free second-opinion scanner for PCs.

Search URL Search Domain Scan URL

URL: https://aws.amazon.com/marketplace/pp/prodview-7silxvfxce4zq?qid=1599237395672&sr=0-1&ref_=srh_res_product_title
Title: Sophos Cloud Optix Monitor 25 cloud assets for free.

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/company.aspx
Title: About Sophos

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/sophos-group-privacy-policy.aspx
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal.aspx
Title: Legal

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/intercept-x.aspx
Title: Intercept X

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/server-security.aspx
Title: Intercept X for Server

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/mobile-control.aspx
Title: Intercept X for Mobile

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/sophos-email.aspx
Title: Sophos Email

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/secure-wifi.aspx
Title: Sophos Wireless

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/managed-threat-response.aspx
Title: Managed Threat Response

Search URL Search Domain Scan URL

URL: https://twitter.com/NakedSecurity

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SophosSecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/5053/

Search URL Search Domain Scan URL

URL: https://wpvip.com/?utm_source=vip_powered_wpcom&utm_medium=web&utm_campaign=VIP%20Footer%20Credit&utm_term=nakedsecurity.sophos.com
Title: WordPress VIP

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1662675797981&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1662675797981%26url%3Dhttps%253A%252F%252Fnakedsecurity.sophos.com%252F2020%252F05%252F15%252Fhow-scammers-abuse-google-searchs-open-redirect-feature%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1662675797981&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1662675797981&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&liSync=true&e_ipv6=AQICJz-MXeaaWwAAAYMfM0nH0hcvyYjnesHgRO0SiICZNtdKI2HBPsAL-PTRgnX6oIdNJVRP

Request Chain 75

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1144736546&utmhn=nakedsecurity.sophos.com&utme=8(4!CampaignID)9(4!70130000001xGqlAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&utmhid=849882839&utmr=-&utmp=%2Fnakedsecurity%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&utmht=1662675798242&utmac=UA-737537-1&utmcc=__utma%3D1.1098213058.1662675798.1662675798.1662675798.1%3B%2B__utmz%3D1.1662675798.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1744475701&utmredir=1&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-737537-1&cid=1098213058.1662675798&jid=1744475701&_v=5.7.2&z=1144736546 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1098213058.1662675798&jid=1744475701&_v=5.7.2&z=1144736546 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1098213058.1662675798&jid=1744475701&_v=5.7.2&z=1144736546&slf_rd=1&random=694981235

Request Chain 76

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=895871280&utmhn=nakedsecurity.sophos.com&utme=8(4!CampaignID)9(4!70130000001xGqlAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&utmhid=849882839&utmr=-&utmp=%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&utmht=1662675798245&utmac=UA-737537-25&utmcc=__utma%3D222203399.1204528877.1662675798.1662675798.1662675798.1%3B%2B__utmz%3D222203399.1662675798.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1681030097&utmredir=1&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~ HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-737537-25&cid=1204528877.1662675798&jid=1681030097&_v=5.7.2&z=895871280 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1204528877.1662675798&jid=1681030097&_v=5.7.2&z=895871280 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1204528877.1662675798&jid=1681030097&_v=5.7.2&z=895871280&slf_rd=1&random=837384190

Request Chain 80

https://segments.company-target.com/l/dmVuZG9yPW1hcmlwb3NhJnAxPWV4YW1wbGUuY29tJnRva2VuPWYyNTE0ZTIyMjNmMjcxZGUzMDBiMTkwOGMyYzkwYzkxMWJlZDc4ZDc= HTTP 303
https://segments.company-target.com/validateCookie?vendor=mariposa&user_id=example.com&verifyHash=ba6fe5045ef595e4626b82cc380bdd348e24ea0b

Request Chain 81

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AACnME7GNNcAAA5Ju3c04w HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACnME7GNNcAAA5Ju3c04w&verifyHash=5be8fc21256508cddbb2f986af16397fb859b5e5

Request Chain 106

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=C4E27AA7056140AAB4E0E52307D8B96A&RedC=c.clarity.ms&MXFR=00C781F28AB66A7037A793EB8EB66458 HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=C4E27AA7056140AAB4E0E52307D8B96A&MUID=10C6A60759A66AAB28F9B41E58746BA6

109 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/ 90 KB
22 KB 244ms
205ms Document
text/html 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx / WordPress VIP <https://wpvip.com>

Resource Hash

661f43d9c68c22a570e06047252b335e27092489954600dae9f651c6a48ae064

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
cache-control: max-age=300, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 08 Sep 2022 22:23:17 GMT
host-header: a9130478a60e5f9135f765b23f26593b
link: <https://nakedsecurity.sophos.com/wp-json/>; rel="https://api.w.org/" <https://nakedsecurity.sophos.com/wp-json/wp/v2/posts/496373>; rel="alternate"; type="application/json" <https://nakedsecurity.sophos.com/?p=496373>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-cache: miss
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
x-rq: hhn2 0 2 9980

GET
H2 200 /
nakedsecurity.sophos.com/_static/ 102 KB
14 KB 10ms
9ms Stylesheet
text/css 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/_static/??-eJyNj8EOwjAIhl/IDrfDogfjs3SUTJR2TWExfXvnzJLt5vEHPuCDd3acUOZACqgKgdVgkAlfTngovlRQq0JN5NQsAyfYE0+FSIE9CUVKdghZfKXihEaP9T986e3zAcIp2XpidlnmkZOCki/4ABKvxpgLbf9/RcpSNgouT2rqfkariW5r7/HW9n3Xdtfr5fwBN4RjAA==

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5467511a1c80aeedcb76b7143274329dd6d861608a3cac5b8ac6a46166723c97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 0 2 9980
last-modified: Fri, 02 Sep 2022 14:46:20 GMT
server: nginx
age: 194523
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 14715

GET
H2 200 /
nakedsecurity.sophos.com/_static/ 189 KB
35 KB 7ms
6ms Stylesheet
text/css 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

38ab3f7d1c69ad33e955da101c04d99ed3e60931fa4ae9691cbbc001dcf78c8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 0 2 9980
last-modified: Fri, 02 Sep 2022 14:47:54 GMT
server: nginx
age: 194523
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 35511

GET
H2 200 / Show response
nakedsecurity.sophos.com/_static/ 98 KB
34 KB 12ms
12ms Script
application/javascript 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZmZGBmZmpqWkWAK91IiI=

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 0 2 9980
last-modified: Tue, 30 Aug 2022 19:06:15 GMT
server: nginx
age: 608860
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 34312

GET
H2 200 naked-security-logo-white@2x.png
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/ 2 KB
2 KB 10ms
6ms Image
image/png 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/naked-security-logo-white@2x.png

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

6280af26ccd34631a90de8cc4f33e915d39720dd7767ea8a2042e1864dd0819a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 0 2 9980
last-modified: Fri, 22 Jul 2022 01:49:00 GMT
server: nginx
age: 3717257
etag: W/"62da020c-90b"
strict-transport-security: max-age=31536000
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 2338
expires: Fri, 08 Sep 2023 22:23:17 GMT

GET
H2 200 2F4785DE8C3F43ECBD699A18F332FEEB.ashx
www.sophos.com/medialibrary/ 13 KB
13 KB 190ms
19ms Image
image/png 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/2F4785DE8C3F43ECBD699A18F332FEEB.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

4c331a19f481eb536fa4ddc75c1c8808057f1357bcf8c61e6ab963b6dc2a6907

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:19 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: private, max-age=4765
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
x-ua-compatible: IE=edge
content-length: 13036
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:42:42 GMT

GET
H2 200 27111765D65A45D49A232925D2CE428B.ashx
www.sophos.com/medialibrary/ 22 KB
22 KB 193ms
21ms Image
image/png 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/27111765D65A45D49A232925D2CE428B.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

63ee1658cac1b7a77753a1bf9e9fc5e7a05e73426e608fef3f2b482a1f0c71ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 13:25:09 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: private, max-age=4742
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
x-ua-compatible: IE=edge
content-length: 22556
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:42:19 GMT

GET
H2 200 sophos-cloud-optix-icon.svg
www.sophos.com/medialibrary/SophosNext/Images/Products/Icons/ 2 KB
2 KB 240ms
68ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/SophosNext/Images/Products/Icons/sophos-cloud-optix-icon.svg

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

6ddecf084e5b6ed52ab9c8143890a72a3d695edee6fafbf4ca5128a7cd6f1b3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 13
strict-transport-security: max-age=10886400
content-encoding: gzip
x-content-type-options: nosniff
x-edgeconnect-midmile-rtt: 124
server-timing: cdn-cache; desc=HIT, edge; dur=30
content-length: 1110
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 10 Dec 2021 07:20:59 GMT
x-frame-options: SAMEORIGIN
date: Thu, 08 Sep 2022 22:23:17 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: private, max-age=375
expires: Thu, 08 Sep 2022 22:29:32 GMT

GET
H2 200 08EA66123F1B4DDE8FE5C9B578A7FAA7.ashx
www.sophos.com/medialibrary/ 2 KB
2 KB 210ms
38ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/08EA66123F1B4DDE8FE5C9B578A7FAA7.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

bf45a939fd9e6d74a7acc1b575d73088396888717272bb8643c2b5479afea4a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 20 Oct 2021 05:49:44 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4706
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 1252
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:41:43 GMT

GET
H2 200 678FE994855047739F50D6C411184FA6.ashx
www.sophos.com/medialibrary/ 1 KB
1 KB 219ms
48ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/678FE994855047739F50D6C411184FA6.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

86f388a06affc92020302d848bc31e5df0593256b24bfe1c1a9d8d3d8e70915a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:44:40 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4724
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 786
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:42:01 GMT

GET
H2 200 01B80E7D7CD54EF8AC2E51C9C6EC0236.ashx
www.sophos.com/medialibrary/ 2 KB
1 KB 228ms
58ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/01B80E7D7CD54EF8AC2E51C9C6EC0236.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

1621e7c862be84cd5d2cd8e4b3a4d8382b853714d6ca0a57da9a04b115a42364

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:43:01 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=6420
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 891
x-xss-protection: 1; mode=block
expires: Fri, 09 Sep 2022 00:10:17 GMT

GET
H2 200 BEBD9C41BB4E480498514B29B92A145A.ashx
www.sophos.com/medialibrary/ 942 B
966 B 60ms
59ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/BEBD9C41BB4E480498514B29B92A145A.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

e062f5843f223fb2222333e6cca83f64b1d307875aeca187aec1a3055f3157b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:48:32 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4698
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 535
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:41:35 GMT

GET
H2 200 DC9D1A7BA3964B0C9DAF1F1E68806B5A.ashx
www.sophos.com/medialibrary/ 1 KB
1 KB 69ms
69ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/DC9D1A7BA3964B0C9DAF1F1E68806B5A.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

1b15df54cdbcf927d9ca83dec5a5804283f3a3aae0d1a787897b516690ff5d1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 13:00:46 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4711
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 691
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:41:48 GMT

GET
H2 200 8F51F06B62814B108D3B2763FF018E37.ashx
www.sophos.com/medialibrary/ 2 KB
1 KB 79ms
78ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/8F51F06B62814B108D3B2763FF018E37.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

161e1d347ed141e560fdff4e56964d7fa41834bdbc779b2c59722ac15e50f0cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 13:02:43 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4678
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 932
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:41:15 GMT

GET
H2 200 597ADA0AF01A4A12B2B27239D0F9992C.ashx
www.sophos.com/medialibrary/ 1 KB
1 KB 87ms
87ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/597ADA0AF01A4A12B2B27239D0F9992C.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

4503e524f77aba44b36b834f2f8efc08a48189f7915ed42956b151c9afb55c1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:53:02 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4817
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 756
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:43:34 GMT

GET
H2 200 8CB72BF5E1AD41F7894CE5E42101B0F3.ashx
www.sophos.com/medialibrary/ 975 B
880 B 96ms
95ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/8CB72BF5E1AD41F7894CE5E42101B0F3.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

e1b293d96560e1b12aafc0b0798ead6291de4c789c78671fff5609cea24aeedc

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 08 Mar 2018 07:45:50 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4667
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 448
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:41:04 GMT

GET
H2 200 C586E372694547A1B207A61D87246BA7.ashx
www.sophos.com/medialibrary/ 2 KB
1 KB 105ms
104ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/C586E372694547A1B207A61D87246BA7.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

edfc15c6d8e105511ebc6f81ca49ec279a1f608c5b9e465cf37a56baba09750b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:58:49 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4699
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 1078
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:41:36 GMT

GET
H2 200 3376DF5742A64AEE93FDB9DCA7291239.ashx
www.sophos.com/medialibrary/ 3 KB
4 KB 113ms
112ms Image
image/png 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/3376DF5742A64AEE93FDB9DCA7291239.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

e8eab802d8a017af747aeb8abd3c937420e3f0a2c0f3d06828df322e620c6867

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:18 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: private, max-age=4744
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
x-ua-compatible: IE=edge
content-length: 3295
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:42:21 GMT

GET
H2 200 A1FF440D2BB84511B8C94D771D44E207.ashx
www.sophos.com/medialibrary/ 318 B
675 B 121ms
120ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/A1FF440D2BB84511B8C94D771D44E207.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

b2fe29d1813dd78bc44fcb57c65740ee5965fe6985c5c69d9576e0c0a9b5fe5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:18 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4695
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 244
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:41:32 GMT

GET
H2 200 FCD3410ED2C347808D9DB8AC12C62DBD.ashx
www.sophos.com/medialibrary/ 391 B
701 B 129ms
129ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/FCD3410ED2C347808D9DB8AC12C62DBD.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

1a49a2cffa6dda5993f1571558d44644ad9517dfa370fbb7b0e9d005d33fc7bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:18 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4654
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 271
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 23:40:51 GMT

GET
H2 200 50985180E5F54C94917A2A6508E24287.ashx
www.sophos.com/medialibrary/ 441 B
740 B 141ms
140ms Image
image/svg+xml 23.75.243.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/50985180E5F54C94917A2A6508E24287.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.75.243.91 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-75-243-91.deploy.static.akamaitechnologies.com

Software

Resource Hash

e4aadbfb76725939385602738ef216b5f75ee5a3d3824d82be9862c43bb1b079

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:17 GMT
date: Thu, 08 Sep 2022 22:23:17 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=6350
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 309
x-xss-protection: 1; mode=block
expires: Fri, 09 Sep 2022 00:09:07 GMT

GET
H2 200 shutterstock_1679159329-compressor.jpg
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2020/05/ 40 KB
40 KB 8ms
7ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2020/05/shutterstock_1679159329-compressor.jpg?resize=780,408

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

396ece7da42aff66b3f8796b571322ea8e9455e2eb335b79f9a640b0b1b187b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 109 140 443
last-modified: Mon, 29 Aug 2022 02:29:39 GMT
server: nginx
etag: "a45412d7163243e5"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 40928
expires: Tue, 29 Aug 2023 02:29:39 GMT

GET
H2 200 rating.js Show response
polldaddy.com/js/rating/ 16 KB
5 KB 509ms
165ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/js/rating/rating.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 9c0d7fa32b9df01a54fb97e195ec1a25bbc65b528766e4392ca21b001224fea0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
last-modified: Tue, 29 Mar 2022 16:44:11 GMT
server: nginx
etag: W/"6243375b-41b7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
expires: Sat, 08 Oct 2022 22:23:18 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 117 KB
45 KB 130ms
50ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5VK6LTK

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

83a53e0824cadc04267cf1be887d08a24e68694e6d9c91a2bb41ee2f0e12762e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45489
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 21:11:47 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Sep 2022 22:23:17 GMT

GET
H2 200 / Show response
nakedsecurity.sophos.com/_static/ 300 KB
75 KB 8ms
8ms Script
application/javascript 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/_static/??-eJyNy0EKgCAQQNELpVOC7qLD2JCKM0pjSLdPgvZtP+9Dr8oXbsgNWkBCASk1FGHsosy8WEgCNV9HZNFJJvg1+HLipyP7fO3DvZ1onOrEmm9NkQfaaF2cM7Nz1tr0AB5JM2s=

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

dd5c04b5dca94a5fd1d124190ff1c143b8845c9bcd6c8f9ac7f6608707441dee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 0 2 9980
last-modified: Thu, 01 Sep 2022 21:09:15 GMT
server: nginx
age: 608860
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 76349

GET
H2 200 e-202236.js Show response
stats.wp.com/ 9 KB
3 KB 26ms
6ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202236.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-nc: HIT hhn
date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: br
server: nginx
etag: W/"62f6b688-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 27 Aug 2023 22:12:00 GMT

GET
H2 200 icon-search-99cae8.svg
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/ 2 KB
981 B 7ms
6ms Image
image/svg+xml 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/icon-search-99cae8.svg

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f09c53ca35858cba3d65ebcc619e4ff5d68ab5590391d3f0bb0fdca57a89d816

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: gzip
x-rq: hhn2 0 2 9980
last-modified: Thu, 04 Aug 2022 02:01:07 GMT
server: nginx
age: 54
etag: W/"62eb2863-7b0"
vary: X-Mobile-Class
x-cache: hit
content-type: image/svg+xml
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 879
expires: Fri, 08 Sep 2023 22:23:17 GMT

GET
H2 200 klinicslabbook-webfont.woff2
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 26 KB
26 KB 111ms
111ms Font
font/woff2 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/klinicslabbook-webfont.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f05a815262962493146cae3d7370bfa4c5d488fc8630e5caf861f33f2ede341d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq
Origin: https://nakedsecurity.sophos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 0
x-cache: miss
content-length: 26372
x-rq: hhn2 0 2 9980
last-modified: Thu, 04 Aug 2022 02:01:07 GMT
server: nginx
etag: W/"62eb2863-66e8"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 22:23:17 GMT

GET
H2 200 flama-medium-webfont.woff
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 26 KB
26 KB 110ms
110ms Font
font/woff 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/flama-medium-webfont.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b0a63a118c83ee872479df62851952db56d1d01f6dad0b148b3522b7b712d47d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq
Origin: https://nakedsecurity.sophos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 0
x-cache: miss
x-rq: hhn2 0 2 9980
last-modified: Thu, 04 Aug 2022 02:01:07 GMT
server: nginx
etag: W/"62eb2863-676c"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 22:23:17 GMT

GET
H2 200 flama-light-webfont.woff
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 26 KB
26 KB 109ms
109ms Font
font/woff 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/flama-light-webfont.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f02048fc30cf09f21fabfee36fb76feb7c239a3b6b0a011e6c5ab4c91422fd0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq
Origin: https://nakedsecurity.sophos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 0
x-cache: miss
content-length: 26215
x-rq: hhn2 0 2 9980
last-modified: Thu, 04 Aug 2022 02:01:07 GMT
server: nginx
etag: W/"62eb2863-6684"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 22:23:17 GMT

GET
H2 200 post-nav-previous.png
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/ 365 B
419 B 7ms
6ms Image
image/png 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/post-nav-previous.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d85e8f32872c1fd6438f8a355f4b7226b5af9ba87474e590cc352f6cd16d2d9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 0 2 9980
last-modified: Fri, 22 Jul 2022 01:49:00 GMT
server: nginx
age: 3716816
etag: "62da020c-16d"
strict-transport-security: max-age=31536000
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 365
expires: Fri, 08 Sep 2023 22:23:17 GMT

GET
H2 200 post-nav-next.png
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/ 364 B
412 B 7ms
7ms Image
image/png 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/post-nav-next.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

707d0980b1c65b912c943b578c3a576a01ed96cab83b0e6b8bd6602b9835066c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 0 2 9980
last-modified: Fri, 22 Jul 2022 01:49:00 GMT
server: nginx
age: 3716816
etag: "62da020c-16c"
strict-transport-security: max-age=31536000
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 364
expires: Fri, 08 Sep 2023 22:23:17 GMT

GET
H2 200 klinicslablight-webfont.woff2
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 25 KB
26 KB 165ms
165ms Font
font/woff2 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/klinicslablight-webfont.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f06210c8e0ec5ba4f4679ba1c9a301176def4a552f29388629ddaef7320681ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq
Origin: https://nakedsecurity.sophos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 0
x-cache: miss
content-length: 26016
x-rq: hhn2 0 2 9980
last-modified: Thu, 04 Aug 2022 02:01:07 GMT
server: nginx
etag: W/"62eb2863-6584"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 22:23:17 GMT

GET
H2 200 flama-book-webfont.woff
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 26 KB
26 KB 109ms
109ms Font
font/woff 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/flama-book-webfont.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

964dd54dd651e6c51d925cd29df29d85678781f357444e148522b04bb0a28bf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TgOUEaItUTBIkA+Vu2oYvcUxIxJp0/nPlwEUm/GzdAyV1bULrlr40UheDqi2quwS6o73IihRGO1rc3KMF6d5ZmjQR4rnl2s8tfXAVLG7d4UH2wS0xOIXPge/IZPc6lnmqZAe+9Phzd1QlBq
Origin: https://nakedsecurity.sophos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 0
x-cache: miss
x-rq: hhn2 0 2 9980
last-modified: Thu, 04 Aug 2022 02:01:07 GMT
server: nginx
etag: W/"62eb2863-66e4"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 22:23:17 GMT

GET
H2 200 skype-message.png
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2020/05/ 19 KB
19 KB 7ms
7ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2020/05/skype-message.png

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7ef688a40b5120227d23c350bceaefd6ff21bf36c0a1a2171b947a2e344f0a94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 109 144 443
last-modified: Mon, 29 Aug 2022 02:29:39 GMT
server: nginx
etag: "6afb906c67522cec"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 19226
expires: Tue, 29 Aug 2023 02:29:39 GMT

GET
H2 200 brave-1.png
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2020/05/ 53 KB
53 KB 8ms
7ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2020/05/brave-1.png

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

991923b6a8fae549f6ee964ffb9c558d18f74f02625505f4109e4744d17b324f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-rq: hhn2 109 32 443
last-modified: Wed, 24 Nov 2021 12:49:39 GMT
server: nginx
etag: "dbcc129d774284e7"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 54316
expires: Thu, 24 Nov 2022 12:49:39 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 76ms
33ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Thu, 28 Jul 2022 17:32:37 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C1266988E8FC4419BBE4F23C2EEB0724 Ref B: FRAEDGE1220 Ref C: 2022-09-08T22:23:17Z
etag: "80a8697a8a2d81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
date: Thu, 08 Sep 2022 22:23:17 GMT
accept-ranges: bytes
content-length: 11367

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 100 KB
27 KB 37ms
8ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5ae95e748ad12444cd760e245c02264cea3e8deb41fabd95f1e0784b81f72783

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26737
x-xss-protection: 0
pragma: public
x-fb-debug: oqkoUvO8JafzlgmX8vDxBOhTnJCPwwUoqUgDv8WbhyJXAAebHaAkN5bIKoPeR/iSmI/94HSh2RDf5tArYBIpJQ==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 08 Sep 2022 22:23:17 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 89ms
18ms Script
application/x-javascript 2a02:26f0:10e::6860:5bba
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10e::6860:5bba Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=23754
accept-ranges: bytes
content-length: 3063

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 162 KB
60 KB 46ms
44ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-743773256

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VK6LTK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3e69fa9b3a2cc7d14f196929aa530b02ca0dac6fb8a335870e525df7f44eac7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61275
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 21:11:47 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Sep 2022 22:23:17 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 82ms
6ms Script
application/javascript 199.232.136.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: gzip
last-modified: Tue, 30 Aug 2022 15:04:19 GMT
etag: "d4de8398858246712016031c834bb061+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 15317
x-served-by: cache-iad-kjyo7100163-IAD, cache-hhn11545-HHN

GET
H2 200 qevents.js Show response
a.quora.com/ 40 KB
15 KB 42ms
14ms Script
text/plain 162.159.152.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.quora.com/qevents.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:17 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3089018
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: ABWFWAK2P6Z86ST7
x-amz-id-2: Lo6V6sS9dollZm991E+r9QS5ilIWlcul705lMiga2oQnz8bnT95jaa4X7qyu2MPUU2YNcD20ek4=
last-modified: Fri, 18 Mar 2022 00:16:52 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1647562609/ctime:1647562609/gid:150037/gname:ezhang/md5:47078e63380c6b0cbbfb6d8508b25ee7/mode:33204/mtime:1647562609/uid:150037/uname:ezhang
etag: W/"47078e63380c6b0cbbfb6d8508b25ee7"
vary: Accept-Encoding
content-type: text/plain
cache-control: public, max-age=14400
x-amz-version-id: vyBstMTGyA6m5sV66zq8xsypUg.tAOk.
cf-ray: 747b1678dd84bb8c-FRA
expires: Fri, 09 Sep 2022 02:23:17 GMT

GET
H/1.1 200
OK events.js Show response
tags.srv.stackadapt.com/ 17 KB
6 KB 461ms
103ms Script
text/javascript 52.54.24.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.24.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-24-90.compute-1.amazonaws.com
Software: /
Resource Hash: b6beea83b41d9ecf1174e4388d6dc1c0785e94bab96d0af7c425e7ca7253f74f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 08 Sep 2022 22:23:18 GMT
Content-Encoding: gzip
Cache-Control: max-age=5
Content-Length: 5401
Connection: keep-alive
Content-Type: text/javascript

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 81ms
20ms Script
application/x-javascript 52.222.177.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VK6LTK
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.177.228 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-177-228.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Thu, 08 Sep 2022 17:37:43 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 17135
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 e783bb6c29f662cfdd94e8ac169d6a36.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: HAM50-C1
X-Amz-Cf-Id: 739zY_Z9dR2P6e5zw6bM3C-ykJzp2IPzaiBXAE4n2zCpCo_oUCLfMg==

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 16 KB
6 KB 128ms
33ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 21:37:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2756
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
x-amz-request-id: FR7SK1675Q8V9H7D
x-amz-id-2: IJSYausG5PyUOwebfpLwvxg4zEZ9pydswbPA+ZI0Qtp6MiwoeVKUO4dopEv1Klf10nVns76Sckw=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Jun 2022 12:21:31 GMT
server: ATS
etag: "6a624022b5d271dcefb070b0b6670abc-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-version-id: .QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 334990480506518 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/334990480506518?v=2.9.79&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b5c362f1555024cd5b82dea46ecec6a9469e62241235ecfc4e9519ea2e3864c5

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85947
x-xss-protection: 0
pragma: public
x-fb-debug: M5C8Bh8V9wQF22KtGVKFOhDIXe05Hi+OVaacgb9q/XEp59paNErsetwyi4GYQuuefl8vStxqcsMGTr/Mpl6+Ow==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 08 Sep 2022 22:23:17 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/ 43 B
423 B 471ms
106ms Image
image/gif 52.2.80.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&tag=ViewContent&ts=1662675797926

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.2.80.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-2-80-154.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Thu, 08 Sep 2022 22:23:18 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Q-Stat: ,c544cb32e7425a70de8dd8f830fe0ded,10.0.0.223,7900,185.213.155.165,,59411466966,1,1662675798.344,0.001,,.,0,0,0.000,0.000,-,0,0,197,243,121,10,35796,,,,,,-,
Content-Type: image/gif

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
16 KB 128ms
50ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15690
x-xss-protection: 0
server: cafe
etag: 13194339052015637803
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 08 Sep 2022 22:23:18 GMT

GET
H2 200 4015302.js Show response
bat.bing.com/p/action/ 1 KB
842 B 32ms
32ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/4015302.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aac5341aa4c349318c1a57a00c4df3d3174c930fe1f04c34a87f4b07982d06d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B1DCAAAD7D214D23A3A0C9DA38E31AF4 Ref B: FRAEDGE1220 Ref C: 2022-09-08T22:23:17Z
date: Thu, 08 Sep 2022 22:23:17 GMT
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private,max-age=60
content-length: 666

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 67ms
19ms Image
image/gif 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&rl=&if=false&ts=1662675797976&sw=1600&sh=1200&v=2.9.79&r=stable&ec=0&o=30&fbp=fb.1.1662675797975.1520384942&it=1662675797919&coo=false&rqm=GET

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 08 Sep 2022 22:23:18 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1662675797981&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1662675797981%26url%3Dhttps%253A%252F%252Fnakedsecurity.sophos.co...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1662675797981&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1662675797981&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2...

0
264 B

157ms
106ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1662675797981&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&liSync=true&e_ipv6=AQICJz-MXeaaWwAAAYMfM0nH0hcvyYjnesHgRO0SiICZNtdKI2HBPsAL-PTRgnX6oIdNJVRP
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: D759D782880246478E07B250D9C2CDAD Ref B: FRAEDGE1308 Ref C: 2022-09-08T22:23:18Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXoMeBahTV4uK5Rdxmlxg==
x-li-fabric: prod-lva1

Redirect headers

date: Thu, 08 Sep 2022 22:23:17 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 5CB25F2F739D455AAB7D79B68ECBA298 Ref B: FRAEDGE1406 Ref C: 2022-09-08T22:23:18Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1662675797981&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&liSync=true&e_ipv6=AQICJz-MXeaaWwAAAYMfM0nH0hcvyYjnesHgRO0SiICZNtdKI2HBPsAL-PTRgnX6oIdNJVRP
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXoMeBYDjCb+dhPyuTbyA==

GET
H2 200 adsct
t.co/i/ 43 B
336 B 149ms
122ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=517401d4-9bcd-4bf1-9ac1-b2903fccb8bc&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=2bebf8ee-d31b-41bc-9537-57d72b1e5dca&tw_document_href=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4apa&type=javascript&version=2.3.27

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-response-time: 115
date: Thu, 08 Sep 2022 22:23:17 GMT
server: tsa_o
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 2ad5ccf26ecfe04e0a10a8a8655d309ea9b6573403d47d46d26e2c2529b93752
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
353 B 151ms
123ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=517401d4-9bcd-4bf1-9ac1-b2903fccb8bc&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=2bebf8ee-d31b-41bc-9537-57d72b1e5dca&tw_document_href=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4apa&type=javascript&version=2.3.27

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-response-time: 117
date: Thu, 08 Sep 2022 22:23:17 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 20ebad9469b282de3e7287076aed17a06821860f11604b43dcab8a276b2626dd
content-length: 43

GET
H2 200 4015302 Show response
www.clarity.ms/tag/uet/ 2 KB
2 KB 308ms
149ms Script
application/x-javascript 2620:1ec:27::cafe:1774
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/4015302
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/4015302.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:27::cafe:1774 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: d5e1400eee0949528068e4bc7b680039cacfdd013aee4164d988544fc7c4c4d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
x-powered-by: ASP.NET
x-azure-ref: 0VmsaYwAAAAACcT8PKnWJTa9DqCP6srgDTElTMDFFREdFMDUwOAA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
content-length: 1588
expires: -1

GET
H2 200 10150886.json Show response
s.yimg.com/wi/config/ 46 B
684 B 95ms
33ms XHR
application/octet-stream 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10150886.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 19:43:30 GMT
x-content-type-options: nosniff
age: 9589
x-amz-server-side-encryption: AES256
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: 6PHP9KJFBX15S0VX
x-amz-id-2: n0pqQlWRmhtyVV5KwNr+iG1XDmeYLF0U5b6HcUbMkNy+TV6q13K0bHrFA4nS8hB4TGCb6yzAEX8=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 20 Jan 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 15 Dec 2021 05:54:05 GMT
server: ATS
etag: "3769bd8c10be070cf8c85c08517a8fdc"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-version-id: VO4i6Xctkzo3gjHc0HLprUqd6v7sNIpd
access-control-allow-origin: *
x-xss-protection: 1; mode=block
content-length: 46
content-type: application/octet-stream

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/ 3 KB
2 KB 179ms
87ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1662675798094&cv=9&fst=1662675798094&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&tiba=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&auid=268284721.1662675798&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f477ce00c56054732e796120e25bdbd59279df67d5714746cfce4f62dd199584

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1119
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
631 B 142ms
36ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2008%20Sep%202022%2022%3A23%3A18%20GMT&n=0&b=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&.yp=10150886&f=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&enc=UTF-8&yv=1.13.0&tagmgr=gtm

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Thu, 08 Sep 2022 22:23:18 GMT

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
543 B 166ms
166ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6133783&item_id=_comm_6133783
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 50870e8da23872c30fa309895e6bcf9e10a3575a7001d54f6fcaff8f9d0ee263

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
550 B 165ms
165ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6149949&item_id=_comm_6149949
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: c1817e1ecd0d9bd3dca63a459f6c8ed1e1537326bc751d9a03a83792b7b44b52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
545 B 166ms
165ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6150246&item_id=_comm_6150246
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 3cc1c65a673b37eaa0bb0cfb567268d15b0a831c2708ab961d2ef8a6fee93420

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
543 B 166ms
166ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6149950&item_id=_comm_6149950
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 412b3b1fae4165c7fbbdfcb26b140226ad917e96c60b32be00beed0e037dc209

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
546 B 166ms
166ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6165959&item_id=_comm_6165959
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 541654686bb744c72ad4e8950bb8cf9fb5ab7d07a57aa05a8de41a68a5f0d071

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
547 B 166ms
166ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6165972&item_id=_comm_6165972
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 6f8335b75414a35e0040bce275c49766771943872f83b7835179a7b9e3214dd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
545 B 167ms
167ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6219347&item_id=_comm_6219347
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 184179bcb91fed70ed252c734fa54358a0d93343c9570914b827bde5217f2258

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
547 B 166ms
166ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6222285&item_id=_comm_6222285
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 9c1f15176d95e744d3f57536b9f3a8f41e8c6e71544834d984719116850c416a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
543 B 167ms
167ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6227391&item_id=_comm_6227391
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: a8f6595e285c4085200aea9ee4f45fe54a229f4805d6ebcde5c5fc74056d9dc7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
543 B 319ms
319ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6298611&item_id=_comm_6298611
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 34eeeef2cc592fbe6d7c0ba83ec2ba60afbe622b555f4c6734b23cf508ba8032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 2 KB
546 B 318ms
318ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=7238218&uid=wp-comment-6329568&item_id=_comm_6329568
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 1a3943718328f50162226e58817036e1141852b82995bcdbb9badc1ff487256d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 52ms
36ms Script
text/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/_static/??-eJyNy0EKgCAQQNELpVOC7qLD2JCKM0pjSLdPgvZtP+9Dr8oXbsgNWkBCASk1FGHsosy8WEgCNV9HZNFJJvg1+HLipyP7fO3DvZ1onOrEmm9NkQfaaF2cM7Nz1tr0AB5JM2s=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 1934
date: Thu, 08 Sep 2022 21:51:04 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Thu, 08 Sep 2022 23:51:04 GMT

GET
H/1.1 200
OK elqCfg.min.js Show response
img03.en25.com/i/ 6 KB
3 KB 385ms
12ms Script
application/x-javascript 96.16.149.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://img03.en25.com/i/elqCfg.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.149.96 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-149-96.deploy.static.akamaitechnologies.com

Software

Resource Hash

3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
X-Content-Type-Options: nosniff
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Connection: keep-alive
Content-Length: 2183
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Wed, 22 Jun 2022 13:18:58 GMT
Date: Thu, 08 Sep 2022 22:23:18 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: no-store
ETag: "7795cda13a86d81:0"
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Expires: Thu, 08 Sep 2022 22:23:18 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
116 B 12ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A11.2&blog=166161173&post=496373&tz=1&srv=nakedsecurity.sophos.com&hp=vip&host=nakedsecurity.sophos.com&ref=&fcp=399&rand=0.5223247197514611
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 08 Sep 2022 22:23:18 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 nsp-1200.png
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/07/ 18 KB
18 KB 7ms
6ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/07/nsp-1200.png?w=412&h=200&crop=1

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c1b5abdbb69406f60f199ccb2a1b1e2a1a31da6d66d4f87679cc8456869aca25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
x-rq: hhn2 109 142 443
last-modified: Thu, 14 Jul 2022 16:54:32 GMT
server: nginx
etag: "767898cfb5fa0bec"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 18460
expires: Fri, 14 Jul 2023 16:54:32 GMT

GET
H2 200 cat-1200.png
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/08/ 48 KB
48 KB 7ms
7ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/08/cat-1200.png?w=412&h=200&crop=1

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8a11a1bdb458db9c6f265e25f38f343b7978c35747df6caa367e47bcccee6dac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
x-rq: hhn2 109 30 443
last-modified: Wed, 03 Aug 2022 16:58:04 GMT
server: nginx
etag: "283fd6893b1c3a7b"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 48778
expires: Thu, 03 Aug 2023 16:58:04 GMT

GET
H2 200 ff-1200.png
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/04/ 15 KB
15 KB 7ms
7ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/04/ff-1200.png?w=412&h=200&crop=1

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

07927a9a88434415d119a70fdcb1b8d91f3cb07fcc02ce20aef65b57f79ead9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
x-rq: hhn2 109 198 443
last-modified: Tue, 05 Apr 2022 16:36:23 GMT
server: nginx
etag: "9a44b048ed5660c4"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 15474
expires: Wed, 05 Apr 2023 16:36:23 GMT

GET
H2 204 0
bat.bing.com/action/ 0
175 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=57683c47-2df5-4f6f-804e-2c4af8a90cda&sid=d6c6af402fc411eda94c911ecd20358e&vid=d6c6ce502fc411ed8c41d5f5e20a165d&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&kw=google,%20&p=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&r=&lt=879&evt=pageLoad&sv=1&rn=288833

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A6AAB3063D7F49AF82D990A506647FDD Ref B: FRAEDGE1220 Ref C: 2022-09-08T22:23:18Z
date: Thu, 08 Sep 2022 22:23:17 GMT
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 WuEFNglz.min.js Show response
scripts.demandbase.com/ 61 KB
16 KB 86ms
8ms Script
application/javascript 108.138.17.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://scripts.demandbase.com/WuEFNglz.min.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.17.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-17-87.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: LCueR8U3D7lJgwCfemj1Slg2LluSXKrc
content-encoding: gzip
etag: W/"b068f44152e87ccb66f40491a735aad0"
age: 3045
x-cache: Hit from cloudfront
vary: Accept-Encoding
last-modified: Thu, 17 Jun 2021 19:46:43 GMT
server: AmazonS3
date: Thu, 08 Sep 2022 21:32:34 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
via: 1.1 85ca8c4198fb707d10ecc2a784a315be.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA56-P7
x-amz-cf-id: eSdrZRHS2_A5WzBTz5S88k30pxAGFYPA5GBG3dZlf-cij6RtQggVJg==

GET
H3

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1144736546&utmhn=nakedsecurity.sophos.com&utme=8(4!CampaignID)9(4!70130000001xGqlAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x120...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-737537-1&cid=1098213058.1662675798&jid=1744475701&_v=5.7.2&z=1144736546
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1098213058.1662675798&jid=1744475701&_v=5.7.2&z=1144736546
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1098213058.1662675798&jid=1744475701&_v=5.7.2&z=1144736546&slf_rd=1&random=694981235

42 B
63 B

123ms
48ms

Image
image/gif

2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1098213058.1662675798&jid=1744475701&_v=5.7.2&z=1144736546&slf_rd=1&random=694981235

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1098213058.1662675798&jid=1744475701&_v=5.7.2&z=1144736546&slf_rd=1&random=694981235
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=895871280&utmhn=nakedsecurity.sophos.com&utme=8(4!CampaignID)9(4!70130000001xGqlAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-737537-25&cid=1204528877.1662675798&jid=1681030097&_v=5.7.2&z=895871280
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1204528877.1662675798&jid=1681030097&_v=5.7.2&z=895871280
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1204528877.1662675798&jid=1681030097&_v=5.7.2&z=895871280&slf_rd=1&random=837384190

42 B
63 B

122ms
47ms

Image
image/gif

2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1204528877.1662675798&jid=1681030097&_v=5.7.2&z=895871280&slf_rd=1&random=837384190

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1204528877.1662675798&jid=1681030097&_v=5.7.2&z=895871280&slf_rd=1&random=837384190
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 __utm.gif
ssl.google-analytics.com/ 35 B
55 B 36ms
36ms Image
image/gif 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=1772848241&utmhn=nakedsecurity.sophos.com&utmt=event&utme=5(Naked%20Security*Show%20newsletter%20-%20top)8(4!CampaignID)9(4!70130000001xGqlAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&utmhid=849882839&utmr=-&utmp=%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&utmht=1662675798247&utmac=UA-737537-25&utmcc=__utma%3D222203399.1204528877.1662675798.1662675798.1662675798.1%3B%2B__utmz%3D222203399.1662675798.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=61CgAAAAAAAAAAAAAAAAAAgE~

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 18:14:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 14950
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

OPTIONS
H/1.1 200
OK dmVuZG9yPW1hcmlwb3NhJnAxPWV4YW1wbGUuY29tJnRva2VuPWYyNTE0ZTIyMjNmMjcxZGUzMDBiMTkwOGMyYzkwYzkxMWJlZDc4ZDc=
segments.company-target.com/l/ Frame 0
0 160ms
98ms Preflight 52.222.214.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://segments.company-target.com/l/dmVuZG9yPW1hcmlwb3NhJnAxPWV4YW1wbGUuY29tJnRva2VuPWYyNTE0ZTIyMjNmMjcxZGUzMDBiMTkwOGMyYzkwYzkxMWJlZDc4ZDc=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-8.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://nakedsecurity.sophos.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Access-Control-Max-Age: 3600
Connection: keep-alive
Content-Length: 0
Date: Thu, 08 Sep 2022 22:23:18 GMT
Vary: Origin
Via: 1.1 bfad099b4e1fa2ec7d21876e0293dc20.cloudfront.net (CloudFront)
X-Amz-Cf-Id: X0ts7Y7ReAhOFWwc-hBANcpJdWAU9JkCi6otjsXHJPN7jBort9BvQg==
X-Amz-Cf-Pop: FRA56-P3
X-Cache: Miss from cloudfront
trace-id: 398f685141ce93c1

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 1 KB
1 KB 97ms
63ms XHR
application/json 18.66.97.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&page_title=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/WuEFNglz.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-46.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: ac3b910bfbfbac794c42fba9ac1524e9b3c796e77727a97d1417bfb8b5c3dabb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
request-id: 2a1e0556-e387-4651-a57e-f95106cc5c7a
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://nakedsecurity.sophos.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 5d5481cfa85227a3fdd5ff0b03093c62.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: GTr0vyv1_2vZwTvRMe3dRaeX7SVbRFSqQ_Zt7rzmMpswVHkfIEbX7g==
expires: Wed, 07 Sep 2022 22:23:18 GMT

GET
H/1.1

200
OK

validateCookie Show response
segments.company-target.com/
Redirect Chain

https://segments.company-target.com/l/dmVuZG9yPW1hcmlwb3NhJnAxPWV4YW1wbGUuY29tJnRva2VuPWYyNTE0ZTIyMjNmMjcxZGUzMDBiMTkwOGMyYzkwYzkxMWJlZDc4ZDc=
https://segments.company-target.com/validateCookie?vendor=mariposa&user_id=example.com&verifyHash=ba6fe5045ef595e4626b82cc380bdd348e24ea0b

26 B
512 B

188ms
188ms

XHR
image/gif

52.222.214.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://segments.company-target.com/validateCookie?vendor=mariposa&user_id=example.com&verifyHash=ba6fe5045ef595e4626b82cc380bdd348e24ea0b
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: HTTP/1.1
Server: 52.222.214.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-8.fra56.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Thu, 08 Sep 2022 22:23:18 GMT
Via: 1.1 59439a13f6db75e801a63663b4f79372.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P3
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: 4bc0c3af7859f292
X-Amz-Cf-Id: wVpGKjtEGuPyCb9T54Bdx5JrmOCpvk8qEHItRxmb3G3fjSW_Y8pJXw==
Access-Control-Allow-Credentials: true

Redirect headers

Date: Thu, 08 Sep 2022 22:23:18 GMT
Via: 1.1 59439a13f6db75e801a63663b4f79372.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P3
Location: /validateCookie?vendor=mariposa&user_id=example.com&verifyHash=ba6fe5045ef595e4626b82cc380bdd348e24ea0b
Vary: Origin
X-Cache: Miss from cloudfront
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
trace-id: 40cd3f50ce567544
Content-Length: 0
X-Amz-Cf-Id: c4uQvMjQ5lZ0EoIQ_qoyLLcl4l030cIzbE_8aZ6c1e95BPOZZPYVFA==

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AACnME7GNNcAAA5Ju3c04w
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACnME7GNNcAAA5Ju3c04w&verifyHash=5be8fc21256508cddbb2f986af16397fb859b5e5

26 B
409 B

99ms
99ms

Image
image/gif

52.222.214.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACnME7GNNcAAA5Ju3c04w&verifyHash=5be8fc21256508cddbb2f986af16397fb859b5e5
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: HTTP/1.1
Server: 52.222.214.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-8.fra56.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Thu, 08 Sep 2022 22:23:18 GMT
Via: 1.1 77ba839b79ec0a8b2031c8a828e7fdfa.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P3
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: 3fe12b4e7f40a37d
X-Amz-Cf-Id: s0MFvTjzJeTao5q_QM-Savw8RVpwoA2mSiYnQ3sfGCE5dCraqklj-A==

Redirect headers

Date: Thu, 08 Sep 2022 22:23:18 GMT
Via: 1.1 77ba839b79ec0a8b2031c8a828e7fdfa.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P3
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AACnME7GNNcAAA5Ju3c04w&verifyHash=5be8fc21256508cddbb2f986af16397fb859b5e5
Connection: keep-alive
trace-id: 0261726fe30fc1e0
Content-Length: 0
X-Amz-Cf-Id: QJLGWbmERweHwQrmtLCHtVxPtKt6Q3Uqy_ssoZMq9o8v3VqYvsKA7g==

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 146ms
39ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/743773256/ 42 B
165 B 151ms
52ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/743773256/?random=1662675798094&cv=9&fst=1662674400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&tiba=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&async=1&fmt=3&is_vtc=1&random=255320508&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/743773256/ 42 B
548 B 128ms
48ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/743773256/?random=1662675798094&cv=9&fst=1662674400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&tiba=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&async=1&fmt=3&is_vtc=1&random=255320508&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 clarity.js Show response
www.clarity.ms/eus-b/s/0.6.40/ 54 KB
23 KB 144ms
143ms Script
application/javascript 2620:1ec:27::cafe:1774
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/eus-b/s/0.6.40/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/4015302
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:27::cafe:1774 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: bbffae0d03e6d48b808856596e595ab718c08bbc4476e7323bfcff4a6f833260

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
etag: "1d8bd4806fdad30"
last-modified: Wed, 01 Jun 2022 12:22:22 GMT
x-powered-by: ASP.NET
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
x-azure-ref: 0VmsaYwAAAAAngNJR9t7LRJYIUQYjP8c0TElTMDFFREdFMDUwOAA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
accept-ranges: bytes
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
87 B 166ms
166ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6149949&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 7b9258ba22bf2f97c61fc46d53f472cda821d4d730b26772a2008b9397202ca0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
87 B 167ms
167ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6133783&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 3f41d17bab2293be8ce2c9605e5c94bef86bd91ac7359d3307ad64e516f9f509

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 nero-hand-sml.png
polldaddy.com/images/ratings/ 938 B
1 KB 162ms
162ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/nero-hand-sml.png
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: fcd979553c43747d6e8686d91f3616954c01faf7177dd5db4427856063be2956

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
last-modified: Fri, 12 Mar 2021 05:30:45 GMT
server: nginx
etag: "604afc85-3aa"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 938
expires: Sat, 08 Oct 2022 22:23:18 GMT

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
87 B 167ms
167ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6150246&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: a68e0da9ff047b6cdc6a58b4f179b0fd1ac0e97eda2dfade8c1375203b3adba7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
89 B 170ms
167ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6149950&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 617ffb964e26c84d0424565e5a368a9031e9881865cd7c74038f49537b165ef4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
87 B 169ms
167ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6165959&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 8f6d27bf07f52b22aa791547c3a2103bf0824c44ae2df17d413e5a7e0d386075

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
87 B 167ms
166ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6165972&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: e99765013eb2f55969542e1663eb0f02cf0b05a9597b58fc871e6964c6729dd9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
86 B 166ms
166ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6222285&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: c7443b4fdccf0b49d8fa5eb106775bb5b5edaeadc40929ada7c505a27767107a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
87 B 166ms
166ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6219347&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 05abc444f8139d33b13689329db8ea9398a1f63d455f8703783db8bebd7c09b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
87 B 167ms
167ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6227391&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 969234168bcf7ea877a437e885fb4294e1fb85cf8227003b5b82375862e17e10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H/1.1 200
OK sa.css
tags.srv.stackadapt.com/ 65 B
292 B 103ms
102ms Stylesheet
text/css 52.54.24.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.24.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-24-90.compute-1.amazonaws.com
Software: /
Resource Hash: 28d801ccf6ed445239a3401f0ef3b360055d0b419daf8315c84f5b636d2bb74f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 08 Sep 2022 22:23:18 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 65
Content-Type: text/css

GET
H/1.1 200
OK sa.jpeg Show response
tags.srv.stackadapt.com/ 0
881 B 413ms
102ms Fetch
image/jpeg 52.54.24.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.24.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-24-90.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 08 Sep 2022 22:23:18 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 651
Content-Type: image/jpeg

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 39ms
18ms Image
image/gif 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&rl=&if=false&ts=1662675798496&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security%22%2C%22meta%3Adescription%22%3A%22Google%20Search%20uses%20open%20redirects%20by%20design%2C%20which%20is%20handy%20if%20you%27re%20a%20scammer%20trying%20to%20hide%20an%20iffy-looking%20URL.%22%2C%22meta%3Akeywords%22%3A%22google%2C%20%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F%22%2C%22og%3Adescription%22%3A%22Google%20Search%20uses%20open%20redirects%20by%20design%2C%20which%20is%20handy%20if%20you%E2%80%99re%20a%20scammer%20trying%20to%20hide%20an%20iffy-looking%20URL.%22%2C%22article%3Apublished_time%22%3A%222020-05-15T13%3A04%3A04%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222020-05-15T13%3A08%3A04%2B00%3A00%22%2C%22og%3Asite_name%22%3A%22Naked%20Security%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fnakedsecurity.sophos.com%2Fwp-content%2Fuploads%2Fsites%2F2%2F2020%2F05%2Fshutterstock_1679159329-compressor.jpg%3Fw%3D775%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fnakedsecurity.sophos.com%2Fwp-content%2Fuploads%2Fsites%2F2%2F2020%2F05%2Fshutterstock_1679159329-compressor.jpg%3Fw%3D775%22%2C%22og%3Aimage%3Awidth%22%3A%22775%22%2C%22og%3Aimage%3Aheight%22%3A%22405%22%2C%22og%3Aimage%3Aalt%22%3A%22%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.79&r=stable&ec=1&o=30&fbp=fb.1.1662675797975.1520384942&it=1662675797919&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 08 Sep 2022 22:23:18 GMT

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
86 B 167ms
167ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6329568&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: e72ee287deffe0dcbf6f6de76cd306f455eac4b70337586b115d67841e090307

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 rating-results.php Show response
polldaddy.com/ratings/ 82 B
86 B 167ms
167ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rating-results.php?id=7238218&item_id=_comm_6298611&period=99&item_count=3&off&text_1_star=Very+Poor&text_2_star=Poor&text_3_star=Average&text_4_star=Good&text_5_star=Excellent
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 81cb96a1acb83f3a5e308b48e5274ac2cab20be38cfa724fdd715d6ff2a0ee85

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
content-encoding: br
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 info.png
polldaddy.com/images/ratings/ 1 KB
1 KB 162ms
162ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/info.png
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/2020/05/15/how-scammers-abuse-google-searchs-open-redirect-feature/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 22:23:18 GMT
last-modified: Wed, 08 Sep 2021 02:43:27 GMT
server: nginx
etag: "6138234f-4ca"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1226
expires: Sat, 08 Oct 2022 22:23:18 GMT

OPTIONS
H/1.1 200
OK validateCookie
segments.company-target.com/ Frame 0
0 99ms
98ms Preflight 52.222.214.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://segments.company-target.com/validateCookie?vendor=mariposa&user_id=example.com&verifyHash=ba6fe5045ef595e4626b82cc380bdd348e24ea0b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-8.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://nakedsecurity.sophos.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Access-Control-Max-Age: 3600
Connection: keep-alive
Content-Length: 0
Date: Thu, 08 Sep 2022 22:23:18 GMT
Vary: Origin
Via: 1.1 bfad099b4e1fa2ec7d21876e0293dc20.cloudfront.net (CloudFront)
X-Amz-Cf-Id: dv1SV3AwaVP9dK35fF_ofPUDW_OsQlMW65t4uLiCwSGiyA3L9KF3JA==
X-Amz-Cf-Pop: FRA56-P3
X-Cache: Miss from cloudfront
trace-id: 92b3709ee869def4

POST
H2 204 collect Show response
f.clarity.ms/ 0
182 B 395ms
184ms XHR
text/plain 20.84.22.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://f.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/eus-b/s/0.6.40/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.84.22.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://nakedsecurity.sophos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-origin: https://nakedsecurity.sophos.com
date: Thu, 08 Sep 2022 22:23:18 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H/1.1 200
OK saq_pxl Show response
tags.srv.stackadapt.com/ 94 B
406 B 103ms
102ms XHR
text/plain 52.54.24.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&t=How%20scammers%20abuse%20Google%20Search%E2%80%99s%20open%20redirect%20feature%20%E2%80%93%20Naked%20Security&tip=WrjHI5lmEb9LWUJCaVN-ucUyZtnvru55sivSWPbFV2E&host=https://nakedsecurity.sophos.com&sa_conv_data_css_value=%20%220-1b5cabcb-82e9-49c2-6008-519289309634%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9e0497cf68b594ac27b0064f4440bc79fb9d59ba5&sa-user-id-v2=s%253A0-1b5cabcb-82e9-49c2-6008-519289309634%2524ip%2524185.213.155.165.vosyUeFi6tF0BomjiaEO1aPlsqiVAWjvZTv3hcPzcF0&sa-user-id=s%253A0-1b5cabcb-82e9-49c2-6008-519289309634.OlBP%252FhUFwho0OxBwnantIUA7Yl7%252BG5SykUd2bXmAlb0
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.24.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-24-90.compute-1.amazonaws.com
Software: /
Resource Hash: 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Thu, 08 Sep 2022 22:23:18 GMT
Access-Control-Allow-Methods: GET
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 94

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame F27E 0
182 B 101ms
32ms Document
text/html 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2F2020%2F05%2F15%2Fhow-scammers-abuse-google-searchs-open-redirect-feature%2F&upid=ql4fc2b&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://nakedsecurity.sophos.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html
date: Thu, 08 Sep 2022 22:23:18 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=C4E27AA7056140AAB4E0E52307D8B96A&RedC=c.clarity.ms&MXFR=00C781F28AB66A7037A793EB8EB66458
https://c.clarity.ms/c.gif?CtsSyncId=C4E27AA7056140AAB4E0E52307D8B96A&MUID=10C6A60759A66AAB28F9B41E58746BA6

42 B
367 B

28ms
28ms

Image
image/gif

20.234.93.27
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=C4E27AA7056140AAB4E0E52307D8B96A&MUID=10C6A60759A66AAB28F9B41E58746BA6
Protocol: H2
Server: 20.234.93.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
last-modified: Wed, 17 Aug 2022 23:56:46 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "de363c295b2d81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 08 Sep 2022 22:23:18 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7C93C2EAE5B24DBFA00C04FDD3674396 Ref B: FRAEDGE1220 Ref C: 2022-09-08T22:23:18Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=C4E27AA7056140AAB4E0E52307D8B96A&MUID=10C6A60759A66AAB28F9B41E58746BA6
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

POST
H2 204 collect Show response
f.clarity.ms/ 0
25 B 92ms
91ms XHR
text/plain 20.84.22.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://f.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/eus-b/s/0.6.40/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.84.22.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://nakedsecurity.sophos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-origin: https://nakedsecurity.sophos.com
date: Thu, 08 Sep 2022 22:23:18 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

Verdicts & Comments Add Verdict or Comment

102 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

45 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sophos.com/	1970-01-20 08:00:51	Name: _gcl_au Value: 1.1.268284721.1662675798
.quora.com/	1970-01-20 05:51:17	Name: __cf_bm Value: 0FtLNZ0z7tsafGBYpf8cvPQbPZd1kOdZT.5WOlKj.y0-1662675797-0-AbZ+QHy+b4CG3EqHirzAB+1CZ4PqrXmko0TJLZvCr8CMQWuO2PfcAeLUKljXlhApoPLy7vOXSM2IPIMB5aXVxoo=
.bing.com/	1970-01-20 15:12:51	Name: MUID Value: 10C6A60759A66AAB28F9B41E58746BA6
.sophos.com/	1970-01-20 08:00:51	Name: _fbp Value: fb.1.1662675797975.1520384942
www.sophos.com/	1969-12-31 23:59:59	Name: akacd_pr01 Value: 3840128596~rv=53~id=ab8a671262fcdcec70a1e36074ed4b25
.t.co/	1970-01-20 15:27:15	Name: muc_ads Value: 0dbe2743-4b05-4d0c-8f8d-2feda2359ec8
.twitter.com/	1970-01-20 15:27:15	Name: personalization_id Value: "v1_Ai3UhyLE8LTV9b6Ym7e3mA=="
.sophos.com/	1970-01-20 10:10:27	Name: CampaignID Value: 70130000001xGqlAAE
.sophos.com/	1970-01-20 05:52:42	Name: _uetsid Value: d6c6af402fc411eda94c911ecd20358e
.sophos.com/	1970-01-20 15:12:51	Name: _uetvid Value: d6c6ce502fc411ed8c41d5f5e20a165d
.sophos.com/	1970-01-20 15:27:15	Name: __utma Value: 1.1098213058.1662675798.1662675798.1662675798.1
.sophos.com/	1969-12-31 23:59:59	Name: __utmc Value: 1
.sophos.com/	1970-01-20 10:14:03	Name: __utmz Value: 1.1662675798.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.sophos.com/	1970-01-20 05:51:16	Name: __utmt Value: 1
.sophos.com/	1970-01-20 05:51:17	Name: __utmb Value: 1.1.10.1662675798
.nakedsecurity.sophos.com/	1970-01-20 15:27:15	Name: __utma Value: 222203399.1204528877.1662675798.1662675798.1662675798.1
.nakedsecurity.sophos.com/	1969-12-31 23:59:59	Name: __utmc Value: 222203399
.nakedsecurity.sophos.com/	1970-01-20 10:14:03	Name: __utmz Value: 222203399.1662675798.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.nakedsecurity.sophos.com/	1970-01-20 05:51:16	Name: __utmt_ns Value: 1
.nakedsecurity.sophos.com/	1970-01-20 05:51:17	Name: __utmb Value: 222203399.2.9.1662675798
.yahoo.com/	1970-01-20 14:37:13	Name: A3 Value: d=AQABBFZrGmMCECcyDWJronE4aBLJlHKe52UFEgEBAQG8G2MkYwAAAAAA_eMAAA&S=AQAAAgrtT9lmuNcfzv2AHoqE8xk
.doubleclick.net/	1970-01-20 05:51:16	Name: test_cookie Value: CheckForPermission
.linkedin.com/	1970-01-20 06:34:27	Name: UserMatchHistory Value: AQLPbt87DexwKwAAAYMfM0jinKRoYxPyrMr6dtnISbE_TwuLGIhZ9MSqej9XR0xsvuLU7-lOQpQ3dw
.linkedin.com/	1970-01-20 06:34:27	Name: AnalyticsSyncHistory Value: AQIktfmfVkOx9gAAAYMfM0jiDZS0BZabHU3jMSJ5quEEj_SRUruD8y6QRb6IcD9gp6TeCxZPpAWWQ_VVQGwM4g
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 14:36:51	Name: bcookie Value: "v=2&6440eb3f-16ff-4785-82cc-09b0dda1abf2"
.linkedin.com/	1970-01-20 05:52:42	Name: lidc Value: "b=VGST05:s=V:r=V:a=V:p=V:g=2576:u=1:x=1:i=1662675798:t=1662762198:v=2:sig=AQErpzOeBd9iHFt0GUrjlFhLnY86t7z-"
www.clarity.ms/	1970-01-20 14:36:51	Name: CLID Value: f533651a5d6e4f24972a52421afe8fdc.20220908.20230908
tags.srv.stackadapt.com/	1970-01-20 14:36:51	Name: sa-user-id Value: s%3A0-1b5cabcb-82e9-49c2-6008-519289309634.OlBP%2FhUFwho0OxBwnantIUA7Yl7%2BG5SykUd2bXmAlb0
.srv.stackadapt.com/	1970-01-20 14:36:51	Name: sa-user-id-v2 Value: s%3AG1yry4LpScJgCFGSiTCWNLnVm6U.uxdKv%2ByxhftDTJH3elRkpiMA3L2YKmAD6VxYKiyDw2Y
nakedsecurity.sophos.com/	1970-01-20 14:36:51	Name: sa-user-id Value: s%253A0-1b5cabcb-82e9-49c2-6008-519289309634.OlBP%252FhUFwho0OxBwnantIUA7Yl7%252BG5SykUd2bXmAlb0
nakedsecurity.sophos.com/	1970-01-20 14:36:51	Name: sa-user-id-v2 Value: s%253A0-1b5cabcb-82e9-49c2-6008-519289309634%2524ip%2524185.213.155.165.vosyUeFi6tF0BomjiaEO1aPlsqiVAWjvZTv3hcPzcF0
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 14:36:51	Name: bscookie Value: "v=1&20220908222318d10eadea-82e2-445c-85ac-6d88c7b0cc41AQHF_AoJKUzkmsiRTdBeJDUTtoOgBRcb"
.linkedin.com/	1970-01-20 10:10:27	Name: li_gc Value: MTswOzE2NjI2NzU3OTg7MjswMjF8YcsutIPi8Q1VCM5Vcj/RSJDFJSplX7ktstHtcce5wg==
.bidr.io/	1970-01-20 15:19:49	Name: bito Value: AACnME7GNNcAAA5Ju3c04w
.bidr.io/	1970-01-20 15:19:49	Name: bitoIsSecure Value: ok
.sophos.com/	1970-01-20 14:36:51	Name: _clck Value: 1uj3zn1\|1\|f4p\|0
.company-target.com/	1970-01-20 15:27:15	Name: tuuid_lu Value: 1662675798
.company-target.com/	1970-01-20 15:27:15	Name: tuuid Value: aaf9b5f0-c722-42c9-89fb-b183708aac16
.c.bing.com/	1970-01-20 15:12:51	Name: SRM_B Value: 10C6A60759A66AAB28F9B41E58746BA6
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 15:12:51	Name: MUID Value: 10C6A60759A66AAB28F9B41E58746BA6
.c.clarity.ms/	1970-01-20 05:51:16	Name: ANONCHK Value: 0
.sophos.com/	1970-01-20 05:52:42	Name: _clsk Value: 10sx4rw\|1662675798970\|1\|1\|f.clarity.ms/collect

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.quora.com
analytics.twitter.com
api.company-target.com
bat.bing.com
c.bing.com
c.clarity.ms
connect.facebook.net
f.clarity.ms
googleads.g.doubleclick.net
id.rlcdn.com
img03.en25.com
insight.adsrvr.org
js.adsrvr.org
match.prod.bidr.io
nakedsecurity.sophos.com
pixel.wp.com
polldaddy.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
s.yimg.com
scripts.demandbase.com
segments.company-target.com
snap.licdn.com
sp.analytics.yahoo.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
stats.wp.com
t.co
tags.srv.stackadapt.com
www.clarity.ms
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.sophos.com
104.244.42.195
104.244.42.197
108.138.17.87
13.107.42.14
142.250.185.194
15.197.193.217
162.159.152.17
18.66.97.46
192.0.123.248
192.0.76.3
199.232.136.157
20.234.93.27
20.84.22.197
212.82.100.181
23.75.243.91
2620:1ec:21::14
2620:1ec:27::cafe:1774
2620:1ec:c11::200
2a00:1288:f03d:1fa::4000
2a00:1450:4001:802::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80e::2008
2a00:1450:4001:82b::2004
2a00:1450:400c:c06::9a
2a02:26f0:10e::6860:5bba
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f107:83:face:b00c:0:25de
2a04:fa87:fffd::c000:42e3
35.244.174.68
52.2.80.154
52.213.154.120
52.222.177.228
52.222.214.8
52.54.24.90
96.16.149.96
05abc444f8139d33b13689329db8ea9398a1f63d455f8703783db8bebd7c09b9
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4
07927a9a88434415d119a70fdcb1b8d91f3cb07fcc02ce20aef65b57f79ead9f
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
161e1d347ed141e560fdff4e56964d7fa41834bdbc779b2c59722ac15e50f0cb
1621e7c862be84cd5d2cd8e4b3a4d8382b853714d6ca0a57da9a04b115a42364
184179bcb91fed70ed252c734fa54358a0d93343c9570914b827bde5217f2258
1a3943718328f50162226e58817036e1141852b82995bcdbb9badc1ff487256d
1a49a2cffa6dda5993f1571558d44644ad9517dfa370fbb7b0e9d005d33fc7bc
1b15df54cdbcf927d9ca83dec5a5804283f3a3aae0d1a787897b516690ff5d1e
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
28d801ccf6ed445239a3401f0ef3b360055d0b419daf8315c84f5b636d2bb74f
30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
34eeeef2cc592fbe6d7c0ba83ec2ba60afbe622b555f4c6734b23cf508ba8032
38ab3f7d1c69ad33e955da101c04d99ed3e60931fa4ae9691cbbc001dcf78c8b
396ece7da42aff66b3f8796b571322ea8e9455e2eb335b79f9a640b0b1b187b2
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3cc1c65a673b37eaa0bb0cfb567268d15b0a831c2708ab961d2ef8a6fee93420
3e69fa9b3a2cc7d14f196929aa530b02ca0dac6fb8a335870e525df7f44eac7e
3f41d17bab2293be8ce2c9605e5c94bef86bd91ac7359d3307ad64e516f9f509
412b3b1fae4165c7fbbdfcb26b140226ad917e96c60b32be00beed0e037dc209
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d
4503e524f77aba44b36b834f2f8efc08a48189f7915ed42956b151c9afb55c1f
4c331a19f481eb536fa4ddc75c1c8808057f1357bcf8c61e6ab963b6dc2a6907
50870e8da23872c30fa309895e6bcf9e10a3575a7001d54f6fcaff8f9d0ee263
541654686bb744c72ad4e8950bb8cf9fb5ab7d07a57aa05a8de41a68a5f0d071
5467511a1c80aeedcb76b7143274329dd6d861608a3cac5b8ac6a46166723c97
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5ae95e748ad12444cd760e245c02264cea3e8deb41fabd95f1e0784b81f72783
617ffb964e26c84d0424565e5a368a9031e9881865cd7c74038f49537b165ef4
6280af26ccd34631a90de8cc4f33e915d39720dd7767ea8a2042e1864dd0819a
63ee1658cac1b7a77753a1bf9e9fc5e7a05e73426e608fef3f2b482a1f0c71ae
661f43d9c68c22a570e06047252b335e27092489954600dae9f651c6a48ae064
6ddecf084e5b6ed52ab9c8143890a72a3d695edee6fafbf4ca5128a7cd6f1b3f
6f8335b75414a35e0040bce275c49766771943872f83b7835179a7b9e3214dd6
707d0980b1c65b912c943b578c3a576a01ed96cab83b0e6b8bd6602b9835066c
75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469
7b9258ba22bf2f97c61fc46d53f472cda821d4d730b26772a2008b9397202ca0
7ef688a40b5120227d23c350bceaefd6ff21bf36c0a1a2171b947a2e344f0a94
81cb96a1acb83f3a5e308b48e5274ac2cab20be38cfa724fdd715d6ff2a0ee85
821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83a53e0824cadc04267cf1be887d08a24e68694e6d9c91a2bb41ee2f0e12762e
86f388a06affc92020302d848bc31e5df0593256b24bfe1c1a9d8d3d8e70915a
8a11a1bdb458db9c6f265e25f38f343b7978c35747df6caa367e47bcccee6dac
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774
8f6d27bf07f52b22aa791547c3a2103bf0824c44ae2df17d413e5a7e0d386075
964dd54dd651e6c51d925cd29df29d85678781f357444e148522b04bb0a28bf4
969234168bcf7ea877a437e885fb4294e1fb85cf8227003b5b82375862e17e10
991923b6a8fae549f6ee964ffb9c558d18f74f02625505f4109e4744d17b324f
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9c0d7fa32b9df01a54fb97e195ec1a25bbc65b528766e4392ca21b001224fea0
9c1f15176d95e744d3f57536b9f3a8f41e8c6e71544834d984719116850c416a
a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2
a68e0da9ff047b6cdc6a58b4f179b0fd1ac0e97eda2dfade8c1375203b3adba7
a8f6595e285c4085200aea9ee4f45fe54a229f4805d6ebcde5c5fc74056d9dc7
aac5341aa4c349318c1a57a00c4df3d3174c930fe1f04c34a87f4b07982d06d6
ac3b910bfbfbac794c42fba9ac1524e9b3c796e77727a97d1417bfb8b5c3dabb
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b0a63a118c83ee872479df62851952db56d1d01f6dad0b148b3522b7b712d47d
b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb
b2fe29d1813dd78bc44fcb57c65740ee5965fe6985c5c69d9576e0c0a9b5fe5f
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b5c362f1555024cd5b82dea46ecec6a9469e62241235ecfc4e9519ea2e3864c5
b6beea83b41d9ecf1174e4388d6dc1c0785e94bab96d0af7c425e7ca7253f74f
bbffae0d03e6d48b808856596e595ab718c08bbc4476e7323bfcff4a6f833260
bf45a939fd9e6d74a7acc1b575d73088396888717272bb8643c2b5479afea4a2
c1817e1ecd0d9bd3dca63a459f6c8ed1e1537326bc751d9a03a83792b7b44b52
c1b5abdbb69406f60f199ccb2a1b1e2a1a31da6d66d4f87679cc8456869aca25
c7443b4fdccf0b49d8fa5eb106775bb5b5edaeadc40929ada7c505a27767107a
d5e1400eee0949528068e4bc7b680039cacfdd013aee4164d988544fc7c4c4d8
d85e8f32872c1fd6438f8a355f4b7226b5af9ba87474e590cc352f6cd16d2d9a
dd5c04b5dca94a5fd1d124190ff1c143b8845c9bcd6c8f9ac7f6608707441dee
e062f5843f223fb2222333e6cca83f64b1d307875aeca187aec1a3055f3157b1
e1b293d96560e1b12aafc0b0798ead6291de4c789c78671fff5609cea24aeedc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4aadbfb76725939385602738ef216b5f75ee5a3d3824d82be9862c43bb1b079
e72ee287deffe0dcbf6f6de76cd306f455eac4b70337586b115d67841e090307
e8eab802d8a017af747aeb8abd3c937420e3f0a2c0f3d06828df322e620c6867
e99765013eb2f55969542e1663eb0f02cf0b05a9597b58fc871e6964c6729dd9
edfc15c6d8e105511ebc6f81ca49ec279a1f608c5b9e465cf37a56baba09750b
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f02048fc30cf09f21fabfee36fb76feb7c239a3b6b0a011e6c5ab4c91422fd0b
f05a815262962493146cae3d7370bfa4c5d488fc8630e5caf861f33f2ede341d
f06210c8e0ec5ba4f4679ba1c9a301176def4a552f29388629ddaef7320681ba
f09c53ca35858cba3d65ebcc619e4ff5d68ab5590391d3f0bb0fdca57a89d816
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f477ce00c56054732e796120e25bdbd59279df67d5714746cfce4f62dd199584
f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11
fcd979553c43747d6e8686d91f3616954c01faf7177dd5db4427856063be2956

nakedsecurity.sophos.com Open in urlscan Pro 2a04:fa87:fffd::c000:42e3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

109 Requests

94 %HTTPS

37 %IPv6

28 Domains

39 Subdomains

32 IPs

7 Countries

941 kBTransfer

2272 kBSize

45 Cookies

46 Outgoing links

Redirected requests

109 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

nakedsecurity.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42e3 Public Scan

Screenshot
Live screenshot

Full Image

109
Requests

94 %
HTTPS

37 %
IPv6

28
Domains

39
Subdomains

32
IPs

7
Countries

941 kB
Transfer

2272 kB
Size

45
Cookies

109 HTTP transactions
0 data transactions