threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://threatpost.com/convincing-google-impersonation=
Effective URL:
https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Submission: On March 18 via api (March 18th 2020, 2:21:21 pm UTC) from US

Summary HTTP 230 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 49 IPs in 7 countries across 37 domains to perform 230 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by Thawte EV RSA CA 2018 on June 17th 2019. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 20	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
11	99.86.243.30 99.86.243.30	16509 (AMAZON-02) (AMAZON-02)
5	2606:4700:303... 2606:4700:3036::681f:4fc2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2a00:1450:400... 2a00:1450:4001:818::2002	15169 (GOOGLE) (GOOGLE)
7	2600:9000:206... 2600:9000:206e:c000:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
12	2600:9000:214... 2600:9000:214f:a400:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
4 7	2a00:1450:400... 2a00:1450:4001:824::2004	15169 (GOOGLE) (GOOGLE)
22	185.220.204.204 185.220.204.204	41436 (CLOUDWEBM...) (CLOUDWEBMANAGE-EU)
7	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:820::2002	15169 (GOOGLE) (GOOGLE)
4	69.173.144.142 69.173.144.142	26667 (RUBICONPR...) (RUBICONPROJECT)
1	72.251.249.14 72.251.249.14	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
4	185.33.223.80 185.33.223.80	29990 (ASN-APPNEX) (ASN-APPNEX)
4	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
5	152.199.21.89 152.199.21.89	15133 (EDGECAST) (EDGECAST)
1 6	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE)
1	178.128.135.80 178.128.135.80	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	95.101.185.51 95.101.185.51	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 3	2a00:1450:400... 2a00:1450:4001:818::200e	15169 (GOOGLE) (GOOGLE)
2 2	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
35	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:817::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f02... 2a03:2880:f02d:e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2a05:f500:11:... 2a05:f500:11:101::b93f:9001	14413 (LINKEDIN) (LINKEDIN)
1	151.101.113.140 151.101.113.140	54113 (FASTLY) (FASTLY)
1	91.228.74.248 91.228.74.248	27281 (QUANTCAST) (QUANTCAST)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
2	99.86.234.82 99.86.234.82	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:815::2002	15169 (GOOGLE) (GOOGLE)
8	13.224.194.45 13.224.194.45	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
20	185.127.16.54 185.127.16.54	210329 (CLOUDWEBM...) (CLOUDWEBMANAGE-UK-1)
1	2600:9000:206... 2600:9000:206e:4400:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
3	18.194.129.81 18.194.129.81	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
2	52.58.85.190 52.58.85.190	16509 (AMAZON-02) (AMAZON-02)
1	91.228.74.137 91.228.74.137	27281 (QUANTCAST) (QUANTCAST)
2	23.37.55.184 23.37.55.184	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
1 1	52.203.99.84 52.203.99.84	14618 (AMAZON-AES) (AMAZON-AES)
1	52.0.180.19 52.0.180.19	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
2 2	63.32.144.14 63.32.144.14	16509 (AMAZON-02) (AMAZON-02)
2 3	52.29.20.136 52.29.20.136	16509 (AMAZON-02) (AMAZON-02)
1 1	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE)
1 2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1	95.101.184.244 95.101.184.244	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	95.101.184.231 95.101.184.231	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	165.227.252.242 165.227.252.242	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
230	49

20 35.173.160.135 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 99.86.243.30 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-30.vie50.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3036::681f:4fc2 (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:818::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:206e:c000:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2600:9000:214f:a400:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:824::2004 (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 185.220.204.204 (Amsterdam, Netherlands)

ASN41436 (CLOUDWEBMANAGE-EU, GB)

live.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:820::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.142 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.251.249.14 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.33.223.80 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 152.199.21.89 (United States)

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.95.120.147 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 147.120.95.34.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.128.135.80 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.101.185.51 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-51.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:818::200e (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9c (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

35 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:11:101::b93f:9001 (Ireland)

ASN14413 (LINKEDIN, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.113.140 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.248 (United Kingdom)

ASN27281 (QUANTCAST, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.86.234.82 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-234-82.vie50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.224.194.45 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-45.fra2.r.cloudfront.net

math-aids-threatpost-tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 185.127.16.54 (London, United Kingdom)

ASN210329 (CLOUDWEBMANAGE-UK-1, GB)

video.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:4400:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.194.129.81 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-129-81.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.58.85.190 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-85-190.eu-central-1.compute.amazonaws.com

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.137 (United Kingdom)

ASN27281 (QUANTCAST, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.37.55.184 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-55-184.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.203.99.84 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-99-84.compute-1.amazonaws.com

sync.adap.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.0.180.19 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-180-19.compute-1.amazonaws.com

sync.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.32.144.14 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-63-32-144-14.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.29.20.136 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-20-136.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.2 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s14-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.184.244 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-184-244.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.184.231 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-184-231.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 165.227.252.242 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	sekindo.com live.sekindo.com video.sekindo.com	3 MB
38	threatpost.com 1 redirects threatpost.com assets.threatpost.com media.threatpost.com	4 MB
28	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	366 KB
19	adlightning.com tagan.adlightning.com math-aids-threatpost-tagan.adlightning.com	236 KB
16	ampproject.org cdn.ampproject.org	461 KB
14	doubleclick.net 3 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	102 KB
12	advertising.com 2 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com sync.adaptv.advertising.com pixel.advertising.com	2 KB
8	rubiconproject.com fastlane.rubiconproject.com prebid-server.rubiconproject.com eus.rubiconproject.com	7 KB
8	google.com 4 redirects www.google.com adservice.google.com	1 KB
6	openx.net 1 redirects teachingaids-d.openx.net u.openx.net eu-u.openx.net	1 KB
5	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	292 B
5	adnxs.com ib.adnxs.com acdn.adnxs.com	3 KB
5	admetricspro.com qd.admetricspro.com	163 KB
4	google.de adservice.google.de www.google.de	567 B
4	googletagservices.com www.googletagservices.com	96 KB
3	yahoo.com 1 redirects pr-bh.ybp.yahoo.com ups.analytics.yahoo.com	2 KB
3	google-analytics.com 2 redirects www.google-analytics.com	18 KB
3	casalemedia.com as-sec.casalemedia.com	3 KB
2	adsrvr.org 2 redirects match.adsrvr.org	990 B
2	everesttech.net 2 redirects sync-tm.everesttech.net	598 B
2	googleapis.com fonts.googleapis.com	1 KB
2	amazon-adsystem.com c.amazon-adsystem.com	28 KB
2	quantserve.com secure.quantserve.com pixel.quantserve.com	7 KB
2	gstatic.com www.gstatic.com fonts.gstatic.com	103 KB
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	267 B
1	twitter.com analytics.twitter.com	651 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	adap.tv 1 redirects sync.adap.tv	221 B
1	t.co t.co	448 B
1	quantcount.com rules.quantcount.com	357 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	reddit.com www.reddit.com	3 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	549 B
1	googletagmanager.com www.googletagmanager.com	24 KB
1	lijit.com ap.lijit.com	702 B
1	kasperskycontenthub.com kasperskycontenthub.com	398 B
230	37

	Domain	Requested by
22	live.sekindo.com	threatpost.com live.sekindo.com
20	video.sekindo.com	threatpost.com live.sekindo.com
19	tpc.googlesyndication.com	tagan.adlightning.com threatpost.com cdn.ampproject.org
19	threatpost.com	1 redirects threatpost.com live.sekindo.com
16	cdn.ampproject.org	securepubads.g.doubleclick.net threatpost.com
12	media.threatpost.com	threatpost.com
11	tagan.adlightning.com	threatpost.com tagan.adlightning.com
9	pagead2.googlesyndication.com	tagan.adlightning.com threatpost.com pagead2.googlesyndication.com securepubads.g.doubleclick.net
8	math-aids-threatpost-tagan.adlightning.com	tagan.adlightning.com
7	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
7	www.google.com	4 redirects threatpost.com tagan.adlightning.com
7	assets.threatpost.com	threatpost.com
5	adserver-us.adtech.advertising.com	qd.admetricspro.com
5	qd.admetricspro.com	threatpost.com
4	googleads.g.doubleclick.net	tagan.adlightning.com pagead2.googlesyndication.com threatpost.com
4	hbopenbid.pubmatic.com	qd.admetricspro.com live.sekindo.com
4	ib.adnxs.com	qd.admetricspro.com live.sekindo.com
4	fastlane.rubiconproject.com	qd.admetricspro.com
4	www.googletagservices.com	threatpost.com tagan.adlightning.com securepubads.g.doubleclick.net
3	pixel.advertising.com	2 redirects threatpost.com
3	ads.adaptv.advertising.com	live.sekindo.com
3	www.google-analytics.com	2 redirects threatpost.com
3	as-sec.casalemedia.com	qd.admetricspro.com live.sekindo.com
3	teachingaids-d.openx.net	qd.admetricspro.com live.sekindo.com
2	ups.analytics.yahoo.com	1 redirects threatpost.com
2	match.adsrvr.org	2 redirects
2	sync-tm.everesttech.net	2 redirects
2	u.openx.net	1 redirects live.sekindo.com
2	eus.rubiconproject.com	live.sekindo.com qd.admetricspro.com
2	prebid-server.rubiconproject.com	live.sekindo.com
2	fonts.googleapis.com	live.sekindo.com
2	c.amazon-adsystem.com	live.sekindo.com c.amazon-adsystem.com
2	www.google.de	threatpost.com
2	stats.g.doubleclick.net	2 redirects
2	adservice.google.de	tagan.adlightning.com
1	analytics.twitter.com	tagan.adlightning.com
1	eu-u.openx.net	qd.admetricspro.com
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	acdn.adnxs.com	qd.admetricspro.com
1	ads.pubmatic.com	qd.admetricspro.com
1	cm.g.doubleclick.net	1 redirects
1	pr-bh.ybp.yahoo.com	threatpost.com
1	sync.adaptv.advertising.com	threatpost.com
1	sync.adap.tv	1 redirects
1	pixel.quantserve.com	threatpost.com
1	fonts.gstatic.com	threatpost.com
1	t.co	threatpost.com
1	rules.quantcount.com	secure.quantserve.com
1	adservice.google.com	tagan.adlightning.com
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	www.gstatic.com	www.google.com
1	www.googletagmanager.com	threatpost.com
1	e.serverbid.com	qd.admetricspro.com
1	ap.lijit.com	qd.admetricspro.com
1	kasperskycontenthub.com	threatpost.com
230	60

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feedly.com
www.instagram.com
medium.com
media.threatpost.com
attendee.gotowebinar.com
akismet.com
t.co
indd.adobe.com
spotlight.threatpost.com

Subject Issuer	Validity	Valid
threatpost.com Thawte EV RSA CA 2018	`2019-06-17` - `2020-06-17`	a year	crt.sh
*.adlightning.com Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-04` - `2020-10-09`	8 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
kasperskycontenthub.com Thawte RSA CA 2018	`2019-06-14` - `2020-06-13`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-02-25` - `2020-05-19`	3 months	crt.sh
www.sekindo.com Go Daddy Secure Certificate Authority - G2	`2019-05-23` - `2020-06-18`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2019-03-11` - `2020-05-10`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 High Assurance Server CA	`2018-05-22` - `2020-05-26`	2 years	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2018-01-04` - `2020-07-09`	3 years	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2019-12-25` - `2020-03-24`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-02-25` - `2020-05-19`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-02-25` - `2020-05-19`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-05-30`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2019-11-21` - `2020-09-01`	9 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2018-08-17` - `2020-09-02`	2 years	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-02-25` - `2020-05-19`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2019-10-04` - `2020-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2019-10-07` - `2020-09-29`	a year	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-02-25` - `2020-05-19`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.vssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2019-11-07` - `2020-05-05`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-01-04` - `2020-07-02`	6 months	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2017-06-14` - `2020-06-18`	3 years	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-02-13` - `2020-08-11`	6 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2020-01-02` - `2021-04-02`	a year	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh

This page contains 21 frames:

Primary Page: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Frame ID: C67C1DE944CACAF3AE7BB21DCF629820
Requests: 90 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1584541245&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Frame ID: 8EC95EDEB034C15A399942306031FCE2
Requests: 41 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-5b1e2be-4189caf1.js
Frame ID: C86674D134C11884C85ABA1A86EA7828
Requests: 14 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-5b1e2be-4189caf1.js
Frame ID: DEF219D22A4F7F6B81C93692AF537977
Requests: 18 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=qpy2aGtSgsYPZzCoYWjcaBCo&theme=standard&size=normal&cb=samflv56sbmt
Frame ID: 5C44E7034FE06345099D8796A43B3036
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-5b1e2be-4189caf1.js
Frame ID: D9C41EDC3C8F3A20FDEB8D548C4E9AFB
Requests: 25 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-5b1e2be-4189caf1.js
Frame ID: 670859C24B9543432C1E8DFB4CDCF955
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200312/r20190131/zrt_lookup.html
Frame ID: 2C1AD6DF694A17F84CEEAB22C18FE19E
Requests: 1 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: 1750FE6E47E93C64C5582036DBBD646C
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: 767ED6668D2594EE50AA0E46A6601394
Requests: 20 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=qpy2aGtSgsYPZzCoYWjcaBCo&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=y9t6y9gn8mg7
Frame ID: 4844C079C0F2F31EFFC3D84EE8972E57
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=90&slotname=7759284332&adk=4262696766&adf=3173046730&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584541247459&bpp=27&bdt=472&fdt=312&idt=312&shv=r20200312&cbv=r20190131&ptt=9&saldr=aa&correlator=4899283501714&frm=23&ife=4&pv=2&ga_vid=1931637771.1584541246&ga_sid=1584541248&ga_hid=451880512&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=10&biw=1585&bih=1200&isw=728&ish=90&ifk=1941443103&scr_x=0&scr_y=0&oid=3&pvsid=447436609624923&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.uerhtjtpyps0&fsb=1&dtd=341
Frame ID: 9F2A39C6292DA85BDCB1C38C80109823
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Frame ID: 209B24CB4E197571B664EBFA6C6A54BF
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Frame ID: 83A763DB6E00561A35FDBFD74860B125
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: F25B985F3A5CA3A25A6EA2A4F195ACAC
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 9FFB1F291931E217F56793EFF38CCF78
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 3A2F23C70719BBCDD6020664CCC275B3
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 61B833509AD0100CEEA5FF64BEC30ADF
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
Frame ID: A56B495EC55E1E79BCEC276286041F69
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 39A4EB7545995FE1CF488B2AA00B8EA2
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: D7871EF2D17D92FAAABC64C1CDA3B17C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://threatpost.com/convincing-google-impersonation= HTTP 301
https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /\/prebid\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

230
Requests

100 %
HTTPS

35 %
IPv6

37
Domains

60
Subdomains

49
IPs

7
Countries

9198 kB
Transfer

13500 kB
Size

4
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatpost/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/threatpost

Search URL Search Domain Scan URL

URL: https://feedly.com/threatpost

Search URL Search Domain Scan URL

URL: https://www.instagram.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://medium.com/@avi_59283/poc-for-google-phishing-in-10-minutes-%C9%A2oogletranslate-com-dcd0d2c32d91
Title: in a posting

Search URL Search Domain Scan URL

URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/16155747/Google-phish.png

Search URL Search Domain Scan URL

URL: https://attendee.gotowebinar.com/register/3191336203359293954?source=art
Title: “5G, the Olympics and Next-Gen Security Challenges,”

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23Magecart
Title: #Magecart

Search URL Search Domain Scan URL

URL: https://t.co/cmaHwShKSZ
Title: https://t.co/cmaHwShKSZ

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost
Title: Follow @threatpost

Search URL Search Domain Scan URL

URL: https://indd.adobe.com/view/01579c19-a6ca-4cb0-8106-ed4d5d02a292
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://spotlight.threatpost.com/
Title: HackerOne Spotlight

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://threatpost.com/convincing-google-impersonation= HTTP 301
https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 53

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=314778856&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ul=en-us&de=UTF-8&dt=Convincing%20Google%20Impersonation%20Opens%20Door%20to%20MiTM%2C%20Phishing%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABC~&jid=290009392&gjid=1444024491&cid=1931637771.1584541246&tid=UA-35676203-21&_gid=366344402.1584541246&_r=1&z=3423801 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=1931637771.1584541246&jid=290009392&_gid=366344402.1584541246&gjid=1444024491&_v=j81&z=3423801 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=290009392&_v=j81&z=3423801 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=290009392&_v=j81&z=3423801&slf_rd=1&random=323734353

Request Chain 98

https://www.google-analytics.com/r/collect?v=1&_v=j81&aip=1&a=314778856&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ul=en-us&de=UTF-8&dt=Convincing%20Google%20Impersonation%20Opens%20Door%20to%20MiTM%2C%20Phishing%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aEhAAUABC~&jid=104956128&gjid=1741652058&cid=1931637771.1584541246&tid=UA-35676203-21&_gid=1178691383.1584541247&_r=1&gtm=2wg3b2PM29HLF&z=634426486 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=1931637771.1584541246&jid=104956128&_gid=1178691383.1584541247&gjid=1741652058&_v=j81&z=634426486 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=104956128&_v=j81&z=634426486 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=104956128&_v=j81&z=634426486&slf_rd=1&random=1593185252

Request Chain 159

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 175

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 197

https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent= HTTP 302
https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=

Request Chain 198

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=XnIuQQAAAHyBK1k2 HTTP 302
https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XnIuQQAAAHyBK1k2&_test=XnIuQQAAAHyBK1k2 HTTP 302
https://sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=XnIuQQAAAHyBK1k2&_test=XnIuQQAAAHyBK1k2

Request Chain 200

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=87c5d532-b5d6-494e-a2e9-7dbc70e67d0d&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=87c5d532-b5d6-494e-a2e9-7dbc70e67d0d

Request Chain 201

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1 HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1&apid=UPab0c6727-6923-11ea-b820-028feea51e5a HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1&apid=UPab0c6727-6923-11ea-b820-028feea51e5a&verify=true

Request Chain 207

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

230 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Redirect Chain

https://threatpost.com/convincing-google-impersonation=
https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

85 KB
22 KB

459ms
225ms

Document
text/html

35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

56fb012c459c714ef7d38cea2a8afb470c9077f898c7ba1f34604770b972ef28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Server: nginx
Date: Wed, 18 Mar 2020 14:20:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/?p=153745>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: HIT
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Wed, 18 Mar 2020 14:20:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store
X-Redirect-By: WordPress
Location: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: MISS

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 234 KB
35 KB 343ms
114ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 56ab0f61f8ed6030bdd684f3752233177da0555b07cb172e0abffe8e02978bc5

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:44 GMT
Content-Encoding: gzip
Last-Modified: Tue, 17 Mar 2020 13:49:16 GMT
Server: nginx
ETag: W/"5e70d55c-3a94d"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 25 Mar 2020 14:20:44 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 47 KB
14 KB 659ms
546ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b14b26b4f9dfea337c9b706964d07db8723f630a38f1587b3966fc90854773cd

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:04:41 GMT
content-encoding: gzip
x-amz-cf-pop: VIE50-C1
x-cache: RefreshHit from cloudfront
status: 200
content-length: 13730
x-amz-meta-git_commit: 0d4dfcb
last-modified: Tue, 17 Mar 2020 22:33:48 GMT
server: AmazonS3
etag: "0c238532754f2ae0b71326275195ea39"
x-amz-version-id: zwlFr.h17cjKTPVFg2p05GidY12gdgZX
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=900
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: dda_4GUii32Pke-PRPyNbnFuYMXzGXvSzXyWJ2fCs65VsDdQwv4k0w==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 18 KB
3 KB 47ms
15ms Script
application/javascript 2606:4700:3036::681f:4fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681f:4fc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6f82014ed1bf97fc0ac74d2a0c213cad2d625e7195893ec8f5297a1f1a9b315

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:44 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 25 Feb 2020 17:18:38 GMT
server: cloudflare
age: 346
etag: W/"4873-59f69adb865f0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 575f989b4abfd6cd-FRA
access-control-allow-origin: *
expires: Wed, 18 Mar 2020 14:21:21 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 42 KB
14 KB 19ms
17ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a519a1e5dbf70e322138ea492c71bdadae357cfab95bf924598dc708e4096da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "459 / 424 of 1000 / last-modified: 1584453129"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14363
x-xss-protection: 0
expires: Wed, 18 Mar 2020 14:20:44 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 218 KB
61 KB 52ms
20ms Script
application/javascript 2606:4700:3036::681f:4fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681f:4fc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aaf45a172ec90c76bcecd61c68d998c2256fe9b1700371e80011d1161c5ab629

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:44 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 27 Sep 2019 21:07:46 GMT
server: cloudflare
age: 346
etag: W/"367ba-5938f47194c80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 575f989b4ac2d6cd-FRA
access-control-allow-origin: *
expires: Wed, 18 Mar 2020 14:21:21 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
236 B 51ms
20ms Script
application/javascript 2606:4700:3036::681f:4fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681f:4fc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:44 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
age: 346
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 575f989b4ac4d6cd-FRA
access-control-allow-origin: *
expires: Wed, 18 Mar 2020 14:24:48 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 294 KB
86 KB 57ms
26ms Script
application/javascript 2606:4700:3036::681f:4fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681f:4fc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f40f7297122393e1425eec62e78a75c3211f7ad3f6b09a356aa317fcedc2cf3

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:44 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 26 Feb 2020 03:30:32 GMT
server: cloudflare
age: 347
etag: W/"49929-59f723a0fd39e-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 575f989b4ac1d6cd-FRA
access-control-allow-origin: *
expires: Wed, 18 Mar 2020 14:17:58 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 16 KB
12 KB 50ms
19ms Script
application/javascript 2606:4700:3036::681f:4fc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681f:4fc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcf391dd0b006a87698ac0894d71039d610480913d24fcdaa1f2fdeeeda943e3

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:44 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 24 Nov 2019 00:06:08 GMT
server: cloudflare
age: 347
etag: W/"41f6-5980c69fe949d-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 575f989b4ac0d6cd-FRA
access-control-allow-origin: *
expires: Wed, 18 Mar 2020 14:15:37 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 77 KB
17 KB 76ms
24ms Stylesheet
text/css 2600:9000:206e:c000:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=e0eeaf73

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:206e:c000:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

2ed8662cb6ca4b48b146127db22ebd71f824d54fb6ca11601bd8fa97ff572cf2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Wed, 18 Mar 2020 13:51:39 GMT
content-encoding: gzip
age: 1759
x-cache: Hit from cloudfront
status: 200
content-length: 16477
x-cache-hit: MISS
last-modified: Tue, 17 Mar 2020 13:49:15 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 d13056936a303c282faeee607951588a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: KADbX7siEhskP40nya6lIECuC03_YbFmaFgW-gJ875p3h1NE77y6Og==
expires: Thu, 19 Mar 2020 13:49:58 GMT

GET
H/1.1 200
OK frontend.min.js Show response
threatpost.com/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/ 9 KB
3 KB 521ms
119ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend.min.js?ver=6.0.2
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: dab98b1d5558dd15c7db5ada4438fe03a424a7c1f5e0f29567d39a0a892bcc41

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:45 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Feb 2020 15:30:48 GMT
Server: nginx
ETag: W/"5e441a28-2431"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 25 Mar 2020 14:20:45 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 1525ms
304ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:45 GMT
Content-Encoding: gzip
Last-Modified: Wed, 18 Dec 2019 22:32:15 GMT
Server: nginx
ETag: W/"5dfaa8ef-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 25 Mar 2020 14:20:45 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 175 KB
55 KB 80ms
28ms Script
application/x-javascript 2600:9000:206e:c000:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=e0eeaf73

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:206e:c000:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f89d17dc2e4ecb385243b7b4cdaf5d8d9f6d4b9829e2be80afb66d01721835e3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 13:51:39 GMT
content-encoding: gzip
age: 1858
x-cache: Hit from cloudfront
status: 200
content-length: 55884
x-cache-hit: MISS
last-modified: Tue, 17 Mar 2020 13:49:16 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 d13056936a303c282faeee607951588a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: yqnzevBfzVZrzjovbgAIOSafTnOfcoff7q0NfNhtXoUlweoah8FBrA==
expires: Thu, 19 Mar 2020 13:49:44 GMT

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
398 B 573ms
115ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=131413414&back=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 18 Mar 2020 14:20:45 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
x-cache-hit: HIT
Transfer-Encoding: chunked
X-Debug-Auth: off
Connection: close
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 google.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/10/23114037/ 3 MB
3 MB 31ms
8ms Image
image/jpeg 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/23114037/google.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9e679a848ff7efd13c99bda68f0e721c27ec6c092a54a3898971023479ce269a

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 16 Mar 2020 21:14:14 GMT
via: 1.1 139113252a51f85c84cb641b4d964ba5.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Wed, 23 Oct 2019 15:40:38 GMT
server: AmazonS3
age: 147991
etag: "84ec81a2ebc0d20befda20079783fa09"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: MUC51-C1, FRA53-C1
accept-ranges: bytes
content-length: 3230141
x-amz-cf-id: qvRhB9TfpeHvx5dft5mhoMzfVX2_R5Wev0PfdWiOLSc5XR4KlR3ooQ==
expires: Thu, 22 Oct 2020 15:40:37 GMT

GET
H2 200 Tara-headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/ 13 KB
13 KB 60ms
37ms Image
image/jpeg 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/Tara-headshot.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 15 Feb 2020 01:16:18 GMT
via: 1.1 660f4277d8fbef27985e8a4a97e362cc.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Fri, 17 Aug 2018 16:22:08 GMT
server: AmazonS3
age: 2811867
etag: "dee18dfeea6de13bec60c1e5237eb723"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA53-C1
accept-ranges: bytes
content-length: 13097
x-amz-cf-id: 2CYvj_k6zRQpciqXl7SqXHG8a47Y6BOrl9YzvHVIjNqVKhU7SPBnoQ==
expires: Sat, 17 Aug 2019 16:22:07 GMT

GET
H2 200 subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 8 KB
9 KB 10ms
10ms Image
image/jpeg 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 15 Feb 2020 06:22:32 GMT
via: 1.1 7ce1191b390045e05b9cc74f7514b77b.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Tue, 19 Feb 2019 20:14:58 GMT
server: AmazonS3
age: 2793494
etag: "5ba45563f793f39ef6baf02645651654"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA53-C1
accept-ranges: bytes
content-length: 8281
x-amz-cf-id: E9v6I0d4FGcaWgDvl_G8__Xv1q7Zfq557gA_qQK34jt5gknYWWI4VA==
expires: Wed, 19 Feb 2020 20:14:57 GMT

GET
H2 200 Google-phish.png
media.threatpost.com/wp-content/uploads/sites/103/2020/03/16155747/ 113 KB
114 KB 14ms
14ms Image
image/png 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/16155747/Google-phish.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 45bb946a23f977d5139f76d588c777c8e3a971c18db05970997197bc5f2900ac

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 16 Mar 2020 21:14:15 GMT
via: 1.1 8547f12dca264b18406421d1487b13af.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Mon, 16 Mar 2020 19:57:48 GMT
server: AmazonS3
age: 147991
etag: "6917645873ab536cff02035314f0ffea"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: MUC51-C1, FRA53-C1
accept-ranges: bytes
content-length: 115720
x-amz-cf-id: AZsbAi8Onqe-CHj9yb9kP1D_0cbmcIYpUF8P9_DcbiYtICksyFck8Q==
expires: Tue, 16 Mar 2021 19:57:47 GMT

GET
H2 200 work-from-home-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/13163335/ 27 KB
28 KB 9ms
9ms Image
image/jpeg 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/13163335/work-from-home-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2ffc331dd3351f5bd16051454e43e4f138886c774294be85f8be45f844f82c72

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 13 Mar 2020 20:56:31 GMT
via: 1.1 7187cfd76669785d6cdaa648abee3065.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Fri, 13 Mar 2020 20:33:52 GMT
server: AmazonS3
age: 408255
etag: "f646a0271dd280b934239a907c8bd52b"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: MUC51-C1, FRA53-C1
accept-ranges: bytes
content-length: 27831
x-amz-cf-id: 5q-Cz9HHjZiM5nZmS12EIwRZLt8-12hCIaZ4yaBlc3b0IUqIHVT6nQ==
expires: Sat, 13 Mar 2021 20:33:49 GMT

GET
H2 200 google-cloud-logo-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/12100600/ 16 KB
17 KB 9ms
8ms Image
image/jpeg 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/12100600/google-cloud-logo-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 54c87afb1cd6ab4d835474b1b97d75bb118cce9fbb3f05a5d2cb1ea824a4dee8

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 14:22:02 GMT
via: 1.1 93c5c2940efa6748481c787e7c245f82.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Thu, 12 Mar 2020 14:06:20 GMT
server: AmazonS3
age: 518324
etag: "d4ba2166bd5f6fbd7df8bf9fb2d5e682"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA54, FRA53-C1
accept-ranges: bytes
content-length: 16865
x-amz-cf-id: BOmlzJFcRH8T357sLFH1fRyQRFtAOgJnVKYJs-MhI0ktZIBpCFDbxg==
expires: Fri, 12 Mar 2021 14:06:16 GMT

GET
H2 200 youtube-540x270.png
media.threatpost.com/wp-content/uploads/sites/103/2020/03/11135447/ 155 KB
156 KB 7ms
7ms Image
image/png 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/11135447/youtube-540x270.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 85f887bfc15021f9668c2fd09eee69af9bc795ac7ec2f90c99eb7ebf6a3d4b39

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 11 Mar 2020 19:29:52 GMT
via: 1.1 d7524ff4a82155dd51a24800cf39deec.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Wed, 11 Mar 2020 17:54:53 GMT
server: AmazonS3
age: 586254
etag: "11ff66f031ff8d516a2d81ad83f2c4ea"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA53-C1
accept-ranges: bytes
content-length: 159066
x-amz-cf-id: 1UOHzGAFql5abTmR7_2OXElNfYTB8jj-tWl1q9m5qmT2E7Bnd3vOLw==
expires: Thu, 11 Mar 2021 17:54:51 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 674 B
533 B 18ms
17ms Script
text/javascript 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ae6ff79046f9ee8c299dabd799c885729b480ed1df8fcda01e62f5b74892d9b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 442
x-xss-protection: 1; mode=block
expires: Wed, 18 Mar 2020 14:20:44 GMT

GET
H2 200 data-center-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2020/01/15162631/ 8 KB
9 KB 8ms
7ms Image
image/png 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/01/15162631/data-center-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1d36800d5a9c72e02424db4f2ee2d3e3391388e8b7e863533f73c788df14ab5e

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 15 Jan 2020 21:27:56 GMT
via: 1.1 5a5b94c62ea85e0c0d78b169589b08b5.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Wed, 15 Jan 2020 21:26:52 GMT
server: AmazonS3
age: 5417570
etag: "93668d327fc4fcc8e57177484d96236e"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1, FRA53-C1
accept-ranges: bytes
content-length: 8414
x-amz-cf-id: c8q4-QgSmh0DeIsMTnLpGHhGRxavCprpIOzOqJFGKJZ2TWRPGKsBeQ==
expires: Thu, 14 Jan 2021 21:26:49 GMT

GET
H2 200 cyber-threat-2020-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2019/10/25090853/ 3 KB
4 KB 11ms
10ms Image
image/png 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/25090853/cyber-threat-2020-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e69b4aedd4ba4df00f7340e4a299dacca0abd06295d6c871f6816ea07db2507c

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 19 Feb 2020 01:19:23 GMT
via: 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Fri, 25 Oct 2019 13:08:56 GMT
server: AmazonS3
age: 2466083
etag: "97535062e07e5bd8bf0ddb185a9869c7"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA53-C1
accept-ranges: bytes
content-length: 3569
x-amz-cf-id: RNpw6JvO86YdfFI5NghPI-5q7Be6aeyKgk_hV8VP62-5BPEVW5ZwPQ==
expires: Sat, 24 Oct 2020 13:08:53 GMT

GET
H2 200 patches-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2017/05/06225026/ 9 KB
9 KB 8ms
7ms Image
image/png 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2017/05/06225026/patches-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b546be5b42d65b5d2eb3ef247886a1d692512462946bac11547df2a0a5ed02a2

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 18 Feb 2020 17:49:55 GMT
via: 1.1 7ce1191b390045e05b9cc74f7514b77b.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Tue, 03 Jul 2018 01:47:16 GMT
server: AmazonS3
age: 2493051
etag: "34fd711c1863cbefe6bf897a5665a720"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA53-C1
accept-ranges: bytes
content-length: 8748
x-amz-cf-id: X75fVEOPQ1eSrPg2zHEjNT9W1Ssl9WDpX7o37V_pcZDejTKW5HSIZA==
expires: Wed, 03 Jul 2019 01:47:12 GMT

GET
H2 200 artificial_intelligence-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/10/01152243/ 2 KB
2 KB 9ms
8ms Image
image/jpeg 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/10/01152243/artificial_intelligence-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a968b405c5b4dcd85f76e5400c41930968710351102d83a80cf114ad7549b5d0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 10:04:08 GMT
via: 1.1 c90147ea5199ff7ce77981c8da4247c4.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Mon, 01 Oct 2018 19:22:48 GMT
server: AmazonS3
age: 2693799
etag: "a67a437ee807847e498f42bfe1dd14fa"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA53-C1
accept-ranges: bytes
content-length: 1834
x-amz-cf-id: -xZKf_zwPynzjxtFBplcIE2eZuaOD9_rBeEJWGvOttDTvzeKShTMew==
expires: Tue, 01 Oct 2019 19:22:43 GMT

GET
H2 200 Hacker-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/01/23110846/ 1 KB
2 KB 7ms
7ms Image
image/jpeg 2600:9000:214f:a400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/01/23110846/Hacker-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:a400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3e05b274c76d548e39c6633af671d715bd1be28a929ab47a5ae8d29ff120df7

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 11 Feb 2020 19:05:59 GMT
via: 1.1 21da0a66bafe2c8de8be4a4d8039346b.cloudfront.net (CloudFront), 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront)
last-modified: Wed, 23 Jan 2019 16:08:49 GMT
server: AmazonS3
age: 3093288
etag: "0c579c9f31a7fe9e5b94b47a6fd20620"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA53-C1
accept-ranges: bytes
content-length: 1393
x-amz-cf-id: OmUtRqKoZa0P3tG9PmTbmYXb0676JjGxqh2OlKPGe8V-1JFONHRFGg==
expires: Thu, 23 Jan 2020 16:08:46 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ 24 KB
7 KB 1110ms
29ms Script
text/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: 1559e425e28a54611f84a10c4a1cf691af538809d48bdc5a157fd89592548fa3

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:45 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/javascript; charset=utf-8

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 16ms
16ms Script
application/x-javascript 2600:9000:206e:c000:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=e0eeaf73

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:206e:c000:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 13:51:39 GMT
content-encoding: gzip
age: 1875
x-cache: Hit from cloudfront
status: 200
content-length: 935
x-cache-hit: MISS
last-modified: Tue, 17 Mar 2020 13:49:14 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 d13056936a303c282faeee607951588a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: 2aHVhwfzOHWVG6Y42V21v39xg3T6HKYDu0KllyWwwtv03BWA54u5fQ==
expires: Thu, 19 Mar 2020 13:49:29 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 26 KB
10 KB 1276ms
216ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.2.6.5
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a783d2ad42c380bc896219c080fa845d1e9f2e77483558103aeb296b95b85701

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 17 Mar 2020 13:49:14 GMT
Server: nginx
ETag: W/"5e70d55a-6923"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 25 Mar 2020 14:20:45 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 6 KB
3 KB 15ms
15ms Script
application/x-javascript 2600:9000:206e:c000:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=e0eeaf73

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:206e:c000:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

663ac3773e9741ad638447e6e9478f83e10e073c5ee433c5de3c640c7dae8c32

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 13:51:39 GMT
content-encoding: gzip
age: 1760
x-cache: Hit from cloudfront
status: 200
content-length: 2338
x-cache-hit: MISS
last-modified: Tue, 17 Mar 2020 13:49:14 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 d13056936a303c282faeee607951588a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: PRjheMIqyAxLDEF-W9TILVhqzm-u_8pMVT5EYLMZmxEP5LOKmYWPgw==
expires: Thu, 19 Mar 2020 13:49:44 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 16ms
15ms Script
application/x-javascript 2600:9000:206e:c000:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=e0eeaf73

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:206e:c000:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 13:49:30 GMT
content-encoding: gzip
age: 1875
x-cache: Hit from cloudfront
status: 200
content-length: 1747
last-modified: Tue, 17 Mar 2020 13:49:14 GMT
server: nginx
cache-control: max-age=86400
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 d13056936a303c282faeee607951588a.cloudfront.net (CloudFront)
x-cache-hit: MISS
x-debug-auth: off
x-amz-cf-pop: VIE50-C1
x-request-host: kasperskycontenthub.com
x-amz-cf-id: e-RVNcV6X_tGp6vfYEFvMz4JK6XZ2e6LDLthdk6gzf3AKZzlYmcjcg==
expires: Thu, 19 Mar 2020 13:49:30 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 15ms
15ms Script
application/x-javascript 2600:9000:206e:c000:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=e0eeaf73

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:206e:c000:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e2059610101cb4718d6d9cf8d6e44243838304968710f35ed7f44188a9c279

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 13:51:39 GMT
content-encoding: gzip
age: 1761
x-cache: Hit from cloudfront
status: 200
content-length: 947
x-cache-hit: MISS
last-modified: Wed, 18 Dec 2019 22:32:15 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 d13056936a303c282faeee607951588a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: iToB67PQjB8sjH6TthUTOZ6uLf-5l6EnFGnnu3VULJLVVMdXIV6EeQ==
expires: Thu, 19 Mar 2020 13:51:24 GMT

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ 53 KB
15 KB 73ms
72ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92236ba12e109fff1e82ecabec1eda229af59c8374c54374a38a46dc01f53559

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 17 Feb 2020 06:48:42 GMT
content-encoding: gzip
age: 2619125
x-cache: Hit from cloudfront
status: 200
content-length: 14481
x-amz-meta-git_commit: 0d4dfcb
last-modified: Mon, 20 Jan 2020 21:00:33 GMT
server: AmazonS3
etag: "bf1a2a1d4ffb353d268fccfda0736572"
x-amz-version-id: PGsbLvp7r6PsyaqOJTHRTfOBKlgvnkI7
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 4dyGbCq1El_z3yuG1iBId73b6UWbIYhVzrfKYI3OxsqrH4EK2n8Z_A==

GET
H2 200 bl-5b1e2be-4189caf1.js Show response
tagan.adlightning.com/math-aids-threatpost/ 77 KB
29 KB 66ms
66ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-5b1e2be-4189caf1.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 027ef26dead3109a62a194fdce626cf25a25f0eb950635749754e64c3acdbec4

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 17 Mar 2020 22:35:00 GMT
content-encoding: gzip
age: 56747
x-cache: Hit from cloudfront
status: 200
content-length: 29340
x-amz-meta-git_commit: 5b1e2be
last-modified: Tue, 17 Mar 2020 22:33:36 GMT
server: AmazonS3
etag: "585b143dc3b6a4e8adcd086c87a8d46d"
x-amz-version-id: CVn.OSFA89eiJRdRwRrH8m6Gii0i.ts_
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: V8aTLcJ0Jb33ijcdmlHd9tBJ51g_pBi_esiWR-OcD504l1fNL6LEew==

GET
H2 200 pubads_impl_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ 165 KB
60 KB 133ms
43ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

sffe /

Resource Hash

8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 18 Mar 2020 14:20:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 61481
x-xss-protection: 0
expires: Wed, 18 Mar 2020 14:20:45 GMT

GET
H2 200 integrator.sync.js Show response
adservice.google.de/adsid/ 113 B
178 B 54ms
54ms Script
application/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 108
x-xss-protection: 0

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 306 B
2 KB 147ms
42ms XHR
application/json 69.173.144.142
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=c49e5ce4-82b7-41ac-b320-cb784aae3f41&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9623458856028622
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: ab03c12ea6a9ab3cbd42d0e99aea371b69a483a3e3efba236bd9e07b48c91289

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:45 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=467
Content-Length: 306
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 191ms
84ms XHR
application/json 69.173.144.142
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=a3924f13-da67-41ba-980a-ddadb3ee75f8&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7283621025669735
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: b9bf85aa47770831122466d8e31ce103915caae610dbf66df0eb914a6d732aaa

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:45 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=414
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 192ms
82ms XHR
application/json 69.173.144.142
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=43905842-1ec2-46a2-a432-994a554bcc7c&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8160774245696529
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 4e273fd46ad93529dc90e39c09aa9e0d2f33cac2cd73ba3ac0d6200e69cdd7bb

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:45 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=412
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 210ms
98ms XHR
application/json 69.173.144.142
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=43905842-1ec2-46a2-a432-994a554bcc7c&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.25112464038467586
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.142 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 0dc8eedc05c0c074b318d49d20a99915a0dc418187342d6f9ee081778bc51b0d

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:45 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=311
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
702 B 79ms
26ms XHR
application/json 72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_3.8.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: dfe167944349de2fd31c4ec28ed11ebdea7c21bb6d1555deb6fd87813ba09e98

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 18 Mar 2020 14:20:45 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 44

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 21 B
711 B 73ms
20ms XHR
application/json 185.33.223.80
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

aaaabde3f68c325033b37bb3ebff887e3b589b7137e717e96648a52221881429

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:47 GMT
X-Proxy-Origin: 85.159.237.65; 85.159.237.65; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.76:80
AN-X-Request-Uuid: 291894a3-892b-4c22-85dd-ae9fc3c46ba0
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 21
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 83ms
28ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 18 Mar 2020 14:20:45 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=46d20bbf0304f72;misc=1584541245763; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ 48 B
81 B 185ms
113ms XHR
application/json 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=46d20bbf0304f72;misc=1584541245763;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: dccf135d70257ff7c8c5d547e6f89e057c39e4cce8f0040264f986f4a2f1f8f5

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:45 GMT
server: nginx
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=47d7d3738aa679c;misc=1584541245763; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ 48 B
81 B 189ms
117ms XHR
application/json 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=47d7d3738aa679c;misc=1584541245763;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 6583635d9e469fd71fe79e0c9b20fc33d0184e68a68564eb6da6b058d60fa035

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:45 GMT
server: nginx
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=48ffcf9bb0d12e5;misc=1584541245763; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ 48 B
81 B 188ms
116ms XHR
application/json 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=48ffcf9bb0d12e5;misc=1584541245763;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 5f86b50febe2140f6e5d60798aeb3f9da6cd0e9012e6508203ea6494648c2973

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:45 GMT
server: nginx
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=490ee0a64df8b48;misc=1584541245763; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ 48 B
259 B 182ms
111ms XHR
application/json 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=490ee0a64df8b48;misc=1584541245763;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: dceefa4f83a42c4c354684cafa23683ba920a03f1b1bdad91973477420a9c5f4

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:45 GMT
server: nginx
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=50b3544684f607d;misc=1584541245763; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ 47 B
80 B 186ms
115ms XHR
application/json 152.199.21.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=50b3544684f607d;misc=1584541245763;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: d6ee16771e7ff43c300e2f8ffc93ac5dc3413055a96ea559d49d843516916ac7

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:45 GMT
server: nginx
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 47
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 173 B
570 B 166ms
111ms XHR
application/json 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=c49e5ce4-82b7-41ac-b320-cb784aae3f41%2Cc49e5ce4-82b7-41ac-b320-cb784aae3f41%2Ca3924f13-da67-41ba-980a-ddadb3ee75f8%2C43905842-1ec2-46a2-a432-994a554bcc7c%2C43905842-1ec2-46a2-a432-994a554bcc7c&nocache=1584541245765&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720&
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.179.0 /
Resource Hash: 1149ad543186f9342aa8723f3cd76be284854a600e1d2c862db6ca2b5d0ff2ad

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:45 GMT
content-encoding: gzip
server: OXGW/16.179.0
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
168 B 504ms
292ms XHR
application/json 178.128.135.80
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 178.128.135.80 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Wed, 18 Mar 2020 14:20:46 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com
content-length: 16
vary: Origin
content-type: application/json

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 25 B
988 B 385ms
317ms XHR
application/json 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%22372c5d443f4984f%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22382f4d426f0bd79%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%223967b0f2c941ea3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%224040a9e410a8e1a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%7D&ac=j&sd=1&
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 46c6ad10f098bfb55b3f43896fa0155181a286b1bc84414e8601ebf93428d3cd

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:46 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 45
Expires: Wed, 18 Mar 2020 14:20:46 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 21 B
712 B 71ms
24ms XHR
application/json 185.33.223.80
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

aaaabde3f68c325033b37bb3ebff887e3b589b7137e717e96648a52221881429

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:47 GMT
X-Proxy-Origin: 85.159.237.65; 85.159.237.65; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.164:80
AN-X-Request-Uuid: 7eab426d-8055-4a02-a9eb-f67a1207eb80
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 21
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:818::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 6131
date: Wed, 18 Mar 2020 12:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Wed, 18 Mar 2020 14:38:35 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=314778856&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ul=en-us&...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=1931637771.1584541246&jid=290009392&_gid=366344402.1584541246&gjid=1444024491&_v=j81&z=3423801
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=290009392&_v=j81&z=3423801
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=290009392&_v=j81&z=3423801&slf_rd=1&random=323734353

42 B
109 B

17ms
16ms

Image
image/gif

2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=290009392&_v=j81&z=3423801&slf_rd=1&random=323734353

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:46 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=290009392&_v=j81&z=3423801&slf_rd=1&random=323734353
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 98 KB
16 KB 473ms
473ms XHR
text/plain 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=576105367550663&correlator=1457052548111487&output=ldjh&impl=fifs&adsid=NT&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200318&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fconvincing-google-impersonation-opens-door-to-mitm-phishing%252F153745%252F%26urlquery%3Dgoogfc%26contentid%3D153745%26category%3Dweb-security%26contenttags%3Dfake-site%252Cgoogle%252Chomographic-characters%252Cimpersonation-tactics%252Cman-middle%252Cmitm%252Cphishing&cookie_enabled=1&bc=31&abxe=1&lmt=1584541246&dt=1584541246291&dlt=1584541244652&idt=1030&frm=20&biw=1600&bih=1200&oid=3&adxs=-9%2C-9%2C-9%2C-9&adys=-9%2C-9%2C-9%2C-9&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&dssz=21&icsg=172047&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1%7C0x-1%7C0x-1%7C0x-1&msz=0x-1%7C0x-1%7C0x-1%7C0x-1&ga_vid=1931637771.1584541246&ga_sid=1584541246&ga_hid=314778856&fws=2%2C2%2C2%2C2&ohw=0%2C0%2C0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

cafe /

Resource Hash

30b448bcf3866f20a816d889462a3e99484f49a184eba4d65002fa412c11836f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 18 Mar 2020 14:20:46 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 15658
x-xss-protection: 0
google-lineitem-id: 5193129080,-1,-1,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138293210130,-1,-1,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ 69 KB
25 KB 41ms
41ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

sffe /

Resource Hash

ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 25689
x-xss-protection: 0
expires: Wed, 18 Mar 2020 14:20:46 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 6ms
6ms Other
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 71 KB
24 KB 17ms
16ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d8313e2445f2a598fa325438da046d8335091dd9f45d6ed7d45996c12f2af678

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:46 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 24358
x-xss-protection: 0
last-modified: Wed, 18 Mar 2020 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 18 Mar 2020 14:20:46 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 11 KB
4 KB 812ms
120ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Last-Modified: Tue, 17 Mar 2020 13:49:16 GMT
Server: nginx
ETag: W/"5e70d55c-2b9f"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 25 Mar 2020 14:20:47 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 11 KB
4 KB 803ms
117ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Last-Modified: Tue, 17 Mar 2020 13:49:16 GMT
Server: nginx
ETag: W/"5e70d55c-2b9f"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 25 Mar 2020 14:20:47 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/qpy2aGtSgsYPZzCoYWjcaBCo/ 259 KB
93 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/qpy2aGtSgsYPZzCoYWjcaBCo/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f68b13965aca7240d1fa7aa4526a872138e15acf8dab4af6374309db830416e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 16 Mar 2020 16:27:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 16 Mar 2020 04:05:33 GMT
server: sffe
age: 165169
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 94711
x-xss-protection: 0
expires: Tue, 16 Mar 2021 16:27:57 GMT

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 909ms
219ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:47 GMT
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: "5e70d55b-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Wed, 25 Mar 2020 14:20:47 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 427ms
212ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
Origin: https://threatpost.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:46 GMT
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: "5e70d55b-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 809ms
124ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: W/"5e70d55b-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 25 Mar 2020 14:20:47 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 821ms
119ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: W/"5e70d55b-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 25 Mar 2020 14:20:47 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 434ms
206ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
Origin: https://threatpost.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:46 GMT
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: "5e70d55b-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 438ms
210ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
Origin: https://threatpost.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:46 GMT
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: "5e70d55b-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 438ms
210ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
Origin: https://threatpost.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:46 GMT
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: "5e70d55b-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 367ms
126ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
Origin: https://threatpost.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:46 GMT
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: "5e70d55b-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 8EC9 2 KB
1 KB 38ms
34ms Script
text/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1584541245&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: 5993b3bd67380a8234b3145cf6ee13e23797f14a34c5504d8c79ae72e36c7b49

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:46 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/javascript; charset=utf-8

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 674ms
118ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: W/"5e70d55b-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 25 Mar 2020 14:20:47 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 361ms
121ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1584452955
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:47 GMT
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: "5e70d55b-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Wed, 25 Mar 2020 14:20:47 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 85ms
40ms Font
font/woff2 2600:9000:206e:c000:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:206e:c000:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=e0eeaf73
Origin: https://threatpost.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 29 Sep 2019 03:41:07 GMT
via: 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront)
age: 14812779
x-cache: Hit from cloudfront
status: 200
content-length: 77160
pragma: public
last-modified: Tue, 24 Sep 2019 11:58:41 GMT
server: nginx
etag: "5d8a04f1-12d68"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
x-amz-cf-id: BW8REi772zOp7B6xshZi0o_abJbTi33YA5V2B7IomctYY3TT-eEnAw==
expires: Mon, 28 Sep 2020 03:41:07 GMT

GET
H/1.1 200
OK photo-newsletter.jpg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 83 KB
83 KB 1153ms
736ms Image
image/jpeg 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/photo-newsletter.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 940e0c3385928422aae38e1a74f1d84b462d8ce1a056c686fde505a0bf3162bb

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: public
Date: Wed, 18 Mar 2020 14:20:47 GMT
Last-Modified: Tue, 17 Mar 2020 13:49:15 GMT
Server: nginx
ETag: "5e70d55b-14c88"
Content-Type: image/jpeg
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 85128
Expires: Wed, 25 Mar 2020 14:20:47 GMT

GET
H2 200 / Show response
graph.facebook.com/ 105 B
549 B 65ms
41ms XHR
application/json 2a03:2880:f02d:e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

617448d837ea26846be612fbf4fe0a0bc6f798c2cde941cbaf5d6ce5b9f623f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
etag: "a4c013bb9a6e41c6755d83e964466345299f7962"
x-app-usage: {"call_count":0,"total_cputime":0,"total_time":0}
status: 200
x-fb-rev: 1001855949
alt-svc: h3-27=":443"; ma=3600
content-length: 105
pragma: no-cache
x-fb-debug: JO5ky6F3vkus3gL0SYGVZct19opsxXb9xeK7/JrwhxH6c2srv/PoXlSQrbVvEOWAc8fKURj6lQD/tiPh7KJ9vg==
x-fb-trace-id: Aii8jgFN7lt
date: Wed, 18 Mar 2020 14:20:47 GMT, Wed, 18 Mar 2020 14:20:47 GMT
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: ALo9SMOMT_wh_oiyUDoP-jB
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v2.12
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 186ms
175ms Script
text/html 2a05:f500:11:101::b93f:9001
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&format=jsonp&callback=jQuery112404024443103271793_1584541246422&_=1584541246423
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9001 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 4 KB
3 KB 239ms
163ms XHR
application/json 151.101.113.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

2eed704516967d8dc76ba196eeb291e766472d219951b26cec272ccdb41c998e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-allow-origin: *
x-cache: MISS
status: 200
vary: accept-encoding
content-length: 1675
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4036-HHN
x-moose: majestic
expires: -1
server: snooserv
x-timer: S1584541247.064959,VS0,VE127
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
via: 1.1 varnish
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
x-ua-compatible: IE=edge
accept-ranges: bytes
x-cache-hits: 0

GET
H/1.1 200
OK DetectGDPR2.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 8EC9 8 KB
3 KB 41ms
31ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR2.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1584541245&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 18 Mar 2020 14:20:46 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Jan 2020 18:48:12 GMT
Server: nginx
ETag: W/"5e2ddeec-211f"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK iab_consent_sdk.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 8EC9 19 KB
6 KB 90ms
43ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1584541245&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 18 Mar 2020 14:20:46 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Feb 2020 15:01:36 GMT
Server: nginx
ETag: W/"5e441350-4be0"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK DetectGDPR.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 8EC9 7 KB
3 KB 93ms
32ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1584541245&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 18 Mar 2020 14:20:46 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Jan 2020 11:58:13 GMT
Server: nginx
ETag: W/"5e2d7ed5-1d87"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK hls.0.12.4_1.min.js Show response
live.sekindo.com/content/video/hls/ Frame 8EC9 247 KB
85 KB 114ms
54ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1584541245&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 18 Mar 2020 14:20:46 GMT
Content-Encoding: gzip
Last-Modified: Mon, 06 Jan 2020 15:31:55 GMT
Server: nginx
ETag: W/"5e1352eb-3dcb9"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK prebidVid.2.44.3_2.min.js Show response
live.sekindo.com/content/prebid/ Frame 8EC9 267 KB
99 KB 115ms
52ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1584541245&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 4ee36d77a67f176a8468c3fafd5c230a2b8584293b81221b004619e700f84106

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 18 Mar 2020 14:20:46 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Jan 2020 06:21:36 GMT
Server: nginx
ETag: W/"5e3275f0-42b3f"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Thu, 18 Mar 2021 14:20:46 GMT

GET
H/1.1 200
OK liveVideo.php Show response
live.sekindo.com/live/ Frame 8EC9 352 KB
102 KB 134ms
71ms Script
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.38240051269531&geoLong=4.899499893188477&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1584541245&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: 1410917920bec60eefe6ef0983b2c8569a421f22ab0ad71c262e08113385730d

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 18 Mar 2020 14:20:46 GMT
Content-Encoding: gzip
Server: nginx
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 bl-5b1e2be-4189caf1.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame C866 77 KB
29 KB 70ms
69ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-5b1e2be-4189caf1.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 027ef26dead3109a62a194fdce626cf25a25f0eb950635749754e64c3acdbec4

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 17 Mar 2020 22:35:00 GMT
content-encoding: gzip
age: 56748
x-cache: Hit from cloudfront
status: 200
content-length: 29340
x-amz-meta-git_commit: 5b1e2be
last-modified: Tue, 17 Mar 2020 22:33:36 GMT
server: AmazonS3
etag: "585b143dc3b6a4e8adcd086c87a8d46d"
x-amz-version-id: CVn.OSFA89eiJRdRwRrH8m6Gii0i.ts_
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Dg25fGfvuWKPNs38igWih4iREpaSNGsrOZ0KFBAGVCzPn4aNFy7wfQ==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame C866 53 KB
15 KB 87ms
86ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92236ba12e109fff1e82ecabec1eda229af59c8374c54374a38a46dc01f53559

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 17 Feb 2020 06:48:42 GMT
content-encoding: gzip
age: 2619126
x-cache: Hit from cloudfront
status: 200
content-length: 14481
x-amz-meta-git_commit: 0d4dfcb
last-modified: Mon, 20 Jan 2020 21:00:33 GMT
server: AmazonS3
etag: "bf1a2a1d4ffb353d268fccfda0736572"
x-amz-version-id: PGsbLvp7r6PsyaqOJTHRTfOBKlgvnkI7
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: -qTdGlGp5EosJp1pnj_s3caH80gaHb9YnZqOHvePTrIy89ruAfi6yA==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C866 106 KB
38 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1aed87072b3ad1e8bede086e65fddd450a76628f35c7c6e3e14bac16ebd2d50d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 38653
x-xss-protection: 0
server: cafe
etag: 3682008271491073185
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 18 Mar 2020 14:20:47 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame C866 73 KB
28 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d7fe0f9bb86a16f6cdbca71a61b250ec61d838cb0cdb2bdd061ee0247783183

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584217929168357"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28078
x-xss-protection: 0
expires: Wed, 18 Mar 2020 14:20:47 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

909009056877bdbc198a45c7adec7d4b0615aa97d0a4d61ac493472dd0b4a97f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584217929168357"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 27546
x-xss-protection: 0
expires: Wed, 18 Mar 2020 14:20:47 GMT

GET
H2 200 bl-5b1e2be-4189caf1.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame DEF2 77 KB
29 KB 120ms
120ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-5b1e2be-4189caf1.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 027ef26dead3109a62a194fdce626cf25a25f0eb950635749754e64c3acdbec4

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 17 Mar 2020 22:35:00 GMT
content-encoding: gzip
age: 56748
x-cache: Hit from cloudfront
status: 200
content-length: 29340
x-amz-meta-git_commit: 5b1e2be
last-modified: Tue, 17 Mar 2020 22:33:36 GMT
server: AmazonS3
etag: "585b143dc3b6a4e8adcd086c87a8d46d"
x-amz-version-id: CVn.OSFA89eiJRdRwRrH8m6Gii0i.ts_
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: ULmgWyjJXj4cyNtWMeTnPA_KSFpfKFvrHhS-8EbqfwhtGEAMmhnw3w==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame DEF2 53 KB
15 KB 124ms
124ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92236ba12e109fff1e82ecabec1eda229af59c8374c54374a38a46dc01f53559

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 17 Feb 2020 06:48:42 GMT
content-encoding: gzip
age: 2619126
x-cache: Hit from cloudfront
status: 200
content-length: 14481
x-amz-meta-git_commit: 0d4dfcb
last-modified: Mon, 20 Jan 2020 21:00:33 GMT
server: AmazonS3
etag: "bf1a2a1d4ffb353d268fccfda0736572"
x-amz-version-id: PGsbLvp7r6PsyaqOJTHRTfOBKlgvnkI7
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: ZTL_QRliCNF-27R9l6lcYiI3LA5Xak-IoymnkE4eKMvN2zGYZ3ohGA==

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012003031842100/ 20 KB
7 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fa58b512176de3de4ee84324c9cb545d4ee79937b6a3518af6ed1a5e61378db

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1284
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7159
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "8d5b3500a9fa769d"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:23 GMT

GET
H2 200 anchor
www.google.com/recaptcha/api2/ Frame 5C44 0
0 50ms
49ms Document
text/html 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=qpy2aGtSgsYPZzCoYWjcaBCo&theme=standard&size=normal&cb=samflv56sbmt

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-xtyBZu5480pISIC/r68mVQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=qpy2aGtSgsYPZzCoYWjcaBCo&theme=standard&size=normal&cb=samflv56sbmt
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 18 Mar 2020 14:20:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-xtyBZu5480pISIC/r68mVQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10100
server: GSE
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 200 bl-5b1e2be-4189caf1.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame D9C4 77 KB
29 KB 66ms
66ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-5b1e2be-4189caf1.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 027ef26dead3109a62a194fdce626cf25a25f0eb950635749754e64c3acdbec4

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 17 Mar 2020 22:35:00 GMT
content-encoding: gzip
age: 56748
x-cache: Hit from cloudfront
status: 200
content-length: 29340
x-amz-meta-git_commit: 5b1e2be
last-modified: Tue, 17 Mar 2020 22:33:36 GMT
server: AmazonS3
etag: "585b143dc3b6a4e8adcd086c87a8d46d"
x-amz-version-id: CVn.OSFA89eiJRdRwRrH8m6Gii0i.ts_
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: rdpkDaCtU9Sm4H0uNOpgJoHH9wiR4SL2py-PJWACbsUHv_Zic0JZWQ==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame D9C4 53 KB
15 KB 103ms
102ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92236ba12e109fff1e82ecabec1eda229af59c8374c54374a38a46dc01f53559

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 17 Feb 2020 06:48:42 GMT
content-encoding: gzip
age: 2619126
x-cache: Hit from cloudfront
status: 200
content-length: 14481
x-amz-meta-git_commit: 0d4dfcb
last-modified: Mon, 20 Jan 2020 21:00:33 GMT
server: AmazonS3
etag: "bf1a2a1d4ffb353d268fccfda0736572"
x-amz-version-id: PGsbLvp7r6PsyaqOJTHRTfOBKlgvnkI7
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 7TIZJsJOe4dmhJkUyqlLEQacHgkZgylHZVoM-AGaxQKFVyVR048FKg==

GET
H2 200 bl-5b1e2be-4189caf1.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 6708 77 KB
29 KB 102ms
101ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-5b1e2be-4189caf1.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 027ef26dead3109a62a194fdce626cf25a25f0eb950635749754e64c3acdbec4

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 17 Mar 2020 22:35:00 GMT
content-encoding: gzip
age: 56748
x-cache: Hit from cloudfront
status: 200
content-length: 29340
x-amz-meta-git_commit: 5b1e2be
last-modified: Tue, 17 Mar 2020 22:33:36 GMT
server: AmazonS3
etag: "585b143dc3b6a4e8adcd086c87a8d46d"
x-amz-version-id: CVn.OSFA89eiJRdRwRrH8m6Gii0i.ts_
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: viPJLJ4GaMp2w2UFwdXJ3gAKwfIRXuC42jr7BKgdiGcSr2rq1upuDQ==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 6708 53 KB
15 KB 104ms
104ms Script
application/javascript 99.86.243.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-30.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92236ba12e109fff1e82ecabec1eda229af59c8374c54374a38a46dc01f53559

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 17 Feb 2020 06:48:42 GMT
content-encoding: gzip
age: 2619126
x-cache: Hit from cloudfront
status: 200
content-length: 14481
x-amz-meta-git_commit: 0d4dfcb
last-modified: Mon, 20 Jan 2020 21:00:33 GMT
server: AmazonS3
etag: "bf1a2a1d4ffb353d268fccfda0736572"
x-amz-version-id: PGsbLvp7r6PsyaqOJTHRTfOBKlgvnkI7
via: 1.1 d88e262cb7d055ed4daf7466b2147af1.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: gjH_WX5-xFvYv4t-Anxq8huLkEVNE7EoSXucsiDZD3zRu-sQ086Hxw==

GET
H/1.1 200
OK quant.js Show response
secure.quantserve.com/ 13 KB
6 KB 127ms
27ms Script
application/x-javascript 91.228.74.248
QUANTCAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.quantserve.com/quant.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.248 , United Kingdom, ASN27281 (QUANTCAST, US),

Reverse DNS

Software

QS /

Resource Hash

e8d7c60749c1d62942a8e0a6f901800bd14ff3094251373626cd99a8875c6391

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Last-Modified: Wed, 18-Mar-2020 14:20:47 GMT
Server: QS
Etag: M0-56c8c653
Vary: Accept-Encoding
Strict-Transport-Security: max-age=86400
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=604800
Connection: keep-alive
Content-Length: 5651
Expires: Wed, 25 Mar 2020 14:20:47 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 100ms
32ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
age: 21981
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19139-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1584541247.316628,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&aip=1&a=314778856&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ul=...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=1931637771.1584541246&jid=104956128&_gid=1178691383.1584541247&gjid=1741652058&_v=j81&z=634426486
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=104956128&_v=j81&z=634426486
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=104956128&_v=j81&z=634426486&slf_rd=1&random=1593185252

42 B
109 B

17ms
17ms

Image
image/gif

2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=104956128&_v=j81&z=634426486&slf_rd=1&random=1593185252

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:47 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1931637771.1584541246&jid=104956128&_v=j81&z=634426486&slf_rd=1&random=1593185252
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame C866 0
0 38ms
38ms Fetch
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstFpe-vZ8DD7tsgY8k8lsmjOlVik2dOHHrF-yKpkljIdm4oQWjY1GJx_zQQX9nJzchGOntx9348s2pFREDrunqVdm4yDwgHaQa7Nwzbvqo29JmxP52ZxDkUbzMZ4sw5XwW2ZyTV8nW0beTbo8gWLACB53nKIX5_iYEsvV9mYmcAx97ctUfe39c6a251mq9XIAXR7ttBAWGf83vZ-7aObqMxq2oBa1Yc5nzB-MC_mMyR0l0YJJWFLCjN-V0BK4-rnbtY25xA_9C8CQHKqVE3sDweam0U&sai=AMfl-YQhUGE9IvwbkeHQQFmQDTPN_ONgsfSrKR4zYNHLdD8QiCTffq5B6K5W8yRMMkxk8BQkzDRbcE7VUK7spAA6CKrTK730tC8NY7ANW40D&sig=Cg0ArKJSzIL64GxIFwijEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Wed, 18 Mar 2020 14:20:47 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 18 Mar 2020 14:20:47 GMT

GET
DATA 200
OK truncated
/ Frame C866 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b68cacefacedf9810bd8f97411ecaab17809bd5dc194ad01384c99e3e5746fbb

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 8EC9 87 KB
25 KB 204ms
98ms Script
application/javascript 99.86.234.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.38240051269531&geoLong=4.899499893188477&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.234.82 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-234-82.vie50.r.cloudfront.net
Software: Server /
Resource Hash: ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 17 Mar 2020 22:00:54 GMT
content-encoding: gzip
server: Server
age: 58792
etag: 1dcfbf3986ee8b9c3abbc67eb808ab43
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
x-amz-cf-id: R8Ls-VDccS-oWPR30G_sYYipvvNVf4ebzRx8FXpla_4Ci_9UuKWJuw==
via: 1.1 b48fca327a980187d93a198e7530195c.cloudfront.net (CloudFront)

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003031842100/ Frame DEF2 200 KB
55 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
Origin: https://threatpost.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1273
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 55795
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a96964b23e387b31"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:34 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003031842100/ Frame DEF2 200 KB
55 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1273
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 55795
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a96964b23e387b31"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:34 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012003031842100/v0/ Frame DEF2 16 KB
6 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4611
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5727
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:03:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "73b8fa958135ca02"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:03:56 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012003031842100/v0/ Frame DEF2 92 KB
28 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1287
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28323
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c55fc50a3cb141e2"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:20 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012003031842100/v0/ Frame DEF2 3 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4596
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1392
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:04:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d4f783c5765ebbae"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:04:11 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012003031842100/v0/ Frame DEF2 46 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4610
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14845
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:03:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "688737a9eb3f24de"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:03:57 GMT

GET
H2 200 17381515569659416361
tpc.googlesyndication.com/simgad/ Frame DEF2 42 KB
43 KB 9ms
7ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17381515569659416361?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmTvSKIAXZxherrjEokxu302lLJ-A

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e9467c15a95120c678114b68b7a342dd320cc28d77ac2cd1aa822e18e0ea3d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 10 Mar 2020 23:19:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 28 Aug 2019 15:57:30 GMT
server: sffe
age: 658864
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 43491
x-xss-protection: 0
expires: Wed, 10 Mar 2021 23:19:43 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame DEF2 2 KB
3 KB 8ms
6ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 17 Mar 2020 23:33:48 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 53219
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Wed, 18 Mar 2020 23:33:48 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame DEF2 295 B
431 B 8ms
6ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 17 Mar 2020 21:53:20 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 59247
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 18 Mar 2020 21:53:20 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame DEF2 0
0 43ms
42ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CA4nWPi5yXpvDFoevgAeNwb6ACPn0lpBc3LGzwMgKgZfc_P8WEAEg0YfSIGCRhICA_BegAfiDkP4DyAEC4AIAqAMByAMIqgSeAk_Qv2NqfGtabgKklOApbxzmjaipDdVcjvNn5-gFgnixEHITh8qow1-jnqypn7PokwyW8PBgKqFH-62REfrHoCkKHchv_IJ9tRnPSqrwGfIL2Bw421LoNNjH7dCMm8rjtQJ7kUUKiE3iOovhObuUE_0INxLx8ZkXPuzznWZghyA9XbOSup0Fn2XLybFm_Nez6QsS33IFsIMnoenD9Y-7El6ZiO3aN-c5GXCGq5j5gmZmcgx2eeVbwu6oHU4agx-6wqaCy63u1ZcZyG950AnQ72ger9N9OzPQPyyA-A17GQ8uZEUJ4fPIqFgvAx0LwraIhzzrttw-b01XeqCMpsndMcsV4I2yhIgrqKbp4mQlTMIyjh9e9qmyO0mxdPaOFU3ABOL3i-mfAuAEAZIFBAgEGAGSBQQIBRgEoAYCgAfw--8BqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQhOkH0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi03MjYzNTczNDQ2ODA0MDc4gAoDyAsB2BMC&sigh=JjD1iqs_R78&tpd=AGWhJmv5YmyfdXSLTQsKWtcHVQhvufDsLmYtYmMTbyX7YjNkgA
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s08-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

GET
DATA 200
OK truncated
/ Frame DEF2 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ab721173b48a6c10e5038cdb90476c5a73959f63ff36873f10140bb482efbad

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame C866 109 B
171 B 17ms
17ms Script
application/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame C866 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/ Frame C866 222 KB
83 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ce2129da582125d26c643bfa3ad19f6f2532b7c2a57da274139de2c79b48af7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 84992
x-xss-protection: 0
server: cafe
etag: 12744657352742557000
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Mar 2020 14:20:47 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200312/r20190131/ Frame 2C1A 0
0 6ms
5ms Document
text/html 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200312/r20190131/zrt_lookup.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200312/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmf-mMMmFRUfuJ7tVgVFVXfs1-t9waztyyryp20QloTyCsVMDbO4qNWcwIH
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Fri, 13 Mar 2020 07:04:29 GMT
expires: Fri, 27 Mar 2020 07:04:29 GMT
content-type: text/html; charset=UTF-8
etag: 10348540741379653356
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4494
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 458178
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame D9C4 43 B
482 B 94ms
26ms Other
image/gif 13.224.194.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=0&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vY29udmluY2luZy1nb29nbGUtaW1wZXJzb25hdGlvbi1vcGVucy1kb29yLXRvLW1pdG0tcGhpc2hpbmcvMTUzNzQ1LyIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTMwMHg2MDAtQVRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDU5NDU1OTc1MiIsImNhbXBhaWduSWQiOiIyNjU0MDI1MDM5IiwiY3JlYXRpdmVJZCI6IjEzODMwMTEzMDEzMyIsImxpbmVpdGVtSWQiOiI1Mjc1NjY4OTA3IiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjMwMCwiaGVpZ2h0IjoyNTAsInd2IjoiMS4wLjArMGQ0ZGZjYiIsImJ2IjoiMS4wLjArMGQ0ZGZjYiIsInRhZ01hcmt1cCI6IjxodG1sIGFtcDRhZHM9XCJcIiBjbGFzcz1cImktYW1waHRtbC1pbmFib3hcIiBpLWFtcGh0bWwtbGF5b3V0PVwiXCIgaS1hbXBodG1sLW5vLWJvaWxlcnBsYXRlPVwiXCI%2BPGhlYWQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMtdGhyZWF0cG9zdC9ibC01YjFlMmJlLTQxODljYWYxLmpzXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYi0wZDRkZmNiLmpzXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjxzY3JpcHQ%2Bd2luZG93W1wiNTc2NDkyMjVfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0gPSB3aW5kb3dbXCI1NzY0OTIyNV9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXSB8fCB7fTt3aW5kb3dbXCI1NzY0OTIyNV9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXS50YWdEZXRhaWxzID0gd2luZG93W1wiNTc2NDkyMjVfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0udGFnRGV0YWlscyB8fCB7XCJzaXRlSWRcIjpcIm1hdGgtYWlkcy10aHJlYXRwb3N0XCIsXCJ3dlwiOlwiMS4wLjArMGQ0ZGZjYlwiLFwidG9wRG9tYWluXCI6XCJodHRwczovL3RocmVhdHBvc3QuY29tL2NvbnZpbmNpbmctZ29vZ2xlLWltcGVyc29uYXRpb24tb3BlbnMtZG9vci10by1taXRtLXBoaXNoaW5nLzE1Mzc0NS9cIixcImN1cnJlbnRUYWdJZFwiOlwiYWRsdGFnX2s3eGV5MzZzX0JIWmk2bkQ3UVJVXCIsXCJhdVwiOlwiLzIxNzA3MTI0MzM2L1RocmVhdFBvc3QtMzAweDYwMC1BVEZfMFwiLFwiYWRTZXJ2ZXJEZXRhaWxzXCI6e1wiYWR2ZXJ0aXNlcklkXCI6XCI0NTk0NTU5NzUyXCIsXCJjYW1wYWlnbklkXCI6XCIyNjU0MDI1MDM5XCIsXCJjcmVhdGl2ZUlkXCI6XCIxMzgzMDExMzAxMzNcIixcImxpbmVpdGVtSWRcIjpcIjUyNzU2Njg5MDdcIixcImFkU2VydmVyXCI6XCJkZnBcIn0sXCJ3XCI6MzAwLFwiaFwiOjI1MH07d2luZG93LmJsb2NrZXIgJiYgYmxvY2tlcihcIjU3NjQ5MjI1X21hdGgtYWlkcy10aHJlYXRwb3N0XCIsIFwiPCEtLUFETF9XUkFQUEVELS0%2BXCIsIGZhbHNlLCB3aW5kb3csIHt9KTs8L3NjcmlwdD48L2hlYWQ%2BPC9odG1sPjwhLS0gSUZSQU1FIElOTkVSIENPTlRFTlQgLS0%2BIiwibWV0YSI6eyJwbFJhdGlvIjowLjAxfX0%3D&i=1-1&t=adltag_k7xey36s_BHZi6nD7QRU&r=d98ce6c518c9f1e82dab97ce832adec&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-45.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Mar 2020 06:18:38 GMT
via: 1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
age: 28930
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
etag: "6b7395c9201aa64331475fddd24d987c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: FihM9oHCM7qDnHASwKR4BXvu9N7nE3b9QvsbCC9rZrJBHTkniJflsQ==

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003031842100/ Frame D9C4 200 KB
55 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
Origin: https://threatpost.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1273
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 55795
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a96964b23e387b31"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:34 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003031842100/ Frame D9C4 200 KB
55 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1273
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 55795
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a96964b23e387b31"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:34 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012003031842100/v0/ Frame D9C4 16 KB
6 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4611
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5727
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:03:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "73b8fa958135ca02"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:03:56 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012003031842100/v0/ Frame D9C4 92 KB
28 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1287
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28323
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c55fc50a3cb141e2"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:20 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012003031842100/v0/ Frame D9C4 3 KB
1 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4596
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1392
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:04:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d4f783c5765ebbae"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:04:11 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012003031842100/v0/ Frame D9C4 46 KB
15 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 4610
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14845
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:03:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "688737a9eb3f24de"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:03:57 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D9C4 2 KB
3 KB 7ms
6ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 17 Mar 2020 23:33:48 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 53219
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Wed, 18 Mar 2020 23:33:48 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D9C4 295 B
362 B 6ms
6ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 17 Mar 2020 21:53:20 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 59247
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 18 Mar 2020 21:53:20 GMT

GET
H2 200 18214743382600115427
tpc.googlesyndication.com/simgad/ Frame D9C4 63 KB
63 KB 9ms
8ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18214743382600115427?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmr06emOjTCUIYkFA8dlbjwatJOPw

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e90430e076a6c0aa15cff9e63081ae3b5503c048cf0f4f45fdcaf9f5e2763251

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 05 Mar 2020 00:46:18 GMT
x-content-type-options: nosniff
last-modified: Wed, 28 Aug 2019 15:57:30 GMT
server: sffe
age: 1172069
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 64506
x-xss-protection: 0
expires: Fri, 05 Mar 2021 00:46:18 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D9C4 0
0 42ms
40ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Ca4SKPi5yXpzDFoevgAeNwb6ACPn0lpBcvLyiq9wJgZfc_P8WEAEg0YfSIGCRhICA_BegAfiDkP4DyAEC4AIAqAMByAMIqgSdAk_Qk1m2fZT31VBJxR1ieJBc5e5YzJ-3G3ef2If8eZ2ZFxexGRKISgfDeP-qMwlYTXq7cGoGGENLamO7feXmjt0AcVYOzTpgACsffvLmqh1TNeHLWMrTbue4ok47g49bTcqwHVrgPOTbDG0glR-n8YFjPILhhDV4EfE45MsurkyuNbv_RuhB4oEkSAzeh1vEXpArSMm01mSrQwyhj7CUXrwqCo6QPmHJ2AWF30YHpl7C6Zz8x-uCJidfMxuN0Z_UYY4-Xu70I8q8N3qYG30_YeLmhSZnobcY5vRZK8W1X9u1t6tAl7JJ45O25mlBgLM4WN9j8EJyZ1a63_KceaUjsjh_RliUBZvsrXNIlP9vKj0iikAkKoylYRjglg7hFcAE4veL6Z8C4AQBkgUECAQYAZIFBAgFGASgBgKAB_D77wGoB47OG6gH1ckbqAeT2BuoB5_bG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBD-pxzSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwHYEwI&sigh=uqjg63PcZlA&tpd=AGWhJmu0uJgOUx6AOUxAlPEuGLQb1m5hpA-bZSpmp5RmOlzJXA
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s08-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

GET
DATA 200
OK truncated
/ Frame D9C4 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08c47f7e7337123387bc5a59a05749e09abc65f767c49ffdd4aed0181636a3a1

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003031842100/ Frame 6708 200 KB
55 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1273
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 55795
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a96964b23e387b31"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:34 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003031842100/ Frame 6708 200 KB
55 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1273
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 55795
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a96964b23e387b31"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:34 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012003031842100/v0/ Frame 6708 92 KB
28 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 1287
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28323
x-xss-protection: 0
server: sffe
date: Wed, 18 Mar 2020 13:59:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c55fc50a3cb141e2"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:59:20 GMT

GET
H2 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 6708 330 B
451 B 10ms
8ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 06 Mar 2020 09:43:39 GMT
x-content-type-options: nosniff
age: 1053428
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 06 Mar 2021 09:43:39 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6708 0
57 B 37ms
35ms Image
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu5RdMCEZGEHmqACOTT6lCM516bSRti3A0sVMeCIeP-ZpXUnCIuODVSFU3Vt023s_21VOAOag4jOQkaGLSIFaNkGUNjffWpnJOBsyYBwRBBYg89eo6a5bLTGElBtBwfwEMmaCutKWvg3RXIXst2rmPynGkgW2pXwD7NuwdI4qEjlx1dYb2Xaa2_KbkG5JhI_QUhf295nKyTk1fsUOak9HaOWo_nujzn2MD8NXjO1u_z6YtlYc37JMd7rR6zE5r7docwzvA8ws5ShESHe4jUzg&sai=AMfl-YQNv1TaHz92momEALz0VsJh_rZ2m0S8futzYMzTRMclYIlXRx-hzjQrZYEJq0GyqzgE2gczGUcz6G9l1tL5ndYoM2mUjxuFID_Ghe1q&sig=Cg0ArKJSzLH-yyZY1zY8EAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6708 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4dd9e0a5c2c130a37cf39303f73e8ed58a62829066574bb4af16fdbccec5678a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ Frame 1750 2 KB
684 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.38240051269531&geoLong=4.899499893188477&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 18 Mar 2020 14:20:47 GMT
server: ESF
date: Wed, 18 Mar 2020 14:20:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 18 Mar 2020 14:20:47 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 767E 2 KB
638 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 18 Mar 2020 14:20:47 GMT
server: ESF
date: Wed, 18 Mar 2020 14:20:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 18 Mar 2020 14:20:47 GMT

GET
H/1.1 200
OK placeHolder.png
live.sekindo.com/content/video/splayer/assets/ 23 KB
24 KB 20ms
17ms Image
image/png 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/content/video/splayer/assets/placeHolder.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:46 GMT
Last-Modified: Sun, 11 Jun 2017 08:03:58 GMT
Server: nginx
ETag: "593cf96e-5dbf"
Content-Type: image/png
Cache-Control: no-cache, private
Accept-Ranges: bytes
Content-Length: 23999
Expires: Wed, 18 Mar 2020 14:20:45 GMT

GET
H/1.1 200
OK vid5e7127991052d395665459.jpg
video.sekindo.com/uploads/cn1/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame 767E 9 KB
9 KB 109ms
31ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn1/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.jpg?cbuster=1584474013

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

3a2372e21f48a6f47108ad1f4639fb29431789cbaa644f47ae64c52ab2abec8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Tue, 17 Mar 2020 19:41:26 GMT
Server: Tengine
ETag: "5e7127e6-232f"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 9007
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e67a175e6f80193428256.jpg
video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame 767E 14 KB
15 KB 129ms
51ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5e67a175e6f80193428256.jpg?cbuster=1583849852

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

2ca96ead8fc47853db84cc77e185134d554f75a5fcbe59323e65fb9c776c1369

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Tue, 10 Mar 2020 14:18:11 GMT
Server: Tengine
ETag: "5e67a1a3-390b"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 14603
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e71c7543988d790150959.jpg
video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/ Frame 767E 21 KB
21 KB 124ms
47ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/vid5e71c7543988d790150959.jpg?cbuster=1584514901

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

03d95929b0703d04e46b6957a7d8794f27214673987b91c56a020dabe35e8a10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Wed, 18 Mar 2020 07:02:25 GMT
Server: Tengine
ETag: "5e71c781-52c4"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 21188
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e700bc4c80c0677299569.jpg
video.sekindo.com/uploads/cn2/video/users/converted/24485/video1523972806/ Frame 767E 15 KB
16 KB 129ms
48ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn2/video/users/converted/24485/video1523972806/vid5e700bc4c80c0677299569.jpg?cbuster=1584401350

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

ed8348ad255986ca08204cc5d4bd3a58e8173a0588b47d89895f77af07c9adaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Mon, 16 Mar 2020 23:35:20 GMT
Server: Tengine
ETag: "5e700d38-3ce5"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 15589
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e67e4d368c16868935178.jpg
video.sekindo.com/uploads/cn7/video/users/converted/24485/video1523972806/ Frame 767E 13 KB
13 KB 121ms
39ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn7/video/users/converted/24485/video1523972806/vid5e67e4d368c16868935178.jpg?cbuster=1583867092

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

f026ff57bddc5af4162c23b3c33ffee2def39216fc770159d2263021c60de0a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Tue, 10 Mar 2020 19:05:19 GMT
Server: Tengine
ETag: "5e67e4ef-329c"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 12956
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e71c75337a14771087703.jpg
video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/ Frame 767E 26 KB
27 KB 72ms
68ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/vid5e71c75337a14771087703.jpg?cbuster=1584514900

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

8fa3dc8d99f9c768dab8377000d306d6c3795c024993ab8a7f42e29f5f236ddd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Wed, 18 Mar 2020 07:02:09 GMT
Server: Tengine
ETag: "5e71c771-6929"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 26921
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e700bc79897c647013074.jpg
video.sekindo.com/uploads/cn2/video/users/converted/24485/video1523972806/ Frame 767E 19 KB
19 KB 70ms
69ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn2/video/users/converted/24485/video1523972806/vid5e700bc79897c647013074.jpg?cbuster=1584401356

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

0a1b5a439d79947cc5db6aa52347627ed146b7710af2ce042804a8a259ea966c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Mon, 16 Mar 2020 23:35:51 GMT
Server: Tengine
ETag: "5e700d57-4a74"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 19060
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e6fbdb6cdf45970267049.jpg
video.sekindo.com/uploads/cn2/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame 767E 17 KB
17 KB 68ms
67ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn2/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5e6fbdb6cdf45970267049.jpg?cbuster=1584381377

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

0b4b6edbb9dfa923bde86147c294879a60493c25e315b728abd03ebb7967add1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Mon, 16 Mar 2020 17:57:18 GMT
Server: Tengine
ETag: "5e6fbdfe-4231"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 16945
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e6fbdab63bec384417917.jpg
video.sekindo.com/uploads/cn2/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame 767E 15 KB
16 KB 83ms
83ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn2/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5e6fbdab63bec384417917.jpg?cbuster=1584381361

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

a70ceb6ff4a5c3959d630f11458a34f204bca08683a0963fd7db7b5897790977

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Mon, 16 Mar 2020 17:57:13 GMT
Server: Tengine
ETag: "5e6fbdf9-3c81"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 15489
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e67a17e8b3c1100247330.jpg
video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame 767E 13 KB
14 KB 69ms
68ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5e67a17e8b3c1100247330.jpg?cbuster=1583849868

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

e2b81f17863fe79aefc02b3aa36acbc5a4d95f0c61d447eebbbc39a0eb93ee6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Tue, 10 Mar 2020 14:18:14 GMT
Server: Tengine
ETag: "5e67a1a6-3577"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 13687
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5e7127991052d395665459.jpg
video.sekindo.com/uploads/cn1/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame 1750 9 KB
9 KB 113ms
38ms Image
image/jpeg 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn1/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.jpg?cbuster=1584474013

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),

Reverse DNS

Software

Tengine /

Resource Hash

3a2372e21f48a6f47108ad1f4639fb29431789cbaa644f47ae64c52ab2abec8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://amli.sekindo.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Tue, 17 Mar 2020 19:41:26 GMT
Server: Tengine
ETag: "5e7127e6-232f"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 9007
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ Frame 1750 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 1750 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bframe
www.google.com/recaptcha/api2/ Frame 4844 0
0 20ms
20ms Document
text/html 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=qpy2aGtSgsYPZzCoYWjcaBCo&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=y9t6y9gn8mg7

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lO+cjGGTCb8hdsY1e9fgHQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=qpy2aGtSgsYPZzCoYWjcaBCo&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=y9t6y9gn8mg7
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 18 Mar 2020 14:20:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-lO+cjGGTCb8hdsY1e9fgHQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1180
server: GSE
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
357 B 494ms
451ms Script
application/x-javascript 2600:9000:206e:4400:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:206e:4400:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:17:14 GMT
via: 1.1 a243c19b86829b9271d382d92416109c.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 214
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: ZVntvkF_H11RZbDGJyMAde4mg5IlCT1ERZir1j_DwvzwQwM2JdL4Zg==

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 8EC9 65 KB
3 KB 116ms
114ms XHR
application/json 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn1%2Fvideo%2Fusers%2Fconverted%2F28530%2Fvideo_5d5baf9fe4c32389620327%2Fvid5e7127991052d395665459.mp4&vid_content_id=705242&vid_content_desc=Apple+places+ban+on+coronavirus+apps+&vid_content_title=Apple+places+ban+on+coronavirus+apps+&vid_content_duration=46&debugInformation=&x=400&y=225&fpl=2&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=52.38240051269531&geoLong=4.899499893188477&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&cbuster=1584541247714&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.38240051269531&geoLong=4.899499893188477&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: 3663dead35753fccb3080139938612e9768e6b6cb4bf2176e3beaa42c956d6bc

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 2875

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 8EC9 65 KB
3 KB 215ms
213ms XHR
application/json 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn1%2Fvideo%2Fusers%2Fconverted%2F28530%2Fvideo_5d5baf9fe4c32389620327%2Fvid5e7127991052d395665459.mp4&vid_content_id=705242&vid_content_desc=Apple+places+ban+on+coronavirus+apps+&vid_content_title=Apple+places+ban+on+coronavirus+apps+&vid_content_duration=46&debugInformation=&x=320&y=180&fpl=2&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=52.38240051269531&geoLong=4.899499893188477&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&cbuster=1584541247714&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.38240051269531&geoLong=4.899499893188477&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: c186afbbc35854b1c3bf5949da665292c070571b3ba15aaf2f54b5faa4a3f6a0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 2887

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 8EC9 23 KB
2 KB 86ms
85ms XHR
application/json 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn1%2Fvideo%2Fusers%2Fconverted%2F28530%2Fvideo_5d5baf9fe4c32389620327%2Fvid5e7127991052d395665459.mp4&vid_content_id=705242&vid_content_desc=Apple+places+ban+on+coronavirus+apps+&vid_content_title=Apple+places+ban+on+coronavirus+apps+&vid_content_duration=46&debugInformation=&x=400&y=225&fpl=2&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=52.38240051269531&geoLong=4.899499893188477&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&cbuster=1584541247715&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.38240051269531&geoLong=4.899499893188477&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: c749fac7a9b0c903abb651292d4c1eac95411fd75ad08c89e6c4ad9e3680959b

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 1757

GET
H2 200 adsct
t.co/i/ 43 B
448 B 219ms
151ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Wed, 18 Mar 2020 14:20:47 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 4bb76956f5acf96427025a598dbaec78
x-transaction: 0018c5ea00af6446
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 9F2A 0
0 362ms
361ms Document
text/html 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=90&slotname=7759284332&adk=4262696766&adf=3173046730&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584541247459&bpp=27&bdt=472&fdt=312&idt=312&shv=r20200312&cbv=r20190131&ptt=9&saldr=aa&correlator=4899283501714&frm=23&ife=4&pv=2&ga_vid=1931637771.1584541246&ga_sid=1584541248&ga_hid=451880512&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=10&biw=1585&bih=1200&isw=728&ish=90&ifk=1941443103&scr_x=0&scr_y=0&oid=3&pvsid=447436609624923&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.uerhtjtpyps0&fsb=1&dtd=341

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-7500593236707325&output=html&h=90&slotname=7759284332&adk=4262696766&adf=3173046730&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1584541247459&bpp=27&bdt=472&fdt=312&idt=312&shv=r20200312&cbv=r20190131&ptt=9&saldr=aa&correlator=4899283501714&frm=23&ife=4&pv=2&ga_vid=1931637771.1584541246&ga_sid=1584541248&ga_hid=451880512&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=10&biw=1585&bih=1200&isw=728&ish=90&ifk=1941443103&scr_x=0&scr_y=0&oid=3&pvsid=447436609624923&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&ifi=1&uci=1.uerhtjtpyps0&fsb=1&dtd=341
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmf-mMMmFRUfuJ7tVgVFVXfs1-t9waztyyryp20QloTyCsVMDbO4qNWcwIH
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 18 Mar 2020 14:20:48 GMT
server: cafe
content-length: 26993
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame C866 73 KB
27 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

909009056877bdbc198a45c7adec7d4b0615aa97d0a4d61ac493472dd0b4a97f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1584217929168357"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 27546
x-xss-protection: 0
expires: Wed, 18 Mar 2020 14:20:47 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame DEF2
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

38ms
38ms

Image
text/html

2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date: Wed, 18 Mar 2020 14:20:47 GMT
x-content-type-options: nosniff
server: safe
location: https://googleads.g.doubleclick.net/pagead/drt/si
content-type: text/html; charset=UTF-8
status: 302
cache-control: private
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 8EC9 6 KB
3 KB 147ms
44ms XHR
application/javascript 99.86.234.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.234.82 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-234-82.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 18 Mar 2020 09:22:46 GMT
content-encoding: gzip
vary: Origin
age: 17882
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 05 Mar 2020 08:28:46 GMT
server: AmazonS3
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 51f7e70303bbb917096a71171b20326f.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: PGhFIb_LB_FqUKhNlq5sEb1BCxb5Am2utpy52U6TIDR_y2TgkhhA7w==

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 8EC9 0
59 B 35ms
35ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 18 Mar 2020 14:20:47 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 8EC9 0
215 B 140ms
42ms XHR
application/json 18.194.129.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.129.81 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-129-81.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Server: adaptv/1.0
Connection: keep-alive
Content-Length: 0
Content-Type: application/json

GET
H2 200 17381515569659416361
tpc.googlesyndication.com/simgad/ Frame DEF2 42 KB
43 KB 7ms
6ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17381515569659416361?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmTvSKIAXZxherrjEokxu302lLJ-A

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e9467c15a95120c678114b68b7a342dd320cc28d77ac2cd1aa822e18e0ea3d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 10 Mar 2020 23:19:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 28 Aug 2019 15:57:30 GMT
server: sffe
age: 658864
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 43491
x-xss-protection: 0
expires: Wed, 10 Mar 2021 23:19:43 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame DEF2 2 KB
3 KB 6ms
6ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 17 Mar 2020 23:33:48 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 53219
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Wed, 18 Mar 2020 23:33:48 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame DEF2 295 B
362 B 6ms
6ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 17 Mar 2020 21:53:20 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 59247
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 18 Mar 2020 21:53:20 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 8EC9 23 KB
2 KB 117ms
116ms XHR
application/json 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn1%2Fvideo%2Fusers%2Fconverted%2F28530%2Fvideo_5d5baf9fe4c32389620327%2Fvid5e7127991052d395665459.mp4&vid_content_id=705242&vid_content_desc=Apple+places+ban+on+coronavirus+apps+&vid_content_title=Apple+places+ban+on+coronavirus+apps+&vid_content_duration=46&debugInformation=&x=320&y=180&fpl=2&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=52.38240051269531&geoLong=4.899499893188477&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&cbuster=1584541247944&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D31385F31367D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e722e3e7eddc&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.38240051269531&geoLong=4.899499893188477&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: 7889b14367dfcfae75df125c6189cdf0a6db2c163958ffcb5300de3badb6ebb0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:47 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 1761

GET
H/1.1 200
OK chunklist_640.m3u8 Show response
video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/ Frame 8EC9 361 B
761 B 121ms
32ms XHR
application/vnd.apple.mpegurl 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/chunklist_640.m3u8
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 35fd5522615ac33058d953b0ae613133140ea57d678729abbb1aae09f5e7757f

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Tue, 17 Mar 2020 19:43:01 GMT
Server: Tengine
ETag: "5e712845-169"
Content-Type: application/vnd.apple.mpegurl
Access-Control-Allow-Origin: *
Expires: Wed, 25 Mar 2020 14:20:12 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 361
X-Proxy-Cache: HIT

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame D9C4 43 B
481 B 30ms
29ms Other
image/gif 13.224.194.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vY29udmluY2luZy1nb29nbGUtaW1wZXJzb25hdGlvbi1vcGVucy1kb29yLXRvLW1pdG0tcGhpc2hpbmcvMTUzNzQ1LyIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTMwMHg2MDAtQVRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDU5NDU1OTc1MiIsImNhbXBhaWduSWQiOiIyNjU0MDI1MDM5IiwiY3JlYXRpdmVJZCI6IjEzODMwMTEzMDEzMyIsImxpbmVpdGVtSWQiOiI1Mjc1NjY4OTA3IiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjMwMCwiaGVpZ2h0IjoyNTAsInd2IjoiMS4wLjArMGQ0ZGZjYiIsImJ2IjoiMS4wLjArMGQ0ZGZjYiIsInRhZ01hcmt1cCI6IjxodG1sIGFtcDRhZHM9XCJcIiBjbGFzcz1cImktYW1waHRtbC1pbmFib3ggaS1hbXBodG1sLXNpbmdsZWRvYyBpLWFtcGh0bWwtc3RhbmRhbG9uZSBpLWFtcGh0bWwtaWZyYW1lZFwiIGktYW1waHRtbC1sYXlvdXQ9XCJcIiBpLWFtcGh0bWwtbm8tYm9pbGVycGxhdGU9XCJcIiBhbXAtdmVyc2lvbj1cIjIwMDMwMzE4NDIxMDBcIj48aGVhZD48c2NyaXB0IHNyYz1cImh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2JsLTViMWUyYmUtNDE4OWNhZjEuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMtdGhyZWF0cG9zdC9iLTBkNGRmY2IuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdD53aW5kb3dbXCI1NzY0OTIyNV9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXSA9IHdpbmRvd1tcIjU3NjQ5MjI1X21hdGgtYWlkcy10aHJlYXRwb3N0XCJdIHx8IHt9O3dpbmRvd1tcIjU3NjQ5MjI1X21hdGgtYWlkcy10aHJlYXRwb3N0XCJdLnRhZ0RldGFpbHMgPSB3aW5kb3dbXCI1NzY0OTIyNV9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXS50YWdEZXRhaWxzIHx8IHtcInNpdGVJZFwiOlwibWF0aC1haWRzLXRocmVhdHBvc3RcIixcInd2XCI6XCIxLjAuMCswZDRkZmNiXCIsXCJ0b3BEb21haW5cIjpcImh0dHBzOi8vdGhyZWF0cG9zdC5jb20vY29udmluY2luZy1nb29nbGUtaW1wZXJzb25hdGlvbi1vcGVucy1kb29yLXRvLW1pdG0tcGhpc2hpbmcvMTUzNzQ1L1wiLFwiY3VycmVudFRhZ0lkXCI6XCJhZGx0YWdfazd4ZXkzNnNfQkhaaTZuRDdRUlVcIixcImF1XCI6XCIvMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC0zMDB4NjAwLUFURl8wXCIsXCJhZFNlcnZlckRldGFpbHNcIjp7XCJhZHZlcnRpc2VySWRcIjpcIjQ1OTQ1NTk3NTJcIixcImNhbXBhaWduSWRcIjpcIjI2NTQwMjUwMzlcIixcImNyZWF0aXZlSWRcIjpcIjEzODMwMTEzMDEzM1wiLFwibGluZWl0ZW1JZFwiOlwiNTI3NTY2ODkwN1wiLFwiYWRTZXJ2ZXJcIjpcImRmcFwifSxcIndcIjozMDAsXCJoXCI6MjUwfTt3aW5kb3cuYmxvY2tlciAmJiBibG9ja2VyKFwiNTc2NDkyMjVfbWF0aC1haWRzLXRocmVhdHBvc3RcIiwgXCI8IS0tQURMX1dSQVBQRUQtLT5cIiwgZmFsc2UsIHdpbmRvdywge30pOzwvc2NyaXB0PjxtZXRhIG5hbWU9XCJyZWZlcnJlclwiIGNvbnRlbnQ9XCJvcmlnaW5cIj48bWV0YSBodHRwLWVxdWl2PVwiQ29udGVudC1TZWN1cml0eS1Qb2xpY3lcIiBjb250ZW50PVwic2NyaXB0LXNyYyBodHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy87b2JqZWN0LXNyYyAnbm9uZSc7Y2hpbGQtc3JjIGJsb2I6O2ZyYW1lLXNyYyAnbm9uZSdcIj48bWV0YSBjaGFyc2V0PVwidXRmLThcIj48c3R5bGUgYW1wLXJ1bnRpbWU9XCJcIiBpLWFtcGh0bWwtdmVyc2lvbj1cIjAxMjAwMzAzMTg0MjEwMFwiPltoaWRkZW5de2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50e2Rpc3BsYXk6aW5saW5lLWJsb2NrfS5pLWFtcGh0bWwtYmx1cnJ5LXBsYWNlaG9sZGVye3RyYW5zaXRpb246b3BhY2l0eSAwLjNzIGN1YmljLWJlemllcigwLjAsMC4wLDAuMiwxKSFpbXBvcnRhbnR9W2xheW91dD1ub2Rpc3BsYXldOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpe2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1sYXlvdXQtZml4ZWQsW2xheW91dD1maXhlZF1bd2lkdGhdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWZpeGVkKXtkaXNwbGF5OmlubGluZS1ibG9jaztwb3NpdGlvbjpyZWxhdGl2ZX0uaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlLFtsYXlvdXQ9cmVzcG9uc2l2ZV1bd2lkdGhdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUpLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KC5pLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUpe2Rpc3BsYXk6YmxvY2s7cG9zaXRpb246cmVsYXRpdmV9LmktYW1waHRtbC1sYXlvdXQtaW50cmluc2lje2Rpc3BsYXk6aW5saW5lLWJsb2NrO3Bvc2l0aW9uOnJlbGF0aXZlO21heC13aWR0aDoxMDAlfS5pLWFtcGh0bWwtaW50cmluc2ljLXNpemVye21heC13aWR0aDoxMDAlO2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fS5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lciwuaS1hbXBodG1sLWxheW91dC1maXhlZC1oZWlnaHQsW2xheW91dD1jb250YWluZXJdLFtsYXlvdXQ9Zml4ZWQtaGVpZ2h0XVtoZWlnaHRde2Rpc3BsYXk6YmxvY2s7cG9zaXRpb246cmVsYXRpdmV9LmktYW1waHRtbC1sYXlvdXQtZmlsbCxbbGF5b3V0PWZpbGxdOm5vdCguaS1hbXBodG1sLWxheW91dC1maWxsKXtkaXNwbGF5OmJsb2NrO292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7cG9zaXRpb246YWJzb2x1dGU7dG9wOjA7bGVmdDowO2JvdHRvbTowO3JpZ2h0OjB9LmktYW1waHRtbC1sYXlvdXQtZmxleC1pdGVtLFtsYXlvdXQ9ZmxleC1pdGVtXTpub3QoLmktYW1waHRtbC1sYXlvdXQtZmxleC1pdGVtKXtkaXNwbGF5OmJsb2NrO3Bvc2l0aW9uOnJlbGF0aXZlOy1tcy1mbGV4OjEgMSBhdXRvO2ZsZXg6MSAxIGF1dG99LmktYW1waHRtbC1sYXlvdXQtZmx1aWR7cG9zaXRpb246cmVsYXRpdmV9LmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVke292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnR9LmktYW1waHRtbC1sYXlvdXQtYXdhaXRpbmctc2l6ZXtwb3NpdGlvbjphYnNvbHV0ZSFpbXBvcnRhbnQ7dG9wOmF1dG8haW1wb3J0YW50O2JvdHRvbTphdXRvIWltcG9ydGFudH1pLWFtcGh0bWwtc2l6ZXJ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9LmktYW1waHRtbC1ibHVycnktcGxhY2Vob2xkZXIsLmktYW1waHRtbC1maWxsLWNvbnRlbnR7ZGlzcGxheTpibG9jaztoZWlnaHQ6MDttYXgtaGVpZ2h0OjEwMCU7bWF4LXdpZHRoOjEwMCU7bWluLWhlaWdodDoxMDAlO21pbi13aWR0aDoxMDAlO3dpZHRoOjA7bWFyZ2luOmF1dG99LmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIC5pLWFtcGh0bWwtZmlsbC1jb250ZW50e3Bvc2l0aW9uOmFic29sdXRlO3RvcDowO2xlZnQ6MDtib3R0b206MDtyaWdodDowfS5pLWFtcGh0bWwtbGF5b3V0LWludHJpbnNpYyAuaS1hbXBodG1sLXNpemVye21heC13aWR0aDoxMDAlfS5pLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudCwuaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7cGFkZGluZzowIWltcG9ydGFudDtib3JkZXI6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVye3Bvc2l0aW9uOmZpeGVkIWltcG9ydGFudDt0b3A6MHB4IWltcG9ydGFudDtsZWZ0OjBweCFpbXBvcnRhbnQ7d2lkdGg6NHB4IWltcG9ydGFudDtoZWlnaHQ6NHB4IWltcG9ydGFudDtvcGFjaXR5OjAhaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7bWFyZ2luOjAhaW1wb3J0YW50O2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50O3Zpc2liaWxpdHk6dmlzaWJsZSFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcntsZWZ0OjhweCFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDoxMnB4IWltcG9ydGFudH0uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ%2BLmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDoxNnB4IWltcG9ydGFudH0uaS1hbXBodG1sLXVucmVzb2x2ZWR7cG9zaXRpb246cmVsYXRpdmU7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudH0uaS1hbXBodG1sLXNlbGVjdC1kaXNhYmxlZHstd2Via2l0LXVzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50Oy1tb3otdXNlci1zZWxlY3Q6bm9uZSFpbXBvcnRhbnQ7LW1zLXVzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50O3VzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtbm90YnVpbHQsW2xheW91dF06bm90KC5pLWFtcGh0bWwtZWxlbWVudCl7cG9zaXRpb246cmVsYXRpdmU7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDtjb2xvcjp0cmFuc3BhcmVudCFpbXBvcnRhbnR9LmktYW1waHRtbC1ub3RidWlsdDpub3QoLmktYW1waHRtbC1sYXlvdXQtY29udGFpbmVyKT4qLFtsYXlvdXRdOm5vdChbbGF5b3V0PWNvbnRhaW5lcl0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpPip7ZGlzcGxheTpub25lfS5pLWFtcGh0bWwtZ2hvc3R7dmlzaWJpbGl0eTpoaWRkZW4haW1wb3J0YW50fS5pLWFtcGh0bWwtZWxlbWVudD5bcGxhY2Vob2xkZXJdLFtsYXlvdXRdOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpPltwbGFjZWhvbGRlcl17ZGlzcGxheTpibG9ja30uaS1hbXBodG1sLWVsZW1lbnQ%2BW3BsYWNlaG9sZGVyXS5hbXAtaGlkZGVuLC5pLWFtcGh0bWwtZWxlbWVudD5bcGxhY2Vob2xkZXJdLmhpZGRlbnt2aXNpYmlsaXR5OmhpZGRlbn0uaS1hbXBodG1sLWVsZW1lbnQ6bm90KC5hbXAtbm90c3VwcG9ydGVkKT5bZmFsbGJhY2tdLC5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lcj5bcGxhY2Vob2xkZXJdLmFtcC1oaWRkZW4sLmktYW1waHRtbC1sYXlvdXQtY29udGFpbmVyPltwbGFjZWhvbGRlcl0uaGlkZGVue2Rpc3BsYXk6bm9uZX0uaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQ%2BW2ZhbGxiYWNrXSwuaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQ%2BW3BsYWNlaG9sZGVyXXtwb3NpdGlvbjphYnNvbHV0ZSFpbXBvcnRhbnQ7dG9wOjAhaW1wb3J0YW50O2xlZnQ6MCFpbXBvcnRhbnQ7cmlnaHQ6MCFpbXBvcnRhbnQ7Ym90dG9tOjAhaW1wb3J0YW50O3otaW5kZXg6MX0uaS1hbXBodG1sLW5vdGJ1aWx0PltwbGFjZWhvbGRlcl17ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9LmktYW1waHRtbC1oaWRkZW4tYnktbWVkaWEtcXVlcnl7ZGlzcGxheTpub25lIWltcG9ydGFudH0uaS1hbXBodG1sLWVsZW1lbnQtZXJyb3J7YmFja2dyb3VuZDpyZWQhaW1wb3J0YW50O2NvbG9yOiNmZmYhaW1wb3J0YW50O3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudH0uaS1hbXBodG1sLWVsZW1lbnQtZXJyb3I6YmVmb3Jle2NvbnRlbnQ6YXR0cihlcnJvci1tZXNzYWdlKX1pLWFtcC1zY3JvbGwtY29udGFpbmVyLGktYW1waHRtbC1zY3JvbGwtY29udGFpbmVye3Bvc2l0aW9uOmFic29sdXRlO3RvcDowO2xlZnQ6MDtyaWdodDowO2JvdHRvbTowO2Rpc3BsYXk6YmxvY2t9aS1hbXAtc2Nyb2xsLWNvbnRhaW5lci5hbXAtYWN0aXZlLGktYW1waHRtbC1zY3JvbGwtY29udGFpbmVyLmFtcC1hY3RpdmV7b3ZlcmZsb3c6YXV0bzstd2Via2l0LW92ZXJmbG93LXNjcm9sbGluZzp0b3VjaH0uaS1hbXBodG1sLWxvYWRpbmctY29udGFpbmVye2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50O3BvaW50ZXItZXZlbnRzOm5vbmU7ei1pbmRleDoxfS5pLWFtcGh0bWwtbm90YnVpbHQ%2BLmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lcntkaXNwbGF5OmJsb2NrIWltcG9ydGFudH0uaS1hbXBodG1sLWxvYWRpbmctY29udGFpbmVyLmFtcC1oaWRkZW57dmlzaWJpbG&i=1-7&t=adltag_k7xey36s_BHZi6nD7QRU&r=1fe530d4e21edd38b46a4eb003c82ee&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-45.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Mar 2020 06:18:38 GMT
via: 1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
age: 28931
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
etag: "6b7395c9201aa64331475fddd24d987c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: Muy8fXg7t_SHv1b8HBeFBmwLAWt2OAk-jYTehYLKY4zAmhiLawCv3w==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame D9C4 43 B
480 B 31ms
27ms Other
image/gif 13.224.194.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=l0eTpoaWRkZW59LmktYW1waHRtbC1lbGVtZW50PltvdmVyZmxvd117Y3Vyc29yOnBvaW50ZXI7cG9zaXRpb246cmVsYXRpdmU7ei1pbmRleDoyO3Zpc2liaWxpdHk6aGlkZGVufS5pLWFtcGh0bWwtZWxlbWVudD5bb3ZlcmZsb3ddLmFtcC12aXNpYmxle3Zpc2liaWxpdHk6dmlzaWJsZX10ZW1wbGF0ZXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fS5hbXAtYm9yZGVyLWJveCwuYW1wLWJvcmRlci1ib3ggKiwuYW1wLWJvcmRlci1ib3ggOmFmdGVyLC5hbXAtYm9yZGVyLWJveCA6YmVmb3Jle2JveC1zaXppbmc6Ym9yZGVyLWJveH1hbXAtcGl4ZWx7ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtYW5hbHl0aWNzLGFtcC1zdG9yeS1hdXRvLWFkc3twb3NpdGlvbjpmaXhlZCFpbXBvcnRhbnQ7dG9wOjAhaW1wb3J0YW50O3dpZHRoOjFweCFpbXBvcnRhbnQ7aGVpZ2h0OjFweCFpbXBvcnRhbnQ7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDt2aXNpYmlsaXR5OmhpZGRlbn1odG1sLmktYW1waHRtbC1maWU%2BYW1wLWFuYWx5dGljc3twb3NpdGlvbjppbml0aWFsIWltcG9ydGFudH1bdmlzaWJsZS13aGVuLWludmFsaWRdOm5vdCgudmlzaWJsZSksYW1wLWxpc3QgW2ZldGNoLWVycm9yXSxmb3JtIFtzdWJtaXQtZXJyb3JdLGZvcm0gW3N1Ym1pdC1zdWNjZXNzXSxmb3JtIFtzdWJtaXR0aW5nXXtkaXNwbGF5Om5vbmV9YW1wLWFjY29yZGlvbntkaXNwbGF5OmJsb2NrIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uPnNlY3Rpb257ZmxvYXQ6bm9uZSFpbXBvcnRhbnR9YW1wLWFjY29yZGlvbj5zZWN0aW9uPip7ZmxvYXQ6bm9uZSFpbXBvcnRhbnQ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnQ7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDtwb3NpdGlvbjpyZWxhdGl2ZSFpbXBvcnRhbnR9YW1wLWFjY29yZGlvbixhbXAtYWNjb3JkaW9uPnNlY3Rpb257bWFyZ2luOjB9YW1wLWFjY29yZGlvbj5zZWN0aW9uPjpsYXN0LWNoaWxke2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9YW1wLWFjY29yZGlvbj5zZWN0aW9uW2V4cGFuZGVkXT46bGFzdC1jaGlsZHtkaXNwbGF5OmJsb2NrIWltcG9ydGFudH1cbi8qIyBzb3VyY2VVUkw9L2Nzcy9hbXBzaGFyZWQuY3NzKi9odG1sLmktYW1waHRtbC1pbmFib3h7d2lkdGg6MTAwJSFpbXBvcnRhbnQ7aGVpZ2h0OjEwMCUhaW1wb3J0YW50fTwvc3R5bGU%2BPG1ldGEgY29udGVudD1cIndpZHRoPWRldmljZS13aWR0aCxtaW5pbXVtLXNjYWxlPTEsaW5pdGlhbC1zY2FsZT0xXCIgbmFtZT1cInZpZXdwb3J0XCI%2BPG1ldGEgY29udGVudD1cInZlbmRvcj1kb3VibGVjbGljayx0eXBlPWltcHJlc3Npb24taWQsdmFsdWU9Q0p6YV9KQ2NwT2dDRlljWDRBb2RqYUFQZ0FcIiBuYW1lPVwiYW1wNGFkcy1pZFwiPjxsaW5rIGFzPVwic2NyaXB0XCIgY3Jvc3NvcmlnaW49XCJhbm9ueW1vdXNcIiBocmVmPVwiaHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvcnR2LzAxMjAwMzAzMTg0MjEwMC9hbXA0YWRzLXYwLmpzXCIgcmVsPVwicHJlbG9hZFwiPjxzY3JpcHQgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDAzMDMxODQyMTAwL2FtcDRhZHMtdjAuanNcIj48L3NjcmlwdD48c2NyaXB0IGFzeW5jPVwiXCIgY3VzdG9tLWVsZW1lbnQ9XCJhbXAtYWQtZXhpdFwiIHNyYz1cImh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDMwMzE4NDIxMDAvdjAvYW1wLWFkLWV4aXQtMC4xLmpzXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYz1cIlwiIGN1c3RvbS1lbGVtZW50PVwiYW1wLWFuYWx5dGljc1wiIHNyYz1cImh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDMwMzE4NDIxMDAvdjAvYW1wLWFuYWx5dGljcy0wLjEuanNcIj48L3NjcmlwdD48c2NyaXB0IGFzeW5jPVwiXCIgY3VzdG9tLWVsZW1lbnQ9XCJhbXAtZml0LXRleHRcIiBzcmM9XCJodHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDAzMDMxODQyMTAwL3YwL2FtcC1maXQtdGV4dC0wLjEuanNcIj48L3NjcmlwdD48c2NyaXB0IGFzeW5jPVwiXCIgY3VzdG9tLWVsZW1lbnQ9XCJhbXAtZm9ybVwiIHNyYz1cImh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDMwMzE4NDIxMDAvdjAvYW1wLWZvcm0tMC4xLmpzXCI%2BPC9zY3JpcHQ%2BPHN0eWxlIGFtcC1jdXN0b209XCJcIj5hIHsgY29sb3I6ICMwMDAwMDAgfWJvZHkgeyBtYXJnaW46IDA7IGJhY2tncm91bmQ6IHRyYW5zcGFyZW50OyB9I2dvb2dsZV9pbWFnZV9kaXYge2hlaWdodDogNjAwcHg7d2lkdGg6IDMwMHB4O292ZXJmbG93OmhpZGRlbjtwb3NpdGlvbjpyZWxhdGl2ZX1odG1sLCBib2R5IHt3aWR0aDoxMDAlO2hlaWdodDoxMDAlO31ib2R5IHtkaXNwbGF5OnRhYmxlO3RleHQtYWxpZ246Y2VudGVyO30jZ29vZ2xlX2NlbnRlcl9kaXYge2Rpc3BsYXk6dGFibGUtY2VsbDt2ZXJ0aWNhbC1hbGlnbjptaWRkbGU7fSNnb29nbGVfaW1hZ2VfZGl2IHtkaXNwbGF5OmlubGluZS1ibG9jazt9LmFiZ2Mge3Bvc2l0aW9uOmFic29sdXRlO3otaW5kZXg6MjE0NzQ4MzY0NjtyaWdodDowO3RvcDowO30uYWJnYyBhbXAtaW1nLCAuYWJnYyBpbWcge2Rpc3BsYXk6YmxvY2s7fS5hYmdzIHtwb3NpdGlvbjphYnNvbHV0ZTstd2Via2l0LXRyYW5zZm9ybTp0cmFuc2xhdGVYKDc2cHgpO3RyYW5zZm9ybTp0cmFuc2xhdGVYKDc2cHgpO3JpZ2h0OjE2cHg7dG9wOjA7fS5hYmdjcCB7cG9zaXRpb246YWJzb2x1dGU7cmlnaHQ6MDt0b3A6MDt3aWR0aDozMXB4O2hlaWdodDoxNXB4O3BhZGRpbmctbGVmdDoxMHB4O3BhZGRpbmctYm90dG9tOjEwcHg7fS5hYmdiIHtwb3NpdGlvbjpyZWxhdGl2ZTttYXJnaW4tcmlnaHQ6MTZweDt0b3A6MDt9LmFiZ2M6aG92ZXIgLmFiZ3Mgey13ZWJraXQtdHJhbnNmb3JtOm5vbmU7dHJhbnNmb3JtOm5vbmU7fS5jYmIge2Rpc3BsYXk6IGJsb2NrO3Bvc2l0aW9uOiBhYnNvbHV0ZTtyaWdodDowO3RvcDowO2N1cnNvcjogcG9pbnRlcjtoZWlnaHQ6IDE1cHg7d2lkdGg6IDE1cHg7ei1pbmRleDogOTAyMDtwYWRkaW5nLWxlZnQ6MTZweDt9LmJ0biB7ZGlzcGxheTogaW5saW5lLWJsb2NrO2JvcmRlci1yYWRpdXM6IDJweDstbW96LWJveC1zaXppbmc6IGJvcmRlci1ib3g7LXdlYmtpdC1ib3gtc2l6aW5nOiBib3JkZXItYm94O2JveC1zaXppbmc6IGJvcmRlci1ib3g7Ym94LXNoYWRvdzogMHB4IDBweCAycHggcmdiYSgwLDAsMCwwLjEyKSwgMHB4IDFweCAzcHggcmdiYSgwLDAsMCwwLjI2KTtjdXJzb3I6IHBvaW50ZXI7Zm9udC1zaXplOiAwLjdlbTttYXJnaW46IDAgMXB4IDAuNGVtIDFweDt9QG1lZGlhIChtYXgtd2lkdGg6IDM3NXB4KSBhbmQgKG1pbi1oZWlnaHQ6IDEwMHB4KSB7LmJ0biB7ZGlzcGxheTogYmxvY2s7d2lkdGg6IDkwJTttYXgtd2lkdGg6IDI0MHB4O21hcmdpbi1sZWZ0OiBhdXRvO21hcmdpbi1yaWdodDogYXV0bzt9fSNzcHYxIGFtcC1maXQtdGV4dD5kaXYgey13ZWJraXQtanVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O2p1c3RpZnktY29udGVudDogZmxleC1zdGFydDt9Lmp0IC5wbiBhbXAtZml0LXRleHQ%2BZGl2IHstd2Via2l0LWp1c3RpZnktY29udGVudDogZmxleC1zdGFydDtqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7fS5idG4gPiBzcGFuIHtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7cGFkZGluZzogMC41ZW0gMC42ZW07bGluZS1oZWlnaHQ6IDFlbTt9I3NidG4ge2JhY2tncm91bmQtY29sb3I6ICNGRkZGRkY7Y29sb3I6ICM5RTlFQTY7dGV4dC1kZWNvcmF0aW9uOiBub25lO30jc2J0bjpob3Zlciwjc2J0bjphY3RpdmUge2JhY2tncm91bmQtY29sb3I6ICNGNUY1RjU7fSNyYnRuIHtiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoNjYsMTMzLDI0NSk7Y29sb3I6IHdoaXRlO30jcmJ0bjpob3ZlciwjcmJ0bjphY3RpdmUge2JhY2tncm91bmQtY29sb3I6ICMzMjc1RTU7fSNtdGEge3Bvc2l0aW9uOmFic29sdXRlO3RvcDogMDtsZWZ0OiAwO2ZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjtmb250LXNpemU6IDEycHg7Zm9udC13ZWlnaHQ6IDQwMDtsaW5lLWhlaWdodDogMWVtO30jbXRhIGlucHV0W3R5cGU9XCJyYWRpb1wiXSB7ZGlzcGxheTogbm9uZTt9I210YSAucG4ge3JpZ2h0OiAtMzAwcHg7dG9wOiAtNjAwcHg7d2lkdGg6MzAwcHg7aGVpZ2h0OjYwMHB4O3Bvc2l0aW9uOiBhYnNvbHV0ZTstbW96LWJveC1zaXppbmc6IGJvcmRlci1ib3g7LXdlYmtpdC1ib3gtc2l6aW5nOiBib3JkZXItYm94O2JveC1zaXppbmc6IGJvcmRlci1ib3g7YmFja2dyb3VuZC1jb2xvcjogI0ZBRkFGQTt0ZXh0LWFsaWduOiBjZW50ZXI7fSNzcHYyIHtkaXNwbGF5OiAtd2Via2l0LWZsZXg7ZGlzcGxheTogZmxleDstd2Via2l0LWp1c3RpZnktY29udGVudDogZmxleC1zdGFydDtqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7LXdlYmtpdC1mbGV4LXdyYXA6IG5vd3JhcDtmbGV4LXdyYXA6IG5vd3JhcDtvdmVyZmxvdzogaGlkZGVuO2JhY2tncm91bmQtY29sb3I6ICNGQUZBRkE7Zm9udC1zaXplOiAwO30uc3YgI3NwdjIgey13ZWJraXQtZmxleC1kaXJlY3Rpb246IGNvbHVtbjtmbGV4LWRpcmVjdGlvbjogY29sdW1uO30uanQuc3YgI3NwdjIgey13ZWJraXQtanVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O2p1c3RpZnktY29udGVudDogZmxleC1zdGFydDstd2Via2l0LWFsaWduLWl0ZW1zOiBjZW50ZXI7YWxpZ24taXRlbXM6IGNlbnRlcjt9I3NwdjIgKiB7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O30jc3ByMTpjaGVja2VkIH4gI2NiYiwjc3ByMjpjaGVja2VkIH4gI2NiYiwjc3ByMzpjaGVja2VkIH4gI2NiYntkaXNwbGF5OiBub25lO30jc3B2MyB7b3BhY2l0eToxO30uYW1wLWFuaW1hdGUgI3NwdjQge29wYWNpdHk6MDt0cmFuc2l0aW9uOiBvcGFjaXR5IDAuNXMgbGluZWFyIDIuNXM7fS5hbXAtYW5pbWF0ZSAgI3NwdjMgYW1wLWZpdC10ZXh0IHtvcGFjaXR5OjE7dHJhbnNpdGlvbjogb3BhY2l0eSAwLjVzIGxpbmVhciAyczt9I3NwcjM6Y2hlY2tlZCB%2BICNzcHYzIGFtcC1maXQtdGV4dCB7b3BhY2l0eTowfSNzcHIzOmNoZWNrZWQgfiAjc3B2NCB7b3BhY2l0eToxO30jc3ByMTpjaGVja2VkIH4gI3NwdjEsI3NwcjI6Y2hlY2tlZCB%2BICNzcHYyLCNzcHIzOmNoZWNrZWQgfiAjc3B2Mywjc3ByMzpjaGVja2VkIH4gI3NwdjR7cmlnaHQ6IDBweDt0b3A6IDBweDt9LmN0IHN2ZyB7Ym9yZGVyOiAwO21hcmdpbjogMCAwIC0wLjQ1ZW0gMDtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7aGVpZ2h0OiAxLjM4ZW07b3BhY2l0eTogMC40O30uY3Qge2Rpc3BsYXk6IGlubGluZS1ibG9jaztsaW5lLWhlaWdodDogMS4yOGVtO2NvbG9yOiByZ2JhKDAsMCwwLDAuNCk7dGV4dC1hbGlnbjpjZW50ZXI7cGFkZGluZzogMC4zZW07fS5mY3Qge3BhZGRpbmc6IDFlbTt9I3BjdCB7ZGlzcGxheTogYmxvY2s7Zm9udC13ZWlnaHQ6IGJvbGQ7cGFkZGluZzogMWVtIDAuM2VtO30jdGkge3dpZHRoOiAzMDBweDt9I2J0bnMge3dpZHRoOiAzMDBweDt9LmZsIHt3aWR0aDogMzAwcHg7aGVpZ2h0OjYwMHB4O30jc2kge3Bvc2l0aW9uOiByZWxhdGl2ZTtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7bWFyZ2luLWJvdHRvbTogLTAuMTVlbTtoZWlnaHQ6IDFlbTt3aWR0aDogMWVtO29wYWNpdHk6IDAuNDt9LnNiIHtmbGV4LXNocmluazogMDtoZWlnaHQ6IDUwcHg7fS5zbyB7cG9zaXRpb246IHJlbGF0aXZlO3otaW5kZXg6IDkxMTA7b3ZlcmZsb3c6IGhpZGRlbjtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7cGFkZGluZzogMXB4IDVweDt3aWR0aDogOTZweDtoZWlnaHQ6IDUwcHg7Ym9yZGVyOiAxcHggc29saWQgI0UwRTBFMDtiYWNrZ3JvdW5kLWNvbG9yOiAjRkZGRkZGO2N1cnNvcjogcG9pbnRlcjt9LnNvOmhvdmVyLC5zbzphY3RpdmUge2JhY2tncm91bmQtY29sb3I6ICNGNUY1RjU7fS5zbyBkaXYge2Rpc3BsYXk6IC13ZWJraXQtZmxleDtkaXNwbGF5OiBmbGV4Oy13ZWJraXQtYWxpZ2&i=2-7&t=adltag_k7xey36s_BHZi6nD7QRU&r=1fe530d4e21edd38b46a4eb003c82ee&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-45.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Mar 2020 06:18:38 GMT
via: 1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
age: 28931
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
etag: "6b7395c9201aa64331475fddd24d987c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: G6oIS0v2_4mIdel5L_qMEwVwqr94Ae1fa-cavhlAW387BAwrfVG3iQ==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame D9C4 43 B
482 B 44ms
40ms Other
image/gif 13.224.194.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=4taXRlbXM6IGNlbnRlcjthbGlnbi1pdGVtczogY2VudGVyOy13ZWJraXQtanVzdGlmeS1jb250ZW50OiBjZW50ZXI7anVzdGlmeS1jb250ZW50OiBjZW50ZXI7d2lkdGg6IDEwMCU7aGVpZ2h0OiAxMDAlO30uc28gc3BhbiB7Y29sb3I6ICM0Mjg1RjQ7Zm9udC1mYW1pbHk6IEFyaWFsLCBzYW5zLXNlcmlmO3RleHQtYWxpZ246IGNlbnRlcjtmb250LXNpemU6IDEycHg7bGluZS1oZWlnaHQ6IDE0cHg7d2hpdGUtc3BhY2U6IG5vcm1hbDt9QG1lZGlhIChtaW4taGVpZ2h0OiA1NHB4KSB7LnNoLnNzIC5zbywuc3YgLnNvIHtib3gtc2hhZG93OiAwcHggMHB4IDJweCByZ2JhKDAsMCwwLDAuMTIpLCAwcHggMXB4IDNweCByZ2JhKDAsMCwwLDAuMjYpO2JvcmRlcjogbm9uZTt9fS5zdiAuc28sLnNoLnNzIC5zbyB7Ym9yZGVyLXJhZGl1czogMnB4O30uc3YgLnNvIHttYXJnaW46IDRweDt9LnN2Lmp0IC5zbzpmaXJzdC1jaGlsZCB7bWFyZ2luLXRvcDogOHB4O308L3N0eWxlPjxsaW5rIHJlbD1cInByZWNvbm5lY3RcIiBocmVmPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tXCIgcmVmZXJyZXJwb2xpY3k9XCJvcmlnaW5cIj48L2hlYWQ%2BPGJvZHkgY2xhc3M9XCJhbXAtYW5pbWF0ZSBhbXAtbW9kZS1tb3VzZVwiIG1hcmdpbndpZHRoPVwiMFwiIG1hcmdpbmhlaWdodD1cIjBcIiBzdHlsZT1cIm9wYWNpdHk6IDE7IHZpc2liaWxpdHk6IHZpc2libGU7IGFuaW1hdGlvbjogMHMgZWFzZSAwcyAxIG5vcm1hbCBub25lIHJ1bm5pbmcgbm9uZTtcIj48ZGl2IGlkPVwiZ29vZ2xlX2NlbnRlcl9kaXZcIj48ZGl2IGlkPVwiZ29vZ2xlX2ltYWdlX2RpdlwiPjxhIGhyZWY9XCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9hY2xrP3NhPWwmYW1wO2FpPUNjMmc4UGk1eVhwekRGb2V2Z0FlTndiNkFDUG4wbHBCY3ZMeWlxOXdKZ1pmY19QOFdFQUVnMFlmU0lHQ1JoSUNBX0JlZ0FmaURrUDREeUFFQzRBSUFxQU1CeUFNSXFnU2dBa19RazFtMmZaVDMxVkJKeFIxaWVKQmM1ZTVZekotM0czZWYySWY4ZVoyWkZ4ZXhHUktJU2dmRGVQLXFNd2xZVFhxN2NHb0dHRU5MYW1PN2ZlWG1qdDBBY1ZZT3pUcGdBQ3NmZnZMbXFoMVROZUhMV01yVGJ1ZTRvazQ3ZzQ5YlRjcXdIVnJnUE9UYkRHMGdsUi1uOFlGalBJTGhoRFY0RWZFNDVNc3Vya3l1TmJ2X1J1aEI0b0VrU0F6ZWgxdkVYcEFyU01tMDFtU3JRd3loajdDVVhyd3FDbzZRUG1ISjJBV0YzMFlIcGw3QzZaejh4LXVDSmlkZk14dU4wWl9VWVk0LVh1NzBJOHE4TjNxWUczMF9ZZUxtaFNabm9iY1k1dlJaSzhXMVg5dTF0NnRBbDdKSjQ1TzI1bWxCZ0xNNFdOOWo4RUp5WjFhNjNfS2NlYVVqc2poX1JsaVVCWnZzclhOSWxQOXZLbjhnaE5MYWhSX3IwSXV1TWJPMnR2cTRDY0FFNHZlTDZaOEM0QVFCb0FZQ2dBZnctLThCcUFlT3podW9COVhKRzZnSGs5Z2JxQWVmMnh1b0I3b0dxQWZ3MlJ1b0JfTFpHNmdIcHI0YnFBZnMxUnVvQl9QUkc2Z0g3TlVicUFmQzJodllCd0hTQ0FrSWdPR0FFQkFCR0IzeUNCdGhaSGd0YzNWaWMzbHVMVGN5TmpNMU56TTBORFk0TURRd056aXhDVlYweFoxZmlMeG5nQW9EbUFzQnlBc0IyQk1DJmFtcDthZT0xJmFtcDtudW09MSZhbXA7c2lnPUFPRDY0XzJtMEJjT3Q5dGdPRmdRRzRzUklIVll2YnM4bVEmYW1wO2NsaWVudD1jYS1wdWItOTY4NTczNDQ0NTQ3NjgxNCZhbXA7bng9Q0xJQ0tfWCZhbXA7bnk9Q0xJQ0tfWSZhbXA7bmI9MiZhbXA7YWR1cmw9aHR0cHM6Ly9pbmZvLmluZm9ibG94LmNvbS9XVy1QUEMtRlkyMC1DU0FEdW1taWVzLTIwMTkwODAxLmh0bWwlM0ZzcyUzRGdvb2dsZSUyNnN0JTNEY2xvdWQlMjUyMGN5YmVyJTI1MjBzZWN1cml0eSUyNmdjbGlkJTNERUFJYUlRb2JDaE1Jbk5yOGtKeWs2QUlWaHhmZ0NoMk5vQS1BRUFFWUFTQUFFZ0lyTV9EX0J3RVwiIGlkPVwiYXcwXCIgb249XCJ0YXA6ZXhpdC1hcGkuZXhpdCh0YXJnZXQ9J2xhbmRpbmdQYWdlJyxfbmI9JzInKVwiIHRhcmdldD1cIl9ibGFua1wiPjxhbXAtaW1nIGFsdD1cIlwiIGNsYXNzPVwiaW1nX2FkIGktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQgaS1hbXBodG1sLWVsZW1lbnRcIiBoZWlnaHQ9XCI2MDBcIiBpLWFtcGh0bWwtbGF5b3V0PVwiZml4ZWRcIiBpLWFtcGh0bWwtc3NyPVwiXCIgc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3NpbWdhZC8xODIxNDc0MzM4MjYwMDExNTQyNz9zcXA9NHNxUHlRUTdRamtxTnhBQkhRQUF0RUlnQVNnQk1BazRBMER3a3dsWUFXQmZjQUtBQVFHSUFRR2RBUUFBZ0Qtb0FRR3dBWUN0NGdTNEFWX0ZBUzJ5blQ0JmFtcDtycz1BT2dhNHFtcjA2ZW1PalRDVUlZa0ZBOGRsYmp3YXRKT1B3XCIgc3R5bGU9XCJ3aWR0aDozMDBweDtoZWlnaHQ6NjAwcHg7XCIgd2lkdGg9XCIzMDBcIj48aW1nIGFsdD1cIlwiIGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPVwiYXN5bmNcIiBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc2ltZ2FkLzE4MjE0NzQzMzgyNjAwMTE1NDI3P3NxcD00c3FQeVFRN1Fqa3FOeEFCSFFBQXRFSWdBU2dCTUFrNEEwRHdrd2xZQVdCZmNBS0FBUUdJQVFHZEFRQUFnRC1vQVFHd0FZQ3Q0Z1M0QVZfRkFTMnluVDQmYW1wO3JzPUFPZ2E0cW1yMDZlbU9qVENVSVlrRkE4ZGxiandhdEpPUHdcIj48L2FtcC1pbWc%2BPC9hPjxhbXAtcGl4ZWwgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50XCIgaS1hbXBodG1sLWxheW91dD1cImZpeGVkXCIgcmVmZXJyZXJwb2xpY3k9XCJuby1yZWZlcnJlclwiIHNyYz1cIi8vd3d3Lmdvb2dsZS5jb20vcGFnZWFkL2RydC91aVwiIHN0eWxlPVwid2lkdGg6MXB4O2hlaWdodDoxcHg7XCIgYXJpYS1oaWRkZW49XCJ0cnVlXCI%2BPC9hbXAtcGl4ZWw%2BPGRpdiBhcmlhLWhpZGRlbj1cInRydWVcIiBjbGFzcz1cImFiZ2MgYWJnZiBwZW5cIiBkaXI9XCJsdHJcIiBpZD1cImFiZ2NcIj48ZGl2IGNsYXNzPVwiYWJnY3AgcGVhXCIgaWQ9XCJhYmdjcFwiPjxkaXYgY2xhc3M9XCJhYmdzXCIgaWQ9XCJhYmdzXCI%2BPGEgY2xhc3M9XCJhYmdsXCIgaHJlZj1cImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbS93aHl0aGlzYWQ%2FcmVhc29ucz1BQjNhZkdFQUFBVlNXMXRiVzI1MWJHd3NXeklzT1N3eE0xMHNiblZzYkN4dWRXeHNMSFJ5ZFdWZExGdHVkV3hzTENKb2RIUndjem92TDJkdmIyZHNaV0ZrY3k1bkxtUnZkV0pzWldOc2FXTnJMbTVsZEM5d1lXZGxZV1F2WTI5dWRtVnljMmx2Ymk4X1lXazlRMk15WnpoUWFUVjVXSEI2UkVadlpYWm5RV1ZPZDJJMlFVTlFiakJzY0VKamRreDVhWEU1ZDBwbldtWmpYMUE0VjBWQlJXY3dXV1pUU1VkRFVtaEpRMEZmUW1WblFXWnBSR3RRTkVSNVFVVkRORUZKUVhGQlRVSjVRVTFKY1dkVFowRnJYMUZyTVcweVpscFVNekZXUWtwNFVqRnBaVXBDWXpWbE5WbDZTaTB6UnpObFpqSkpaamhsV2pKYVJuaGxlRWRTUzBsVFoyWkVaVkF0Y1UxM2JGbFVXSEUzWTBkdlIwZEZUa3hoYlU4M1ptVlliV3AwTUVGalZsbFBlbFJ3WjBGRGMyWm1ka3h0Y1dneFZFNWxTRXhYVFhKVVluVmxORzlyTkRkbk5EbGlWR054ZDBoV2NtZFFUMVJpUkVjd1oyeFNMVzQ0V1VacVVFbE1hR2hFVmpSRlprVTBOVTF6ZFhKcmVYVk9ZblpmVW5Wb1FqUnZSV3RUUVhwbGFERjJSVmh3UVhKVFRXMHdNVzFUY2xGM2VXaHFOME5WV0hKM2NVTnZObEZRYlVoS01rRlhSak13V1Vod2JEZERObHA2T0hndGRVTkthV1JtVFhoMVRqQmFYMVZaV1RRdFdIVTNNRWs0Y1RoT00zRlpSek13WDFsbFRHMW9VMXB1YjJKaldUVjJVbHBMT0ZjeFdEbDFNWFEyZEVGc04wcEtORFZQTWpWdGJFSm5URTAwVjA0NWFqaEZTbmxhTVdFMk0xOUxZMlZoVldwemFtaGZVbXhwVlVKYWRuTnlXRTVKYkZBNWRrdHVPR2RvVGt4aGFGSmZjakJKZFhWTllrOHlkSFp4TkVOalFVVTBkbVZNTmxvNFF6UkJVVUp2UVZsRFowRm1keTB0T0VKeFFXVlBlbWgxYjBJNVdFcEhObWRJYXpsblluRkJaV1l5ZUhWdlFqZHZSM0ZCWm5jeVVuVnZRbDlNV2tjMlowaHdjalJpY1VGbWN6RlNkVzlDWDFCU1J6Wm5TRGRPVldKeFFXWkRNbWgyV1VKM1NGTkRRV3RKWjA5SFFVVkNRVUpIUWpONVEwSjBhRnBJWjNSak0xWnBZek5zZFV4VVkzbE9hazB4VG5wTk1FNUVXVFJOUkZGM1RucHBlRU5XVmpCNFdqRm1hVXg0Ym1kQmIwUnRRWE5DZVVGelFqSkNUVU5jZFRBd01qWnphV2RvUFZWdk1IcHRUVGcwUlRjd1hIVXdNREkyWTJsa1BVTkJVVk5NVVVOT1NYSk1UVzVmWVhoRVpIVkxhelZ6ZERCbFVHSk1NSEUyZDI4MlFsRkdZWGgzYzFnMlpXUndiRzV5VFdNNWRuRk1VVFpmVUVGR05tTm9keUlzVzI1MWJHd3NiblZzYkN4dWRXeHNMQ0pvZEhSd2N6b3ZMMlJwYzNCc1lYbGhaSE10Wm05eWJXRjBjeTVuYjI5bmJHVjFjMlZ5WTI5dWRHVnVkQzVqYjIwdllXUnpMM0J5WlhacFpYY3ZZMjl1ZEdWdWRDNXFjejlqYkdsbGJuUTlkM1JoWEhVd01ESTJiMkptZFhOallYUmxaRU4xYzNSdmJXVnlTV1E5TmpBNU9EVTVPRFl5T0Z4MU1EQXlObU55WldGMGFYWmxTV1E5TXpnd01qTTJNamd6TWpVeFhIVXdNREkyZG1WeWMybHZia2xrUFRCY2RUQXdNalpoWkVkeWIzVndRM0psWVhScGRtVkpaRDB6TXpRd01qUTBORGsxT1RaY2RUQXdNalpvZEcxc1VHRnlaVzUwU1dROWNISmxkaTB3WEhVd01ESTJhR1ZwWjJoMFBUWXdNRngxTURBeU5uZHBaSFJvUFRNd01GeDFNREF5Tm5OcFp6MUJRMmxXUWw5M2JFUnFWVTlWV1VnMFUySjJjM1p4TkV0UVRHOTJWbTVGWlhsM0lsMHNiblZzYkN4dWRXeHNMREVzSWs1QlZtdGpSMGcwYWs1TlNYWk1lV2x4T1hkS1JVOVVjbkpEV1Zsb1QwTnhRVk5KVW1GWE5XMWllVFZ3WW0xYWRsbHRlSFpsUXpWcVlqSXdlVUozWjBaRmVHcEtVVUpTUTBZeVRtaE1XRUl4V1drd05VNXFaekZPZWswd1RrUlJNVTVFWXpKUFJFVXdVMEZDV1VGdVFVSm5aMFZMYldaRVdHaG1lbDlmWDE5ZlFWRWlMQ0k0TURReU5qUTJPQ0pkWFYwc1d6RXNNVjFkQnR4SFZuYkF5NzJsLU1paG9OXzluM25CZ09sNlVNaU0ySUZlTC13d3lYYzNWS0RfX3V4QlI0cnJoZXl5YTcyM0QzR2VwazM3LUd1SVJiaTQ0dXpnRjc4dlZiMl9NTzg5d1ZOaTJEeHR3Zkh6SC1WdDNZc1c4bFlSOE53ZzZZV1h5TDFXN2tIdnNzZTE4MVJFcWZzRUtXS3JJVkVJM0c1UkFiRVFMR0lLTi1DdDdtbnphMFgtVnE3QzNtbmk3VGh0dGtHWDc5S0x1MU9rRU5xLUUxRlIxdXRoYmlkR2tCSE9jdVU2elVnNXpublZlLVhKdThGVjJtbU92TV9ZaWZteUVzcVYzc2RJMWtmVVlyZWdfUHU4cEttMmVOWnM3MzFFM3FYN1daYjhsU3lCRlhCZWhoWUNiMGNDbTV2Q1pPbXNNalJNMGZNRjNBZWg0bzQ5WjFxUXZ3LDVVYkh4SDFUOXFNcTBRS1dwU2NYU3cmYW1wO3NvdXJjZT1kaXNwbGF5XCIgaWQ9XCJhYmdsXCIgdGFyZ2V0PVwiX2JsYW5rXCI%2BPGFtcC1pbWcgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50XCIgaGVpZ2h0PVwiMTVcIiBpLWFtcGh0bWwtbGF5b3V0PVwiZml4ZWRcIiBpLWFtcGh0bWwtc3NyPVwiXCIgc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2VuLnBuZ1wiIHN0eWxlPVwid2lkdGg6NzVweDtoZWlnaHQ6MTVweDtcIiB3aWR0aD1cIjc1XCI%2BPGltZyBjbGFzcz1cImktYW1waHRtbC1maWxsLWNvbnRlbnQgaS1hbXBodG1sLXJlcGxhY2VkLWNvbnRlbnRcIiBkZWNvZGluZz1cImFzeW5jXCIgc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2VuLnBuZ1wiPjwvYW1wLWltZz48L2E%2BPC9kaXY%2BPGRpdiBjbGFzcz1cImFiZ2JcIiBpZD1cImFiZ2JcIj48YSBocmVmPVwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tL3doeXRoaXNhZD9yZWFzb25zPUFCM2FmR0VBQUFWU1cxdGJXMjUxYk&i=3-7&t=adltag_k7xey36s_BHZi6nD7QRU&r=1fe530d4e21edd38b46a4eb003c82ee&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-45.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Mar 2020 06:18:38 GMT
via: 1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
age: 28931
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
etag: "6b7395c9201aa64331475fddd24d987c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: QieHWQXfc_W3LGH47_yjIw7DaQBWL8ZAeMd0wiMXWGqVk8dIwUBWFg==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame D9C4 43 B
481 B 45ms
42ms Other
image/gif 13.224.194.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=d3c1d6SXNPU3d4TTEwc2JuVnNiQ3h1ZFd4c0xIUnlkV1ZkTEZ0dWRXeHNMQ0pvZEhSd2N6b3ZMMmR2YjJkc1pXRmtjeTVuTG1SdmRXSnNaV05zYVdOckxtNWxkQzl3WVdkbFlXUXZZMjl1ZG1WeWMybHZiaThfWVdrOVEyTXlaemhRYVRWNVdIQjZSRVp2WlhablFXVk9kMkkyUVVOUWJqQnNjRUpqZGt4NWFYRTVkMHBuV21aalgxQTRWMFZCUldjd1dXWlRTVWREVW1oSlEwRmZRbVZuUVdacFJHdFFORVI1UVVWRE5FRkpRWEZCVFVKNVFVMUpjV2RUWjBGclgxRnJNVzB5WmxwVU16RldRa3A0VWpGcFpVcENZelZsTlZsNlNpMHpSek5sWmpKSlpqaGxXakphUm5obGVFZFNTMGxUWjJaRVpWQXRjVTEzYkZsVVdIRTNZMGR2UjBkRlRreGhiVTgzWm1WWWJXcDBNRUZqVmxsUGVsUndaMEZEYzJabWRreHRjV2d4VkU1bFNFeFhUWEpVWW5WbE5HOXJORGRuTkRsaVZHTnhkMGhXY21kUVQxUmlSRWN3WjJ4U0xXNDRXVVpxVUVsTWFHaEVWalJGWmtVME5VMXpkWEpyZVhWT1luWmZVblZvUWpSdlJXdFRRWHBsYURGMlJWaHdRWEpUVFcwd01XMVRjbEYzZVdocU4wTlZXSEozY1VOdk5sRlFiVWhLTWtGWFJqTXdXVWh3YkRkRE5scDZPSGd0ZFVOS2FXUm1UWGgxVGpCYVgxVlpXVFF0V0hVM01FazRjVGhPTTNGWlJ6TXdYMWxsVEcxb1UxcHViMkpqV1RWMlVscExPRmN4V0RsMU1YUTJkRUZzTjBwS05EVlBNalZ0YkVKblRFMDBWMDQ1YWpoRlNubGFNV0UyTTE5TFkyVmhWV3B6YW1oZlVteHBWVUphZG5OeVdFNUpiRkE1ZGt0dU9HZG9Ua3hoYUZKZmNqQkpkWFZOWWs4eWRIWnhORU5qUVVVMGRtVk1ObG80UXpSQlVVSnZRVmxEWjBGbWR5MHRPRUp4UVdWUGVtaDFiMEk1V0VwSE5tZElhemxuWW5GQlpXWXllSFZ2UWpkdlIzRkJabmN5VW5WdlFsOU1Xa2MyWjBod2NqUmljVUZtY3pGU2RXOUNYMUJTUnpablNEZE9WV0p4UVdaRE1taDJXVUozU0ZORFFXdEpaMDlIUVVWQ1FVSkhRak41UTBKMGFGcElaM1JqTTFacFl6TnNkVXhVWTNsT2FrMHhUbnBOTUU1RVdUUk5SRkYzVG5wcGVFTldWakI0V2pGbWFVeDRibWRCYjBSdFFYTkNlVUZ6UWpKQ1RVTmNkVEF3TWpaemFXZG9QVlZ2TUhwdFRUZzBSVGN3WEhVd01ESTJZMmxrUFVOQlVWTk1VVU5PU1hKTVRXNWZZWGhFWkhWTGF6VnpkREJsVUdKTU1IRTJkMjgyUWxGR1lYaDNjMWcyWldSd2JHNXlUV001ZG5GTVVUWmZVRUZHTm1Ob2R5SXNXMjUxYkd3c2JuVnNiQ3h1ZFd4c0xDSm9kSFJ3Y3pvdkwyUnBjM0JzWVhsaFpITXRabTl5YldGMGN5NW5iMjluYkdWMWMyVnlZMjl1ZEdWdWRDNWpiMjB2WVdSekwzQnlaWFpwWlhjdlkyOXVkR1Z1ZEM1cWN6OWpiR2xsYm5ROWQzUmhYSFV3TURJMmIySm1kWE5qWVhSbFpFTjFjM1J2YldWeVNXUTlOakE1T0RVNU9EWXlPRngxTURBeU5tTnlaV0YwYVhabFNXUTlNemd3TWpNMk1qZ3pNalV4WEhVd01ESTJkbVZ5YzJsdmJrbGtQVEJjZFRBd01qWmhaRWR5YjNWd1EzSmxZWFJwZG1WSlpEMHpNelF3TWpRME5EazFPVFpjZFRBd01qWm9kRzFzVUdGeVpXNTBTV1E5Y0hKbGRpMHdYSFV3TURJMmFHVnBaMmgwUFRZd01GeDFNREF5Tm5kcFpIUm9QVE13TUZ4MU1EQXlObk5wWnoxQlEybFdRbDkzYkVScVZVOVZXVWcwVTJKMmMzWnhORXRRVEc5MlZtNUZaWGwzSWwwc2JuVnNiQ3h1ZFd4c0xERXNJazVCVm10alIwZzBhazVOU1haTWVXbHhPWGRLUlU5VWNuSkRXVmxvVDBOeFFWTkpVbUZYTlcxaWVUVndZbTFhZGxsdGVIWmxRelZxWWpJd2VVSjNaMFpGZUdwS1VVSlNRMFl5VG1oTVdFSXhXV2t3TlU1cVp6Rk9lazB3VGtSUk1VNUVZekpQUkVVd1UwRkNXVUZ1UVVKblowVkxiV1pFV0dobWVsOWZYMTlmUVZFaUxDSTRNRFF5TmpRMk9DSmRYVjBzV3pFc01WMWRCdHhIVm5iQXk3MmwtTWlob05fOW4zbkJnT2w2VU1pTTJJRmVMLXd3eVhjM1ZLRF9fdXhCUjRycmhleXlhNzIzRDNHZXBrMzctR3VJUmJpNDR1emdGNzh2VmIyX01PODl3Vk5pMkR4dHdmSHpILVZ0M1lzVzhsWVI4TndnNllXWHlMMVc3a0h2c3NlMTgxUkVxZnNFS1dLcklWRUkzRzVSQWJFUUxHSUtOLUN0N21uemEwWC1WcTdDM21uaTdUaHR0a0dYNzlLTHUxT2tFTnEtRTFGUjF1dGhiaWRHa0JIT2N1VTZ6VWc1em5uVmUtWEp1OEZWMm1tT3ZNX1lpZm15RXNxVjNzZEkxa2ZVWXJlZ19QdThwS20yZU5aczczMUUzcVg3V1piOGxTeUJGWEJlaGhZQ2IwY0NtNXZDWk9tc01qUk0wZk1GM0FlaDRvNDlaMXFRdncsNVViSHhIMVQ5cU1xMFFLV3BTY1hTdyZhbXA7c291cmNlPWRpc3BsYXlcIiB0YXJnZXQ9XCJfYmxhbmtcIj48YW1wLWltZyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQgaS1hbXBodG1sLWVsZW1lbnRcIiBoZWlnaHQ9XCIxNVwiIGktYW1waHRtbC1sYXlvdXQ9XCJmaXhlZFwiIGktYW1waHRtbC1zc3I9XCJcIiBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2ltYWdlcy9hZGNob2ljZXMvaWNvbi5wbmdcIiBzdHlsZT1cIndpZHRoOjE1cHg7aGVpZ2h0OjE1cHg7XCIgd2lkdGg9XCIxNVwiPjxpbWcgY2xhc3M9XCJpLWFtcGh0bWwtZmlsbC1jb250ZW50IGktYW1waHRtbC1yZXBsYWNlZC1jb250ZW50XCIgZGVjb2Rpbmc9XCJhc3luY1wiIHNyYz1cImh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvaW1hZ2VzL2FkY2hvaWNlcy9pY29uLnBuZ1wiPjwvYW1wLWltZz48L2E%2BPC9kaXY%2BPC9kaXY%2BPGFtcC1hbmFseXRpY3MgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50IGktYW1waHRtbC1ub3RidWlsdCBhbXAtbm90YnVpbHQgYW1wLXVucmVzb2x2ZWQgaS1hbXBodG1sLXVucmVzb2x2ZWRcIiBpLWFtcGh0bWwtbGF5b3V0PVwiZml4ZWRcIiBzdHlsZT1cIndpZHRoOjFweDtoZWlnaHQ6MXB4O1wiIHRyaWdnZXI9XCJpbW1lZGlhdGVcIj48c2NyaXB0IHR5cGU9XCJhcHBsaWNhdGlvbi9qc29uXCI%2Be1wicmVxdWVzdHNcIjoge1wicmVwb3J0Tm9MYWJlbEluc3RhbmNlXCI6IFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2NvbnZlcnNpb24vP2FpPUNjMmc4UGk1eVhwekRGb2V2Z0FlTndiNkFDUG4wbHBCY3ZMeWlxOXdKZ1pmY19QOFdFQUVnMFlmU0lHQ1JoSUNBX0JlZ0FmaURrUDREeUFFQzRBSUFxQU1CeUFNSXFnU2dBa19RazFtMmZaVDMxVkJKeFIxaWVKQmM1ZTVZekotM0czZWYySWY4ZVoyWkZ4ZXhHUktJU2dmRGVQLXFNd2xZVFhxN2NHb0dHRU5MYW1PN2ZlWG1qdDBBY1ZZT3pUcGdBQ3NmZnZMbXFoMVROZUhMV01yVGJ1ZTRvazQ3ZzQ5YlRjcXdIVnJnUE9UYkRHMGdsUi1uOFlGalBJTGhoRFY0RWZFNDVNc3Vya3l1TmJ2X1J1aEI0b0VrU0F6ZWgxdkVYcEFyU01tMDFtU3JRd3loajdDVVhyd3FDbzZRUG1ISjJBV0YzMFlIcGw3QzZaejh4LXVDSmlkZk14dU4wWl9VWVk0LVh1NzBJOHE4TjNxWUczMF9ZZUxtaFNabm9iY1k1dlJaSzhXMVg5dTF0NnRBbDdKSjQ1TzI1bWxCZ0xNNFdOOWo4RUp5WjFhNjNfS2NlYVVqc2poX1JsaVVCWnZzclhOSWxQOXZLbjhnaE5MYWhSX3IwSXV1TWJPMnR2cTRDY0FFNHZlTDZaOEM0QVFCb0FZQ2dBZnctLThCcUFlT3podW9COVhKRzZnSGs5Z2JxQWVmMnh1b0I3b0dxQWZ3MlJ1b0JfTFpHNmdIcHI0YnFBZnMxUnVvQl9QUkc2Z0g3TlVicUFmQzJodllCd0hTQ0FrSWdPR0FFQkFCR0IzeUNCdGhaSGd0YzNWaWMzbHVMVGN5TmpNMU56TTBORFk0TURRd056aXhDVlYweFoxZmlMeG5nQW9EbUFzQnlBc0IyQk1DJnNpZ2g9VW8wem1NODRFNzAmY2lkPUNBUVNMUUNOSXJMTW5fYXhEZHVLazVzdDBlUGJMMHE2d282QlFGYXh3c1g2ZWRwbG5yTWM5dnFMUTZfUEFGNmNodyZjaWQ9Q0FRU0xRQ05JckxNbl9heERkdUtrNXN0MGVQYkwwcTZ3bzZCUUZheHdzWDZlZHBsbnJNYzl2cUxRNl9QQUY2Y2h3JmxhYmVsPSR7bGFiZWx9XCIsXCJyZXBvcnRMYWJlbEluc3RhbmNlXCI6IFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2NvbnZlcnNpb24vP2FpPUNjMmc4UGk1eVhwekRGb2V2Z0FlTndiNkFDUG4wbHBCY3ZMeWlxOXdKZ1pmY19QOFdFQUVnMFlmU0lHQ1JoSUNBX0JlZ0FmaURrUDREeUFFQzRBSUFxQU1CeUFNSXFnU2dBa19RazFtMmZaVDMxVkJKeFIxaWVKQmM1ZTVZekotM0czZWYySWY4ZVoyWkZ4ZXhHUktJU2dmRGVQLXFNd2xZVFhxN2NHb0dHRU5MYW1PN2ZlWG1qdDBBY1ZZT3pUcGdBQ3NmZnZMbXFoMVROZUhMV01yVGJ1ZTRvazQ3ZzQ5YlRjcXdIVnJnUE9UYkRHMGdsUi1uOFlGalBJTGhoRFY0RWZFNDVNc3Vya3l1TmJ2X1J1aEI0b0VrU0F6ZWgxdkVYcEFyU01tMDFtU3JRd3loajdDVVhyd3FDbzZRUG1ISjJBV0YzMFlIcGw3QzZaejh4LXVDSmlkZk14dU4wWl9VWVk0LVh1NzBJOHE4TjNxWUczMF9ZZUxtaFNabm9iY1k1dlJaSzhXMVg5dTF0NnRBbDdKSjQ1TzI1bWxCZ0xNNFdOOWo4RUp5WjFhNjNfS2NlYVVqc2poX1JsaVVCWnZzclhOSWxQOXZLbjhnaE5MYWhSX3IwSXV1TWJPMnR2cTRDY0FFNHZlTDZaOEM0QVFCb0FZQ2dBZnctLThCcUFlT3podW9COVhKRzZnSGs5Z2JxQWVmMnh1b0I3b0dxQWZ3MlJ1b0JfTFpHNmdIcHI0YnFBZnMxUnVvQl9QUkc2Z0g3TlVicUFmQzJodllCd0hTQ0FrSWdPR0FFQkFCR0IzeUNCdGhaSGd0YzNWaWMzbHVMVGN5TmpNMU56TTBORFk0TURRd056aXhDVlYweFoxZmlMeG5nQW9EbUFzQnlBc0IyQk1DJnNpZ2g9VW8wem1NODRFNzAmY2lkPUNBUVNMUUNOSXJMTW5fYXhEZHVLazVzdDBlUGJMMHE2d282QlFGYXh3c1g2ZWRwbG5yTWM5dnFMUTZfUEFGNmNodyZjaWQ9Q0FRU0xRQ05JckxNbl9heERkdUtrNXN0MGVQYkwwcTZ3bzZCUUZheHdzWDZlZHBsbnJNYzl2cUxRNl9QQUY2Y2h3JmxhYmVsPSR7bGFiZWx9JmxhYmVsX2luc3RhbmNlPSR7bGFiZWxJbnN0YW5jZX0mY2J0PU5BVmtjR0g0ak5NSXZMeWlxOXdKRU9UcnJDWVloT0NxQVNJUmFXNW1ieTVwYm1adllteHZlQzVqYjIweUJ3Z0ZFeGpKUUJSQ0YyTmhMWEIxWWkwNU5qZzFOek0wTkRRMU5EYzJPREUwU0FCWUFuQUJnZ0VLbWZEWGhmel9fX19fQVFcIn0sXCJ0cmFuc3BvcnRcIjoge1wiYmVhY29uXCI6IGZhbHNlLFwieGhycG9zdFwiOiBmYWxzZSxcImltYWdlXCI6IHRydWV9LFwidHJpZ2dlcnNcIjoge1widHJhY2tNdXRlXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwibGFiZWxbZm9yPSdzcHIxJ11cIixcInJlcXVlc3RcIjogXCJyZXBvcnROb0xhYmVsSW5zdGFuY2VcIn0sXCJ0cmFja1JlcG9ydEFkXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwibGFiZWxbZm9yPSdzcHIyJ11cIixcInJlcXVlc3RcIjogXCJyZXBvcnRMYWJlbEluc3RhbmNlXCJ9LFwidHJhY2tTdXJ2ZXlSZXNwb25zZVwiOiB7XCJvblwiOiBcImNsaWNrXCIsXCJzZWxlY3RvclwiOiBcImxhYmVsW2Zvcj0nc3ByMyddXCIsXCJyZXF1ZXN0XCI6IFwicmVwb3J0TGFiZWxJbnN0YW5jZVwifSxcInRyYWNrV2h5VGhpc0FkXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwiI3NidG5cIixcInJlcXVlc3RcIjogXCJyZXBvcnRMYWJlbEluc3RhbmNlXCJ9fX08L3NjcmlwdD48L2FtcC1hbmFseXRpY3M%2BPGZvcm0gYWN0aW9uPVwiLy9nLmNvXCIgY2xhc3M9XCJzdiBqdCBhbXAtYW5pbWF0ZSBhYmdmIHBlblwiIGlkPVwibXRhXCIgdGFyZ2V0PVwiX2JsYW5rXCI%2BPGlucHV0IGlkPVwic3ByMFwiIG5hbWU9XCJhXCIgdHlwZT1cInJhZGlvXCI%2BPGlucHV0IGlkPVwic3ByMVwiIG5hbWU9XCJhXCIgdHlwZT1cInJhZGlvXCI%2BPGlucHV0IGlkPVwic3ByMlwiIG5hbWU9XCJhXCIgdHlwZT1cInJhZGlvXCI%2BPGlucHV0IGlkPVwic3ByM1wiIG5hbWU9XCJhXCIgdHlwZT1cInJhZGlvXCI%2BPGxhYmVsIGNsYXNzPVwiY2JiIHBlYVwiIGRhdGEtdmFycy1sYWJlbD1cInVzZXJfZmVlZGJhY2tfbWVudV9pbnRlcmFjdGlvblwiIGZvcj1cInNwcjFcIiBpZD1cImNiYlwiPjxzdmcgaGVpZ2h0PVwiMTVcIiB3aWR0aD1cIjE1XCIgeG1sbnM9XCIvL3d3dy53My5vcm&i=4-7&t=adltag_k7xey36s_BHZi6nD7QRU&r=1fe530d4e21edd38b46a4eb003c82ee&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-45.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Mar 2020 06:18:38 GMT
via: 1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
age: 28931
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
etag: "6b7395c9201aa64331475fddd24d987c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: shuJBc_VJuDFtK8ysQfvF9kWS-2bxZjPpVRuC2KvhJELveTPo6Keyw==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame D9C4 43 B
481 B 48ms
45ms Other
image/gif 13.224.194.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=cvMjAwMC9zdmdcIj48cGF0aCBkPVwiTTAsMGwxNSwwbDAsMTVsLTE1LDBaXCIgZmlsbD1cIiNjZGNjY2NcIj48L3BhdGg%2BPHBhdGggZD1cIk0zLjI1LDMuMjVsOC41LDguNU0xMS43NSwzLjI1bC04LjUsOC41XCIgc3Ryb2tlPVwiIzAwYWVjZFwiIHN0cm9rZS13aWR0aD1cIjEuMjVcIj48L3BhdGg%2BPC9zdmc%2BPC9sYWJlbD48ZGl2IGNsYXNzPVwicG4gYWJnZlwiIGlkPVwic3B2MVwiPjxhbXAtZml0LXRleHQgY2xhc3M9XCJmbCBpLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQgaS1hbXBodG1sLWVsZW1lbnQgaS1hbXBodG1sLW5vdGJ1aWx0IGFtcC1ub3RidWlsdCBhbXAtdW5yZXNvbHZlZCBpLWFtcGh0bWwtdW5yZXNvbHZlZFwiIGhlaWdodD1cIjYwMFwiIGktYW1waHRtbC1sYXlvdXQ9XCJyZXNwb25zaXZlXCIgbGF5b3V0PVwicmVzcG9uc2l2ZVwiIG1heC1mb250LXNpemU9XCIyMFwiIG1pbi1mb250LXNpemU9XCI4XCIgd2lkdGg9XCIzMDBcIj48aS1hbXBodG1sLXNpemVyIHN0eWxlPVwiZGlzcGxheTpibG9jaztwYWRkaW5nLXRvcDoyMDAuMDAwMCU7XCI%2BPC9pLWFtcGh0bWwtc2l6ZXI%2BPGRpdiBpZD1cInRpXCI%2BPHNwYW4gY2xhc3M9XCJjdFwiPkFkIGNsb3NlZCBieSA8c3ZnIGZpbGw9XCIjMDAwMDAwXCIgdmlld0JveD1cIjAgMCA2MCAyNFwiIHhtbG5zPVwiaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmdcIj48cGF0aCBkPVwiTTcuNSAxNi4yOWMtNC4wNyAwLTcuNDktMy4zMS03LjQ5LTcuMzhTMy40MyAxLjUzIDcuNSAxLjUzYzIuMjUgMCAzLjg1Ljg4IDUuMDYgMi4wM2wtMS40MiAxLjQyYy0uODctLjgxLTIuMDQtMS40NC0zLjY0LTEuNDQtMi45NyAwLTUuMjkgMi40LTUuMjkgNS4zN3MyLjMyIDUuMzcgNS4yOSA1LjM3YzEuOTMgMCAzLjAzLS43NyAzLjczLTEuNDguNTgtLjU4Ljk1LTEuNCAxLjEtMi41NEg3LjVWOC4yNGg2Ljc5Yy4wNy4zNi4xMS43OS4xMSAxLjI2IDAgMS41MS0uNDEgMy4zOS0xLjc1IDQuNzItMS4zIDEuMzUtMi45NSAyLjA3LTUuMTUgMi4wN3ptMTcuNzUtNC43NmMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEzLjA4IDBjMCAyLjc0LTIuMTMgNC43NS00Ljc1IDQuNzVzLTQuNzUtMi4wMi00Ljc1LTQuNzVjMC0yLjc1IDIuMTMtNC43NSA0Ljc1LTQuNzVzNC43NSAyIDQuNzUgNC43NXptLTIuMDggMGMwLTEuNzEtMS4yNC0yLjg4LTIuNjctMi44OHMtMi42NyAxLjE3LTIuNjcgMi44OGMwIDEuNjkgMS4yNCAyLjg4IDIuNjcgMi44OHMyLjY3LTEuMTggMi42Ny0yLjg4em0xMi41OC00LjQ2djguNTNjMCAzLjUxLTIuMDcgNC45NS00LjUyIDQuOTUtMi4zIDAtMy42OS0xLjU1LTQuMjEtMi44MWwxLjgyLS43NmMuMzIuNzcgMS4xMiAxLjY5IDIuMzkgMS42OSAxLjU3IDAgMi41NC0uOTcgMi41NC0yLjc5di0uNjhoLS4wN2MtLjQ3LjU4LTEuMzcgMS4wOC0yLjUgMS4wOC0yLjM4IDAtNC41Ni0yLjA3LTQuNTYtNC43NCAwLTIuNjggMi4xOC00Ljc3IDQuNTYtNC43NyAxLjEzIDAgMi4wMy41IDIuNSAxLjA2aC4wN3YtLjc2aDEuOTh6bS0xLjg0IDQuNDhjMC0xLjY3LTEuMTItMi45LTIuNTQtMi45LTEuNDQgMC0yLjY1IDEuMjItMi42NSAyLjkgMCAxLjY2IDEuMjEgMi44NiAyLjY1IDIuODYgMS40My4wMSAyLjU0LTEuMiAyLjU0LTIuODZ6bTUuODktOS41MlYxNmgtMi4wOVYyLjAzaDIuMDl6bTguNDkgMTEuMDdsMS42MiAxLjA4Yy0uNTIuNzctMS43OCAyLjExLTMuOTYgMi4xMS0yLjcgMC00LjcyLTIuMDktNC43Mi00Ljc1IDAtMi44MyAyLjAzLTQuNzUgNC40OC00Ljc1IDIuNDcgMCAzLjY3IDEuOTYgNC4wNyAzLjAybC4yMi41NC02LjM2IDIuNjNjLjQ5Ljk1IDEuMjQgMS40NCAyLjMgMS40NCAxLjA3IDAgMS44MS0uNTMgMi4zNS0xLjMyem0tNC45OS0xLjcxbDQuMjUtMS43NmMtLjIzLS41OS0uOTQtMS4wMS0xLjc2LTEuMDEtMS4wNiAwLTIuNTQuOTMtMi40OSAyLjc3elwiPjwvcGF0aD48cGF0aCBkPVwiTTAgMGg2MnYyNEgwelwiIGZpbGw9XCJub25lXCI%2BPC9wYXRoPjwvc3ZnPjwvc3Bhbj48L2Rpdj48ZGl2IGlkPVwiYnRuc1wiPjxsYWJlbCBkYXRhLXZhcnMtbGFiZWw9XCJ1c2VyX2ZlZWRiYWNrX21lbnVfb3B0aW9uXCIgZGF0YS12YXJzLWxhYmVsLWluc3RhbmNlPVwiMVwiIGZvcj1cInNwcjJcIj48YSBjbGFzcz1cImJ0blwiIGlkPVwicmJ0blwiPjxzcGFuPlJlcG9ydCB0aGlzIGFkPC9zcGFuPjwvYT48L2xhYmVsPjxsYWJlbD48YSBjbGFzcz1cImJ0blwiIGRhdGEtdmFycy1sYWJlbD1cImNsb3NlYnV0dG9uX3doeXRoaXNhZF9jbGlja1wiIGRhdGEtdmFycy1sYWJlbC1pbnN0YW5jZT1cIjFcIiBocmVmPVwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tL3doeXRoaXNhZD9yZWFzb25zPUFCM2FmR0VBQUFWU1cxdGJXMjUxYkd3c1d6SXNPU3d4TTEwc2JuVnNiQ3h1ZFd4c0xIUnlkV1ZkTEZ0dWRXeHNMQ0pvZEhSd2N6b3ZMMmR2YjJkc1pXRmtjeTVuTG1SdmRXSnNaV05zYVdOckxtNWxkQzl3WVdkbFlXUXZZMjl1ZG1WeWMybHZiaThfWVdrOVEyTXlaemhRYVRWNVdIQjZSRVp2WlhablFXVk9kMkkyUVVOUWJqQnNjRUpqZGt4NWFYRTVkMHBuV21aalgxQTRWMFZCUldjd1dXWlRTVWREVW1oSlEwRmZRbVZuUVdacFJHdFFORVI1UVVWRE5FRkpRWEZCVFVKNVFVMUpjV2RUWjBGclgxRnJNVzB5WmxwVU16RldRa3A0VWpGcFpVcENZelZsTlZsNlNpMHpSek5sWmpKSlpqaGxXakphUm5obGVFZFNTMGxUWjJaRVpWQXRjVTEzYkZsVVdIRTNZMGR2UjBkRlRreGhiVTgzWm1WWWJXcDBNRUZqVmxsUGVsUndaMEZEYzJabWRreHRjV2d4VkU1bFNFeFhUWEpVWW5WbE5HOXJORGRuTkRsaVZHTnhkMGhXY21kUVQxUmlSRWN3WjJ4U0xXNDRXVVpxVUVsTWFHaEVWalJGWmtVME5VMXpkWEpyZVhWT1luWmZVblZvUWpSdlJXdFRRWHBsYURGMlJWaHdRWEpUVFcwd01XMVRjbEYzZVdocU4wTlZXSEozY1VOdk5sRlFiVWhLTWtGWFJqTXdXVWh3YkRkRE5scDZPSGd0ZFVOS2FXUm1UWGgxVGpCYVgxVlpXVFF0V0hVM01FazRjVGhPTTNGWlJ6TXdYMWxsVEcxb1UxcHViMkpqV1RWMlVscExPRmN4V0RsMU1YUTJkRUZzTjBwS05EVlBNalZ0YkVKblRFMDBWMDQ1YWpoRlNubGFNV0UyTTE5TFkyVmhWV3B6YW1oZlVteHBWVUphZG5OeVdFNUpiRkE1ZGt0dU9HZG9Ua3hoYUZKZmNqQkpkWFZOWWs4eWRIWnhORU5qUVVVMGRtVk1ObG80UXpSQlVVSnZRVmxEWjBGbWR5MHRPRUp4UVdWUGVtaDFiMEk1V0VwSE5tZElhemxuWW5GQlpXWXllSFZ2UWpkdlIzRkJabmN5VW5WdlFsOU1Xa2MyWjBod2NqUmljVUZtY3pGU2RXOUNYMUJTUnpablNEZE9WV0p4UVdaRE1taDJXVUozU0ZORFFXdEpaMDlIUVVWQ1FVSkhRak41UTBKMGFGcElaM1JqTTFacFl6TnNkVXhVWTNsT2FrMHhUbnBOTUU1RVdUUk5SRkYzVG5wcGVFTldWakI0V2pGbWFVeDRibWRCYjBSdFFYTkNlVUZ6UWpKQ1RVTmNkVEF3TWpaemFXZG9QVlZ2TUhwdFRUZzBSVGN3WEhVd01ESTJZMmxrUFVOQlVWTk1VVU5PU1hKTVRXNWZZWGhFWkhWTGF6VnpkREJsVUdKTU1IRTJkMjgyUWxGR1lYaDNjMWcyWldSd2JHNXlUV001ZG5GTVVUWmZVRUZHTm1Ob2R5SXNXMjUxYkd3c2JuVnNiQ3h1ZFd4c0xDSm9kSFJ3Y3pvdkwyUnBjM0JzWVhsaFpITXRabTl5YldGMGN5NW5iMjluYkdWMWMyVnlZMjl1ZEdWdWRDNWpiMjB2WVdSekwzQnlaWFpwWlhjdlkyOXVkR1Z1ZEM1cWN6OWpiR2xsYm5ROWQzUmhYSFV3TURJMmIySm1kWE5qWVhSbFpFTjFjM1J2YldWeVNXUTlOakE1T0RVNU9EWXlPRngxTURBeU5tTnlaV0YwYVhabFNXUTlNemd3TWpNMk1qZ3pNalV4WEhVd01ESTJkbVZ5YzJsdmJrbGtQVEJjZFRBd01qWmhaRWR5YjNWd1EzSmxZWFJwZG1WSlpEMHpNelF3TWpRME5EazFPVFpjZFRBd01qWm9kRzFzVUdGeVpXNTBTV1E5Y0hKbGRpMHdYSFV3TURJMmFHVnBaMmgwUFRZd01GeDFNREF5Tm5kcFpIUm9QVE13TUZ4MU1EQXlObk5wWnoxQlEybFdRbDkzYkVScVZVOVZXVWcwVTJKMmMzWnhORXRRVEc5MlZtNUZaWGwzSWwwc2JuVnNiQ3h1ZFd4c0xERXNJazVCVm10alIwZzBhazVOU1haTWVXbHhPWGRLUlU5VWNuSkRXVmxvVDBOeFFWTkpVbUZYTlcxaWVUVndZbTFhZGxsdGVIWmxRelZxWWpJd2VVSjNaMFpGZUdwS1VVSlNRMFl5VG1oTVdFSXhXV2t3TlU1cVp6Rk9lazB3VGtSUk1VNUVZekpQUkVVd1UwRkNXVUZ1UVVKblowVkxiV1pFV0dobWVsOWZYMTlmUVZFaUxDSTRNRFF5TmpRMk9DSmRYVjBzV3pFc01WMWRCdHhIVm5iQXk3MmwtTWlob05fOW4zbkJnT2w2VU1pTTJJRmVMLXd3eVhjM1ZLRF9fdXhCUjRycmhleXlhNzIzRDNHZXBrMzctR3VJUmJpNDR1emdGNzh2VmIyX01PODl3Vk5pMkR4dHdmSHpILVZ0M1lzVzhsWVI4TndnNllXWHlMMVc3a0h2c3NlMTgxUkVxZnNFS1dLcklWRUkzRzVSQWJFUUxHSUtOLUN0N21uemEwWC1WcTdDM21uaTdUaHR0a0dYNzlLTHUxT2tFTnEtRTFGUjF1dGhiaWRHa0JIT2N1VTZ6VWc1em5uVmUtWEp1OEZWMm1tT3ZNX1lpZm15RXNxVjNzZEkxa2ZVWXJlZ19QdThwS20yZU5aczczMUUzcVg3V1piOGxTeUJGWEJlaGhZQ2IwY0NtNXZDWk9tc01qUk0wZk1GM0FlaDRvNDlaMXFRdncsNVViSHhIMVQ5cU1xMFFLV3BTY1hTdyZhbXA7c291cmNlPWRpc3BsYXlcIiBpZD1cInNidG5cIiB0YXJnZXQ9XCJfYmxhbmtcIj48c3Bhbj5XaHkgdGhpcyBhZD8mbmJzcDs8c3ZnIGZpbGw9XCIjMDAwMDAwXCIgaWQ9XCJzaVwiIHZpZXdCb3g9XCIwIDAgMTYgMTZcIiB4bWxucz1cIi8vd3d3LnczLm9yZy8yMDAwL3N2Z1wiPjxjaXJjbGUgY3g9XCI2XCIgY3k9XCI2XCIgcj1cIjAuNjdcIj48L2NpcmNsZT48cGF0aCBkPVwiTTQuMiwxMS4zUTMuMywxMS44LDMuMywxMC43NUwzLjMsNC4xUTMuMywzLjEsNC4zLDMuNUwxMC40LDcuMFExMi4wLDcuNSwxMC40LDguMEw2LjY1LDEwLjBMNi42NSw3Ljc1YTAuNjUsMC42NSwwLDEsMCwtMS4zLDBMNS4zNSwxMC43NWEwLjksMC45LDAsMCwwLDEuMywwLjhMMTIuNyw4LjJRMTMuNyw3LjUsMTIuNyw2LjdMMy4zLDEuNlEyLjIsMS4zLDEuOCwyLjVMMS44LDEyLjVRMi4yLDEzLjksMy4zLDEzLjNMNC44LDEyLjVBMC4zLDAuMywwLDEsMCw0LjIsMTEuM1pcIj48L3BhdGg%2BPC9zdmc%2BPC9zcGFuPjwvYT48L2xhYmVsPjwvZGl2PjwvYW1wLWZpdC10ZXh0PjwvZGl2PjxkaXYgY2xhc3M9XCJwbiBhYmdmXCIgaWQ9XCJzcHYyXCI%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9XCJtdXRlX3N1cnZleV9vcHRpb25cIiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9XCI3XCIgZm9yPVwic3ByM1wiPjxkaXY%2BPHNwYW4%2BTm90IGludGVyZXN0ZWQgaW4gdGhpcyBhZDwvc3Bhbj48L2Rpdj48L2xhYmVsPjxsYWJlbCBjbGFzcz1cInNiIHNvXCIgZGF0YS12YXJzLWxhYmVsPVwibXV0ZV9zdXJ2ZXlfb3B0aW9uXCIgZGF0YS12YXJzLWxhYmVsLWluc3RhbmNlPVwiOFwiIGZvcj1cInNwcjNcIj48ZGl2PjxzcGFuPkFkIHdhcyBpbmFwcHJvcHJpYXRlPC9zcGFuPjwvZGl2PjwvbGFiZWw%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9XCJtdXRlX3N1cnZleV9vcHRpb25cIiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9XCIzXCIgZm9yPVwic3ByM1wiPjxkaXY%2BPHNwYW4%2BQWQgY292ZXJlZCBjb250ZW50PC9zcGFuPjwvZGl2PjwvbGFiZWw%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9XCJtdXRlX3N1cnZleV9vcHRpb25cIiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9XCIyXCIgZm9yPVwic3ByM1wiPjxkaXY%2BPHNwYW4%2BU2VlbiB0aGlzIGFkIG11bHRpcGxlIHRpbWVzPC9zcGFuPjwvZGl2PjwvbGFiZWw%2BPC9k&i=5-7&t=adltag_k7xey36s_BHZi6nD7QRU&r=1fe530d4e21edd38b46a4eb003c82ee&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-45.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Mar 2020 06:18:38 GMT
via: 1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
age: 28931
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
etag: "6b7395c9201aa64331475fddd24d987c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: H3O_FbwAbBWwGVQqPtiAsG8x25NYlR2vIqizt6uYOKmZHhH0NzfgMQ==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame D9C4 43 B
480 B 57ms
54ms Other
image/gif 13.224.194.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=aXY%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1cInNwdjNcIj48YW1wLWZpdC10ZXh0IGNsYXNzPVwiZmwgaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50IGktYW1waHRtbC1ub3RidWlsdCBhbXAtbm90YnVpbHQgYW1wLXVucmVzb2x2ZWQgaS1hbXBodG1sLXVucmVzb2x2ZWRcIiBoZWlnaHQ9XCI2MDBcIiBpLWFtcGh0bWwtbGF5b3V0PVwicmVzcG9uc2l2ZVwiIGxheW91dD1cInJlc3BvbnNpdmVcIiBtYXgtZm9udC1zaXplPVwiMTdcIiBtaW4tZm9udC1zaXplPVwiOFwiIHdpZHRoPVwiMzAwXCI%2BPGktYW1waHRtbC1zaXplciBzdHlsZT1cImRpc3BsYXk6YmxvY2s7cGFkZGluZy10b3A6MjAwLjAwMDAlO1wiPjwvaS1hbXBodG1sLXNpemVyPjxzcGFuIGlkPVwicGN0XCI%2BVGhhbmtzLiBGZWVkYmFjayBpbXByb3ZlcyBHb29nbGUgYWRzPC9zcGFuPjwvYW1wLWZpdC10ZXh0PjwvZGl2PjxkaXYgY2xhc3M9XCJwbiBhYmdmXCIgaWQ9XCJzcHY0XCI%2BPGFtcC1maXQtdGV4dCBjbGFzcz1cImZsIGktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZCBpLWFtcGh0bWwtZWxlbWVudCBpLWFtcGh0bWwtbm90YnVpbHQgYW1wLW5vdGJ1aWx0IGFtcC11bnJlc29sdmVkIGktYW1waHRtbC11bnJlc29sdmVkXCIgaGVpZ2h0PVwiNjAwXCIgaS1hbXBodG1sLWxheW91dD1cInJlc3BvbnNpdmVcIiBsYXlvdXQ9XCJyZXNwb25zaXZlXCIgbWF4LWZvbnQtc2l6ZT1cIjIwXCIgbWluLWZvbnQtc2l6ZT1cIjhcIiB3aWR0aD1cIjMwMFwiPjxpLWFtcGh0bWwtc2l6ZXIgc3R5bGU9XCJkaXNwbGF5OmJsb2NrO3BhZGRpbmctdG9wOjIwMC4wMDAwJTtcIj48L2ktYW1waHRtbC1zaXplcj48c3BhbiBjbGFzcz1cImN0IGZjdFwiPkFkIGNsb3NlZCBieSA8c3ZnIGZpbGw9XCIjMDAwMDAwXCIgdmlld0JveD1cIjAgMCA2MCAyNFwiIHhtbG5zPVwiaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmdcIj48cGF0aCBkPVwiTTcuNSAxNi4yOWMtNC4wNyAwLTcuNDktMy4zMS03LjQ5LTcuMzhTMy40MyAxLjUzIDcuNSAxLjUzYzIuMjUgMCAzLjg1Ljg4IDUuMDYgMi4wM2wtMS40MiAxLjQyYy0uODctLjgxLTIuMDQtMS40NC0zLjY0LTEuNDQtMi45NyAwLTUuMjkgMi40LTUuMjkgNS4zN3MyLjMyIDUuMzcgNS4yOSA1LjM3YzEuOTMgMCAzLjAzLS43NyAzLjczLTEuNDguNTgtLjU4Ljk1LTEuNCAxLjEtMi41NEg3LjVWOC4yNGg2Ljc5Yy4wNy4zNi4xMS43OS4xMSAxLjI2IDAgMS41MS0uNDEgMy4zOS0xLjc1IDQuNzItMS4zIDEuMzUtMi45NSAyLjA3LTUuMTUgMi4wN3ptMTcuNzUtNC43NmMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEzLjA4IDBjMCAyLjc0LTIuMTMgNC43NS00Ljc1IDQuNzVzLTQuNzUtMi4wMi00Ljc1LTQuNzVjMC0yLjc1IDIuMTMtNC43NSA0Ljc1LTQuNzVzNC43NSAyIDQuNzUgNC43NXptLTIuMDggMGMwLTEuNzEtMS4yNC0yLjg4LTIuNjctMi44OHMtMi42NyAxLjE3LTIuNjcgMi44OGMwIDEuNjkgMS4yNCAyLjg4IDIuNjcgMi44OHMyLjY3LTEuMTggMi42Ny0yLjg4em0xMi41OC00LjQ2djguNTNjMCAzLjUxLTIuMDcgNC45NS00LjUyIDQuOTUtMi4zIDAtMy42OS0xLjU1LTQuMjEtMi44MWwxLjgyLS43NmMuMzIuNzcgMS4xMiAxLjY5IDIuMzkgMS42OSAxLjU3IDAgMi41NC0uOTcgMi41NC0yLjc5di0uNjhoLS4wN2MtLjQ3LjU4LTEuMzcgMS4wOC0yLjUgMS4wOC0yLjM4IDAtNC41Ni0yLjA3LTQuNTYtNC43NCAwLTIuNjggMi4xOC00Ljc3IDQuNTYtNC43NyAxLjEzIDAgMi4wMy41IDIuNSAxLjA2aC4wN3YtLjc2aDEuOTh6bS0xLjg0IDQuNDhjMC0xLjY3LTEuMTItMi45LTIuNTQtMi45LTEuNDQgMC0yLjY1IDEuMjItMi42NSAyLjkgMCAxLjY2IDEuMjEgMi44NiAyLjY1IDIuODYgMS40My4wMSAyLjU0LTEuMiAyLjU0LTIuODZ6bTUuODktOS41MlYxNmgtMi4wOVYyLjAzaDIuMDl6bTguNDkgMTEuMDdsMS42MiAxLjA4Yy0uNTIuNzctMS43OCAyLjExLTMuOTYgMi4xMS0yLjcgMC00LjcyLTIuMDktNC43Mi00Ljc1IDAtMi44MyAyLjAzLTQuNzUgNC40OC00Ljc1IDIuNDcgMCAzLjY3IDEuOTYgNC4wNyAzLjAybC4yMi41NC02LjM2IDIuNjNjLjQ5Ljk1IDEuMjQgMS40NCAyLjMgMS40NCAxLjA3IDAgMS44MS0uNTMgMi4zNS0xLjMyem0tNC45OS0xLjcxbDQuMjUtMS43NmMtLjIzLS41OS0uOTQtMS4wMS0xLjc2LTEuMDEtMS4wNiAwLTIuNTQuOTMtMi40OSAyLjc3elwiPjwvcGF0aD48cGF0aCBkPVwiTTAgMGg2MnYyNEgwelwiIGZpbGw9XCJub25lXCI%2BPC9wYXRoPjwvc3ZnPjwvc3Bhbj48L2FtcC1maXQtdGV4dD48L2Rpdj48L2Zvcm0%2BPC9kaXY%2BPC9kaXY%2BPC9kaXY%2BPGFtcC1hbmFseXRpY3MgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIGktYW1waHRtbC1lbGVtZW50IGktYW1waHRtbC1ub3RidWlsdCBhbXAtbm90YnVpbHQgYW1wLXVucmVzb2x2ZWQgaS1hbXBodG1sLXVucmVzb2x2ZWRcIiBpLWFtcGh0bWwtbGF5b3V0PVwiZml4ZWRcIiBzdHlsZT1cIndpZHRoOjFweDtoZWlnaHQ6MXB4O1wiIHRyaWdnZXI9XCJpbW1lZGlhdGVcIj48c2NyaXB0IHR5cGU9XCJhcHBsaWNhdGlvbi9qc29uXCI%2Be1widHJhbnNwb3J0XCI6IHtcImJlYWNvblwiOiBmYWxzZSwgXCJ4aHJwb3N0XCI6IGZhbHNlfSxcInJlcXVlc3RzXCI6IHtcInZpc2liaWxpdHkxXCI6IFwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wY3MvYWN0aXZldmlldz94YWk9QUtBT2pzdGViMnQwQ2ZyQlJYQkU3SHlRcXkwSnFib0FYei1iMDZRUUdPSEtjcHAxcHdCdEVmWGhlLVN4MGtfSmQ3eWprdHRzcHV6WmpLVUNkd2UwRHduWDliSG9XakZsWUVSZzVGZ2Vsb29yUk83MFgtWC1OSjhZNE1HV240dC02ZyZzYWk9QU1mbC1ZU2NFbzVWTFBPRWd1REhDZ0ZLVXk0MW9IT3c0Q3JCSkh3TEZVWDBBRUhzVXc3bGJzSl9SNnNhN0dKeWJMTXNaY1FFUmtva3VmX0RYYTdiQkcwYlgtVHBBLW5TTXhmcm9mOFZxSkozJnNpZz1DZzBBcktKU3pNczU5QUxLRFJPOUVBRSZpZD1hbXBpbSZvPSR7ZWxlbWVudFh9LCR7ZWxlbWVudFl9JmQ9JHtlbGVtZW50V2lkdGh9LCR7ZWxlbWVudEhlaWdodH0mc3M9JHtzY3JlZW5XaWR0aH0sJHtzY3JlZW5IZWlnaHR9JmJzPSR7dmlld3BvcnRXaWR0aH0sJHt2aWV3cG9ydEhlaWdodH0mbWN2dD0ke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mbXRvcz0wLDAsJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9LCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mdG9zPTAsMCwke3RvdGFsVmlzaWJsZVRpbWV9LDAsMCZ0ZnM9JHtmaXJzdFNlZW5UaW1lfSZ0bHM9JHtsYXN0U2VlblRpbWV9Jmc9JHttaW5WaXNpYmxlUGVyY2VudGFnZX0maD0ke21heFZpc2libGVQZXJjZW50YWdlfSZ0dD0ke3RvdGFsVGltZX0mcj12JmFkaz0zNzUzODk4MTImYXZtcz1hbXBhXCJ9LFwidHJpZ2dlcnNcIjoge1wiY29udGludW91c1Zpc2libGVcIjoge1wib25cIjogXCJ2aXNpYmxlXCIsXCJyZXF1ZXN0XCI6IFtcInZpc2liaWxpdHkxXCJdLFwicGFyZW50UG9zdE1lc3NhZ2VcIjogXCJpbXByZXNzaW9uLXZpZXdhYmxlXCIsXCJ2aXNpYmlsaXR5U3BlY1wiOiB7XCJzZWxlY3RvclwiOiBcIjpyb290XCIsXCJ2aXNpYmxlUGVyY2VudGFnZU1pblwiOiA1MCxcImNvbnRpbnVvdXNUaW1lTWluXCI6IDEwMDB9fSxcInZpc2liaWxpdHlDaGFuZ2VkXCI6IHtcIm9uXCI6IFwidmlzaWJsZVwiLFwicGFyZW50UG9zdE1lc3NhZ2VcIjogXCJ2aXNpYmlsaXR5LWNoYW5nZWQtJHtpbnRlcnNlY3Rpb25SYXRpb31cIixcInZpc2liaWxpdHlTcGVjXCI6IHtcInJlcGVhdFwiOiB0cnVlLFwic2VsZWN0b3JcIjogXCI6cm9vdFwiLFwidmlzaWJsZVBlcmNlbnRhZ2VUaHJlc2hvbGRzXCI6IFtbMCwwXSxbMCw1XSxbNSwxMF0sWzEwLDE1XSxbMTUsMjBdLFsyMCwyNV0sWzI1LDMwXSxbMzAsMzVdLFszNSw0MF0sWzQwLDQ1XSxbNDUsNTBdLFs1MCw1NV0sWzU1LDYwXSxbNjAsNjVdLFs2NSw3MF0sWzcwLDc1XSxbNzUsODBdLFs4MCw4NV0sWzg1LDkwXSxbOTAsOTVdLFs5NSwxMDBdLFsxMDAsMTAwXV19fSxcImluaUxvYWRcIjoge1wib25cIjogXCJpbmktbG9hZFwiLFwicGFyZW50UG9zdE1lc3NhZ2VcIjogXCJ7XFxcImNcXFwiOlxcXCJzZmNoYW5uZWwzXFxcIixcXFwicFxcXCI6XFxcIntcXFxcXFxcInVpZFxcXFxcXFwiOlxcXFxcXFwiM1xcXFxcXFwiLFxcXFxcXFwid2lkdGhcXFxcXFxcIjoke3Njcm9sbFdpZHRofSxcXFxcXFxcImhlaWdodFxcXFxcXFwiOiR7c2Nyb2xsSGVpZ2h0fX1cXFwiLFxcXCJzXFxcIjpcXFwiY3JlYXRpdmVfZ2VvbWV0cnlfdXBkYXRlXFxcIn1cXG5cIn19fTwvc2NyaXB0PjwvYW1wLWFuYWx5dGljcz48YW1wLWFuYWx5dGljcyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQgaS1hbXBodG1sLWVsZW1lbnQgaS1hbXBodG1sLW5vdGJ1aWx0IGFtcC1ub3RidWlsdCBhbXAtdW5yZXNvbHZlZCBpLWFtcGh0bWwtdW5yZXNvbHZlZFwiIGktYW1waHRtbC1sYXlvdXQ9XCJmaXhlZFwiIHN0eWxlPVwid2lkdGg6MXB4O2hlaWdodDoxcHg7XCIgdHJpZ2dlcj1cImltbWVkaWF0ZVwiPjxzY3JpcHQgdHlwZT1cImFwcGxpY2F0aW9uL2pzb25cIj57XCJ0cmFuc3BvcnRcIjoge1wiYmVhY29uXCI6IHRydWUsIFwieGhycG9zdFwiOiBmYWxzZX0sXCJyZXF1ZXN0c1wiOiB7XCJhbXBlb3NcIjogXCJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3Bjcy9hY3RpdmV2aWV3P3hhaT1BS0FPanN0ZWIydDBDZnJCUlhCRTdIeVFxeTBKcWJvQVh6LWIwNlFRR09IS2NwcDFwd0J0RWZYaGUtU3gwa19KZDd5amt0dHNwdXpaaktVQ2R3ZTBEd25YOWJIb1dqRmxZRVJnNUZnZWxvb3JSTzcwWC1YLU5KOFk0TUdXbjR0LTZnJnNhaT1BTWZsLVlTY0VvNVZMUE9FZ3VESENnRktVeTQxb0hPdzRDckJKSHdMRlVYMEFFSHNVdzdsYnNKX1I2c2E3R0p5YkxNc1pjUUVSa29rdWZfRFhhN2JCRzBiWC1UcEEtblNNeGZyb2Y4VnFKSjMmc2lnPUNnMEFyS0pTek1zNTlBTEtEUk85RUFFJmlkPWFtcGVvcyZvPSR7ZWxlbWVudFh9LCR7ZWxlbWVudFl9JmQ9JHtlbGVtZW50V2lkdGh9LCR7ZWxlbWVudEhlaWdodH0mc3M9JHtzY3JlZW5XaWR0aH0sJHtzY3JlZW5IZWlnaHR9JmJzPSR7dmlld3BvcnRXaWR0aH0sJHt2aWV3cG9ydEhlaWdodH0mbWN2dD0ke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mbXRvcz0wLDAsJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9LCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mdG9zPTAsMCwke3RvdGFsVmlzaWJsZVRpbWV9LDAsMCZ0ZnM9JHtmaXJzdFNlZW5UaW1lfSZ0bHM9JHtsYXN0U2VlblRpbWV9Jmc9JHttaW5WaXNpYmxlUGVyY2VudGFnZX0maD0ke21heFZpc2libGVQZXJjZW50YWdlfSZwdD0ke3BhZ2VMb2FkVGltZX0mdHQ9JHt0b3RhbFRpbWV9JnJwdD0ke25hdlRpbWluZyhuYXZpZ2F0aW9uU3RhcnQsbG9hZEV2ZW50U3RhcnQpfSZyc3Q9JHtuYXZUaW1pbmcobmF2aWdhdGlvblN0YXJ0KX0mcj1kZSZpc2Q9JHtpbml0aWFsU2Nyb2xsRGVwdGh9Jm1zZD0ke21heFNjcm9sbERlcHRofVwifSxcInRyaWdnZXJzXCI6IHtcImVuZE9mU2Vzc2lvblwiOiB7XCJvblwiOiBcInZpc2libGVcIixcInJlcXVlc3RcIjogXCJhbXBlb3NcIixcInZpc2liaWxpdHlTcGVjXCI6IHtcInJlcG9ydFdo&i=6-7&t=adltag_k7xey36s_BHZi6nD7QRU&r=1fe530d4e21edd38b46a4eb003c82ee&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-45.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Mar 2020 06:18:38 GMT
via: 1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
age: 28931
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
etag: "6b7395c9201aa64331475fddd24d987c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: 92uM2pPZe5jGsYsr8BUF1wl-A1bGtiqiSNSU777dhQN5SenWzxhNLA==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame D9C4 43 B
482 B 58ms
55ms Other
image/gif 13.224.194.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=ZW5cIjogXCJkb2N1bWVudEV4aXRcIixcInNlbGVjdG9yXCI6IFwiOnJvb3RcIixcInZpc2libGVQZXJjZW50YWdlTWluXCI6IDUwfX19fTwvc2NyaXB0PjwvYW1wLWFuYWx5dGljcz48ZGl2IHN0eWxlPVwiYm90dG9tOjA7cmlnaHQ6MDt3aWR0aDozMDBweDtoZWlnaHQ6NjAwcHg7YmFja2dyb3VuZDppbml0aWFsO3Bvc2l0aW9uOmFic29sdXRlO21heC13aWR0aDoxMDAlO21heC1oZWlnaHQ6MTAwJTtwb2ludGVyLWV2ZW50czpub25lO2ltYWdlLXJlbmRlcmluZzpwaXhlbGF0ZWQ7ei1pbmRleDoyMTQ3NDgzNjQ3O2JhY2tncm91bmQtaW1hZ2U6dXJsKCdkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUNzQUFBQVdCQU1BQUFDcmwzaUFBQUFBQmxCTVZFVUFBQUQrQWNpV21aeldBQUFBQW5SU1RsTUFBcGlkckJRQUFBQjhTVVJCVkJqVGJWRUJFc0FnQ05JZjhQL1hib3FpdFZubjhrSkNadllmem9oVExGWElXK2pMbklnM2M2c0tISkNaUGF6bXZ2aUZOdlVzN25yYkx5VVR3S1hiZG9PNVlFdEZsU200d2VhY1lJdkFtamg0dVh0V081U2cyYk5KdXVtaXVKZHpOTWF3WERqWVB3N1dFNE1teWtlQmRCUXgxci9rckQzb0F4dURCWHdWWit0MEFBQUFBRWxGVGtTdVFtQ0MnKTtcIj48L2Rpdj48YW1wLXBpeGVsIGFsbG93LXNzci1pbWc9XCJcIiBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQgaS1hbXBodG1sLWVsZW1lbnRcIiBpLWFtcGh0bWwtbGF5b3V0PVwiZml4ZWRcIiBpLWFtcGh0bWwtc3NyPVwiXCIgc3JjPVwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2Fkdmlldz9haT1DYTRTS1BpNXlYcHpERm9ldmdBZU53YjZBQ1BuMGxwQmN2THlpcTl3SmdaZmNfUDhXRUFFZzBZZlNJR0NSaElDQV9CZWdBZmlEa1A0RHlBRUM0QUlBcUFNQnlBTUlxZ1NkQWtfUWsxbTJmWlQzMVZCSnhSMWllSkJjNWU1WXpKLTNHM2VmMklmOGVaMlpGeGV4R1JLSVNnZkRlUC1xTXdsWVRYcTdjR29HR0VOTGFtTzdmZVhtanQwQWNWWU96VHBnQUNzZmZ2TG1xaDFUTmVITFdNclRidWU0b2s0N2c0OWJUY3F3SFZyZ1BPVGJERzBnbFItbjhZRmpQSUxoaERWNEVmRTQ1TXN1cmt5dU5idl9SdWhCNG9Fa1NBemVoMXZFWHBBclNNbTAxbVNyUXd5aGo3Q1VYcndxQ282UVBtSEoyQVdGMzBZSHBsN0M2Wno4eC11Q0ppZGZNeHVOMFpfVVlZNC1YdTcwSThxOE4zcVlHMzBfWWVMbWhTWm5vYmNZNXZSWks4VzFYOXUxdDZ0QWw3Sko0NU8yNW1sQmdMTTRXTjlqOEVKeVoxYTYzX0tjZWFVanNqaF9SbGlVQlp2c3JYTklsUDl2S2owaWlrQWtLb3lsWVJqZ2xnN2hGY0FFNHZlTDZaOEM0QVFCa2dVRUNBUVlBWklGQkFnRkdBU2dCZ0tBQl9ENzd3R29CNDdPRzZnSDFja2JxQWVUMkJ1b0I1X2JHNmdIdWdhb0JfRFpHNmdIOHRrYnFBZW12aHVvQi16Vkc5Z0hBZklIQkJELXB4elNDQWtJZ09HQUVCQUJHQjN5Q0J0aFpIZ3RjM1ZpYzNsdUxUY3lOak0xTnpNME5EWTRNRFF3TnppQUNnUElDd0hZRXdJJmFtcDtzaWdoPXVxamc2M1BjWmxBJmFtcDt0cGQ9QUdXaEptdTB1SmdPVXg2QU9VeEFsUEV1R0xRYjFtNWhwQS1iWlNwbXA1Um1PbHpKWEFcIiBzdHlsZT1cIndpZHRoOjFweDtoZWlnaHQ6MXB4O1wiIGFyaWEtaGlkZGVuPVwidHJ1ZVwiPjxpbWcgc3JjPVwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2Fkdmlldz9haT1DYTRTS1BpNXlYcHpERm9ldmdBZU53YjZBQ1BuMGxwQmN2THlpcTl3SmdaZmNfUDhXRUFFZzBZZlNJR0NSaElDQV9CZWdBZmlEa1A0RHlBRUM0QUlBcUFNQnlBTUlxZ1NkQWtfUWsxbTJmWlQzMVZCSnhSMWllSkJjNWU1WXpKLTNHM2VmMklmOGVaMlpGeGV4R1JLSVNnZkRlUC1xTXdsWVRYcTdjR29HR0VOTGFtTzdmZVhtanQwQWNWWU96VHBnQUNzZmZ2TG1xaDFUTmVITFdNclRidWU0b2s0N2c0OWJUY3F3SFZyZ1BPVGJERzBnbFItbjhZRmpQSUxoaERWNEVmRTQ1TXN1cmt5dU5idl9SdWhCNG9Fa1NBemVoMXZFWHBBclNNbTAxbVNyUXd5aGo3Q1VYcndxQ282UVBtSEoyQVdGMzBZSHBsN0M2Wno4eC11Q0ppZGZNeHVOMFpfVVlZNC1YdTcwSThxOE4zcVlHMzBfWWVMbWhTWm5vYmNZNXZSWks4VzFYOXUxdDZ0QWw3Sko0NU8yNW1sQmdMTTRXTjlqOEVKeVoxYTYzX0tjZWFVanNqaF9SbGlVQlp2c3JYTklsUDl2S2owaWlrQWtLb3lsWVJqZ2xnN2hGY0FFNHZlTDZaOEM0QVFCa2dVRUNBUVlBWklGQkFnRkdBU2dCZ0tBQl9ENzd3R29CNDdPRzZnSDFja2JxQWVUMkJ1b0I1X2JHNmdIdWdhb0JfRFpHNmdIOHRrYnFBZW12aHVvQi16Vkc5Z0hBZklIQkJELXB4elNDQWtJZ09HQUVCQUJHQjN5Q0J0aFpIZ3RjM1ZpYzNsdUxUY3lOak0xTnpNME5EWTRNRFF3TnppQUNnUElDd0hZRXdJJmFtcDtzaWdoPXVxamc2M1BjWmxBJmFtcDt0cGQ9QUdXaEptdTB1SmdPVXg2QU9VeEFsUEV1R0xRYjFtNWhwQS1iWlNwbXA1Um1PbHpKWEFcIj48L2FtcC1waXhlbD48YW1wLWFkLWV4aXQgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lciBpLWFtcGh0bWwtZWxlbWVudCBpLWFtcGh0bWwtbm90YnVpbHQgYW1wLW5vdGJ1aWx0IGFtcC11bnJlc29sdmVkIGktYW1waHRtbC11bnJlc29sdmVkXCIgaS1hbXBodG1sLWxheW91dD1cImNvbnRhaW5lclwiIGlkPVwiZXhpdC1hcGlcIj48c2NyaXB0IHR5cGU9XCJhcHBsaWNhdGlvbi9qc29uXCI%2Be1wiZmlsdGVyc1wiOnt9LFwib3B0aW9uc1wiOntcInN0YXJ0VGltaW5nRXZlbnRcIjpcIm5hdmlnYXRpb25TdGFydFwifSxcInRhcmdldHNcIjp7XCJsYW5kaW5nUGFnZVwiOntcImZpbHRlcnNcIjpbXSxcImZpbmFsVXJsXCI6XCJodHRwczovL2luZm8uaW5mb2Jsb3guY29tL1dXLVBQQy1GWTIwLUNTQUR1bW1pZXMtMjAxOTA4MDEuaHRtbD9zcz1nb29nbGVcXHUwMDI2c3Q9Y2xvdWQlMjBjeWJlciUyMHNlY3VyaXR5XFx1MDAyNmdjbGlkPUVBSWFJUW9iQ2hNSW5OcjhrSnlrNkFJVmh4ZmdDaDJOb0EtQUVBRVlBU0FBRWdJck1fRF9Cd0VcIixcInRyYWNraW5nVXJsc1wiOltcImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L2FjbGs%2Fc2E9bFxcdTAwMjZhaT1DYzJnOFBpNXlYcHpERm9ldmdBZU53YjZBQ1BuMGxwQmN2THlpcTl3SmdaZmNfUDhXRUFFZzBZZlNJR0NSaElDQV9CZWdBZmlEa1A0RHlBRUM0QUlBcUFNQnlBTUlxZ1NnQWtfUWsxbTJmWlQzMVZCSnhSMWllSkJjNWU1WXpKLTNHM2VmMklmOGVaMlpGeGV4R1JLSVNnZkRlUC1xTXdsWVRYcTdjR29HR0VOTGFtTzdmZVhtanQwQWNWWU96VHBnQUNzZmZ2TG1xaDFUTmVITFdNclRidWU0b2s0N2c0OWJUY3F3SFZyZ1BPVGJERzBnbFItbjhZRmpQSUxoaERWNEVmRTQ1TXN1cmt5dU5idl9SdWhCNG9Fa1NBemVoMXZFWHBBclNNbTAxbVNyUXd5aGo3Q1VYcndxQ282UVBtSEoyQVdGMzBZSHBsN0M2Wno4eC11Q0ppZGZNeHVOMFpfVVlZNC1YdTcwSThxOE4zcVlHMzBfWWVMbWhTWm5vYmNZNXZSWks4VzFYOXUxdDZ0QWw3Sko0NU8yNW1sQmdMTTRXTjlqOEVKeVoxYTYzX0tjZWFVanNqaF9SbGlVQlp2c3JYTklsUDl2S244Z2hOTGFoUl9yMEl1dU1iTzJ0dnE0Q2NBRTR2ZUw2WjhDNEFRQm9BWUNnQWZ3LS04QnFBZU96aHVvQjlYSkc2Z0hrOWdicUFlZjJ4dW9CN29HcUFmdzJSdW9CX0xaRzZnSHByNGJxQWZzMVJ1b0JfUFJHNmdIN05VYnFBZkMyaHZZQndIU0NBa0lnT0dBRUJBQkdCM3lDQnRoWkhndGMzVmljM2x1TFRjeU5qTTFOek0wTkRZNE1EUXdOeml4Q1ZWMHhaMWZpTHhuZ0FvRG1Bc0J5QXNCMkJNQ1xcdTAwMjZhZT0xXFx1MDAyNm51bT0xXFx1MDAyNnNpZz1BT0Q2NF8ybTBCY090OXRnT0ZnUUc0c1JJSFZZdmJzOG1RXFx1MDAyNmNsaWVudD1jYS1wdWItOTY4NTczNDQ0NTQ3NjgxNFxcdTAwMjZuYj1fbmJcXHUwMDI2bng9Q0xJQ0tfWFxcdTAwMjZueT1DTElDS19ZXFx1MDAyNmFjdD0xXFx1MDAyNnJpPTFcXHUwMDI2YWR1cmw9aHR0cHM6Ly9pbmZvLmluZm9ibG94LmNvbS9XVy1QUEMtRlkyMC1DU0FEdW1taWVzLTIwMTkwODAxLmh0bWwlM0ZzcyUzRGdvb2dsZSUyNnN0JTNEY2xvdWQlMjUyMGN5YmVyJTI1MjBzZWN1cml0eSUyNmdjbGlkJTNERUFJYUlRb2JDaE1Jbk5yOGtKeWs2QUlWaHhmZ0NoMk5vQS1BRUFFWUFTQUFFZ0lyTV9EX0J3RVwiXSxcInZhcnNcIjp7XCJfbmJcIjp7XCJkZWZhdWx0VmFsdWVcIjpcIlwiLFwiaWZyYW1lVHJhbnNwb3J0U2lnbmFsXCI6XCJcIn19fX19PC9zY3JpcHQ%2BPC9hbXAtYWQtZXhpdD48L2JvZHk%2BPC9odG1sPjwhLS0gSUZSQU1FIElOTkVSIENPTlRFTlQgLS0%2BIiwibWV0YSI6eyJwbFJhdGlvIjowLjAxfX0%3D&i=7-7&t=adltag_k7xey36s_BHZi6nD7QRU&r=1fe530d4e21edd38b46a4eb003c82ee&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.45 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-45.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a

Request headers

Referer: https://threatpost.com/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Mar 2020 06:18:38 GMT
via: 1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
age: 28931
x-cache: Error from cloudfront
status: 200
content-length: 43
last-modified: Mon, 20 Jan 2020 20:59:51 GMT
server: AmazonS3
etag: "6b7395c9201aa64331475fddd24d987c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: Ac5LOCQQe75FPLRM_THDWQlobWgLPPIU
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: fbSYiJ0bKl_L9J1I7AALENnAafwk3XSExxbG9fXLEZrMhEfW0H9qlQ==

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame D9C4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

42ms
42ms

Image
text/html

2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date: Wed, 18 Mar 2020 14:20:48 GMT
x-content-type-options: nosniff
server: safe
location: https://googleads.g.doubleclick.net/pagead/drt/si
content-type: text/html; charset=UTF-8
status: 302
cache-control: private
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 1750 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Roboto&display=swap
Origin: https://threatpost.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 27 Feb 2020 08:47:06 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 1748022
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 11016
x-xss-protection: 0
expires: Fri, 26 Feb 2021 08:47:06 GMT

GET
H2 200 18214743382600115427
tpc.googlesyndication.com/simgad/ Frame D9C4 63 KB
63 KB 6ms
6ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18214743382600115427?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmr06emOjTCUIYkFA8dlbjwatJOPw

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e90430e076a6c0aa15cff9e63081ae3b5503c048cf0f4f45fdcaf9f5e2763251

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 05 Mar 2020 00:46:18 GMT
x-content-type-options: nosniff
last-modified: Wed, 28 Aug 2019 15:57:30 GMT
server: sffe
age: 1172070
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 64506
x-xss-protection: 0
expires: Fri, 05 Mar 2021 00:46:18 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D9C4 2 KB
3 KB 9ms
9ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 17 Mar 2020 23:33:48 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 53220
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Wed, 18 Mar 2020 23:33:48 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D9C4 295 B
367 B 8ms
8ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 17 Mar 2020 21:53:20 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 59248
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 18 Mar 2020 21:53:20 GMT

GET
H2 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 6708 330 B
401 B 8ms
7ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 06 Mar 2020 09:43:39 GMT
x-content-type-options: nosniff
age: 1053429
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 06 Mar 2021 09:43:39 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 8EC9 19 B
709 B 32ms
32ms XHR
application/json 185.33.223.80
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:50 GMT
X-Proxy-Origin: 85.159.237.65; 85.159.237.65; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.41:80
AN-X-Request-Uuid: d8d1539d-76e1-42b1-8a75-95592e10958c
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 8EC9 24 B
987 B 143ms
143ms XHR
application/json 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435870&v=8.1&r=%7B%22id%22%3A%2270dae843f11bb7%22%2C%22imp%22%3A%5B%7B%22id%22%3A%228a1278a16abcbc%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22320x180%22%7D%2C%22bidfloor%22%3A0.78%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22api%22%3A%5B1%2C2%5D%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22w%22%3A320%2C%22h%22%3A180%2C%22placement%22%3A1%7D%7D%2C%7B%22id%22%3A%229a985c00a19309%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22320x180%22%7D%2C%22bidfloor%22%3A0.78%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22api%22%3A%5B1%2C2%5D%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22w%22%3A320%2C%22h%22%3A180%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&nf=1&
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: fa44fc6db3fa817bb1e946d2e907e7dc30097a30d6d6069966fa41cdf37efa1e

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 44
Expires: Wed, 18 Mar 2020 14:20:48 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 8EC9 141 B
361 B 109ms
42ms XHR
application/json 52.58.85.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.85.190 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-85-190.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e15b8ebfdd477e003797e04ca7052dccf866592ca37f40aabe567d630ec14857

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:48 GMT
content-encoding: gzip
status: 200
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 148
expires: 0

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 8EC9 0
215 B 38ms
38ms XHR
application/json 18.194.129.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.129.81 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-129-81.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Server: adaptv/1.0
Connection: keep-alive
Content-Length: 0
Content-Type: application/json

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 8EC9 0
59 B 26ms
26ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 18 Mar 2020 14:20:48 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 8EC9 92 B
295 B 50ms
50ms XHR
application/json 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=75e28a33-34bd-4ce7-b27d-3b54cdd78ad7&nocache=1584541248121&gdpr_consent=&gdpr=1&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&skip=1&auid=540882778&vwd=320&vht=180&
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.179.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:48 GMT
via: 1.1 google
server: OXGW/16.179.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK w_640_000.ts Show response
video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/ Frame 8EC9 386 KB
387 KB 45ms
44ms XHR
video/mp2t 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/w_640_000.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 9a678dbc06cec5ef33041e7c9b699d32b2df15e19536e3eb5e453be932e7559b

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Tue, 17 Mar 2020 19:42:56 GMT
Server: Tengine
ETag: "5e712840-60920"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Wed, 25 Mar 2020 14:20:12 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 395552
X-Proxy-Cache: HIT

GET
BLOB 200
OK abd82b90-56fa-46cb-a0af-b20f68a1ad17
https://threatpost.com/ Frame 8EC9 63 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://threatpost.com/abd82b90-56fa-46cb-a0af-b20f68a1ad17
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: worker

Response headers

Content-Length: 64352
Content-Type: text/javascript

GET
H/1.1 200
OK pixel;r=765935408;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F;fpan=1;fpa=P0-1182226619-1584541248205...
pixel.quantserve.com/ 35 B
658 B 139ms
34ms Image
image/gif 91.228.74.137
QUANTCAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=765935408;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F;fpan=1;fpa=P0-1182226619-1584541248205;ns=0;ce=1;qjs=1;qv=0e9a7da-20191205140709;cm=;ref=;je=0;sr=1600x1200x24;enc=n;dst=1;et=1584541248205;tzo=-60;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2019%2F10%2F23114037%2Fgoogl%2Ctype.article%2Ctitle.Convincing%20Google%20Impersonation%20Opens%20Door%20to%20MiTM%252C%20Phishing%2Cdescription.Using%20homographic%20characters%20is%20an%20easy%20way%20to%20execute%20a%20convincing%20fake%20site%252E%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fconvincing-google-impersonation-opens-door-to-mitm-phishi

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.137 , United Kingdom, ASN27281 (QUANTCAST, US),

Reverse DNS

Software

QS /

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:48 GMT
Server: QS
Strict-Transport-Security: max-age=86400
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control: private, no-cache, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1 200
OK w_640_001.ts Show response
video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/ Frame 8EC9 428 KB
428 KB 44ms
43ms XHR
video/mp2t 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/w_640_001.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 4ac390e47336cd2930da23c6eab0ea1910f3a195c4e5f023dfff00cde17fa525

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:12 GMT
Last-Modified: Tue, 17 Mar 2020 19:42:57 GMT
Server: Tengine
ETag: "5e712841-6afd4"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Wed, 25 Mar 2020 14:20:12 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 438228
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 767E 0
379 B 26ms
26ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=16&serverTime=1584541247&s=0&sta=12348808&x=320&y=180&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e722e3e7eddc&contentFileId=705242&mediaPlayListId=5946&playerVer=3.0.0&contentMatchType=&isExcludeFromOpt=0&cbuster=1584541248544&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:48 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_002.ts Show response
video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/ Frame 8EC9 426 KB
427 KB 37ms
37ms XHR
video/mp2t 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/w_640_002.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),
Reverse DNS
Software: Tengine /
Resource Hash: b7c460dea77f900c0d2373b5a15c2fa35efcde552ad279ab33a443694d12036f

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:13 GMT
Last-Modified: Tue, 17 Mar 2020 19:42:58 GMT
Server: Tengine
ETag: "5e712842-6a938"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Wed, 25 Mar 2020 14:20:13 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 436536
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_003.ts Show response
video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/ Frame 8EC9 328 KB
328 KB 33ms
33ms XHR
video/mp2t 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/w_640_003.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 8134600d920994244917b3eaa9029ff820fe587c3bee8282002d68297d50f4fc

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:13 GMT
Last-Modified: Tue, 17 Mar 2020 19:42:59 GMT
Server: Tengine
ETag: "5e712843-52054"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Wed, 25 Mar 2020 14:20:13 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 335956
X-Proxy-Cache: HIT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame C866 42 B
110 B 16ms
15ms Image
image/gif 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstQc5p90N4VanCxLuP70Wtb1aaWs7AZ63hwhl5WqbaiwgJD4XvcXp0fqUlniZWbtQxn6GinihZ0tbkbQ7fGVdskwvRNNdbp405ifg2p59Y&sig=Cg0ArKJSzFofcjDsUK0hEAE&adk=1015519800&tt=-1&bs=1585%2C1200&mtos=1071,1071,1071,1071,1071&tos=1071,0,0,0,0&p=10,429,100,1157&mcvt=1071&rs=0&ht=0&tfs=623&tls=1694&mc=1&lte=0&bas=0&bac=0&met=ie&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1584541246996&dlt&rpt=683&isd=0&msd=0&ext&xdi=0&ps=1585%2C6140&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-14-14-13-13-0-0-0&tvt=1681&is=728%2C90&iframe_loc=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&r=v&id=osdim&vs=4&uc=14&upc=0&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200316

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:49 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame DEF2 42 B
110 B 19ms
19ms Image
image/gif 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvATgJTkuP98PPmN_uZh8A7bgIJaUz_zOHJDJqRgJAemywbfhY3Z7EY4U-0EWbCz9ACSuDS_YLUCamR85zGohInKrVdkfNEiCL1UC-RYiHbacIWwlPOjgiWtql58A&sai=AMfl-YQUPAdUEtpBw__adUOq0oKeDZ-xIJLmpz4Cn3TJl9eq8WRBQUIIS6rMswZARWCAJ3rkSPQGPIvdTVxkIozITnQQW-ACiSnXx-tQGx6y&sig=Cg0ArKJSzP7nQDZn0jboEAE&id=ampim&o=1057,257&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=361&tls=1362&g=100&h=100&tt=1362&r=v&adk=654286612&avms=ampa

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:49 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 209B 0
0 1102ms
33ms Document
text/html 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 04 Mar 2020 22:48:14 GMT
Content-Encoding: gzip
Content-Length: 7619
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=42138
Expires: Thu, 19 Mar 2020 02:03:08 GMT
Date: Wed, 18 Mar 2020 14:20:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

200

pd
u.openx.net/w/1.0/ Frame 83A7
Redirect Chain

https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent=
https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=

0
0

42ms
41ms

Document
text/html

34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.179.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=3e5765cc-8bab-4a82-aa68-f042d2e77ea2|1584541249
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=3e5765cc-8bab-4a82-aa68-f042d2e77ea2|1584541249; Version=1; Expires=Thu, 18-Mar-2021 14:20:49 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1584541249|mOgikimWiygu; Version=1; Expires=Thu, 02-Apr-2020 14:20:49 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.179.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 18 Mar 2020 14:20:49 GMT
content-type: text/html
content-length: 374
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

status: 302
set-cookie: i=3e5765cc-8bab-4a82-aa68-f042d2e77ea2|1584541249; Version=1; Expires=Thu, 18-Mar-2021 14:20:49 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.179.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
date: Wed, 18 Mar 2020 14:20:49 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1

410
Gone

sync
sync.adaptv.advertising.com/ Frame 8EC9
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=XnIuQQAAAHyBK1k2
https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XnIuQQAAAHyBK1k2&_test=XnIuQQAAAHyBK1k2
https://sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=XnIuQQAAAHyBK1k2&_test=XnIuQQAAAHyBK1k2

10 B
118 B

462ms
121ms

Image
text/plain

52.0.180.19
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=XnIuQQAAAHyBK1k2&_test=XnIuQQAAAHyBK1k2
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.180.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-180-19.compute-1.amazonaws.com
Software: ribs2.0 /
Resource Hash: 42e2bdfb6f2641ab97b6a586c31e591246a5240bc86e504d6ec02c616aeb8e4e

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: ribs2.0
Connection: keep-alive
Content-Length: 10
Content-Type: text/plain

Redirect headers

Location: //sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=XnIuQQAAAHyBK1k2&_test=XnIuQQAAAHyBK1k2
Server: ribs2.0
Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame 8EC9 43 B
779 B 137ms
44ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 18 Mar 2020 14:20:49 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-content-type-options: nosniff
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

204

sync
pixel.advertising.com/ups/55953/ Frame 8EC9
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=87c5d532-b5d6-494e-a2e9-7dbc70e67d0d&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=87c5d532-b5d6-494e-a2e9-7dbc70e67d0d

0
124 B

992ms
31ms

Image
text/plain

52.29.20.136
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55953/sync?uid=87c5d532-b5d6-494e-a2e9-7dbc70e67d0d&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=87c5d532-b5d6-494e-a2e9-7dbc70e67d0d

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.29.20.136 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-20-136.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Wed, 18 Mar 2020 14:20:50 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:49 GMT
x-aspnet-version: 4.0.30319
location: https://pixel.advertising.com/ups/55953/sync?uid=87c5d532-b5d6-494e-a2e9-7dbc70e67d0d&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=87c5d532-b5d6-494e-a2e9-7dbc70e67d0d
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 302
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 369

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame 8EC9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1&verify=true
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1&apid=UPab0c6727-6923-11ea-b820-028feea51e5a
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1&apid=UPab0c6727-6923-11ea-b820-028feea51e5a&verify=true

0
977 B

34ms
34ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1&apid=UPab0c6727-6923-11ea-b820-028feea51e5a&verify=true

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.106 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:50 GMT
Server: ATS/7.1.2.106
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Date: Wed, 18 Mar 2020 14:20:50 GMT
Server: ATS/7.1.2.106
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDIyCSnGEw0KmmpUcf35IJs&google_cver=1&apid=UPab0c6727-6923-11ea-b820-028feea51e5a&verify=true
Connection: keep-alive
Content-Length: 0

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 6708 42 B
110 B 16ms
15ms Image
image/gif 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvLaXcv0ZdguMmbGmR1fNahL6yvusW6EsreqOPNTtP5zosgAfvX7efEZspR66FntAnxP8SEQ1j9PVMsFwHGXdbBj1mQGc5wZgihOBDsCJE&sig=Cg0ArKJSzDE2P-rhtvAVEAE&id=ampim&o=0,0&d=2,2&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,1002,1002,1002&tos=0,0,1002,0,0&tfs=246&tls=1248&g=100&h=100&tt=1248&r=v&adk=3385906655&avms=ampa

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:49 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK w_640_004.ts Show response
video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/ Frame 8EC9 450 KB
450 KB 49ms
48ms XHR
video/mp2t 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/w_640_004.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),
Reverse DNS
Software: Tengine /
Resource Hash: f4054948ea84019439df4231eabb9a1eefd11ec625fb9d5c3bf8008fea36dfd6

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:13 GMT
Last-Modified: Tue, 17 Mar 2020 19:42:59 GMT
Server: Tengine
ETag: "5e712843-707f4"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Wed, 25 Mar 2020 14:20:13 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 460788
X-Proxy-Cache: HIT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame F25B 0
0 118ms
54ms Document
text/html 95.101.184.244
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.184.244 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-184-244.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

Server: Apache/2.2.15 (CentOS)
ETag: "13006b6-9f85-59db914d12ccf"
Last-Modified: Tue, 04 Feb 2020 05:12:07 GMT
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 14955
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=89520
Expires: Thu, 19 Mar 2020 15:12:49 GMT
Date: Wed, 18 Mar 2020 14:20:49 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 9FFB 0
0 946ms
27ms Document
text/html 23.37.55.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-55-184.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 04 Mar 2020 22:48:14 GMT
Content-Encoding: gzip
Content-Length: 7619
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=42138
Expires: Thu, 19 Mar 2020 02:03:08 GMT
Date: Wed, 18 Mar 2020 14:20:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 3A2F 0
0 3162ms
63ms Document
text/html 95.101.184.231
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-184-231.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Fri, 20 May 2016 02:07:09 GMT
Vary: Accept-Encoding
ETag: W/"573e714d-3e3"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Thu, 18 Mar 2021 14:20:52 GMT
Date: Wed, 18 Mar 2020 14:20:52 GMT
Connection: keep-alive

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 61B8
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

360ms
35ms

Document
text/html

205.185.216.42
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

Date: Wed, 18 Mar 2020 14:20:53 GMT
Connection: Keep-Alive
Accept-Ranges: bytes
Cache-Control: max-age=23441
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx000000000000022606760-005e713856-340a38f-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1584541252.dop004.am5.t,1584541253.cds147.am5.shn,1584541253.dop004.am5.t,1584541253.cds009.am5.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame A56B 0
0 40ms
37ms Document
text/html 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.179.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=3e5765cc-8bab-4a82-aa68-f042d2e77ea2|1584541249; pd=v2|1584541249|mOgikimWiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=3e5765cc-8bab-4a82-aa68-f042d2e77ea2|1584541249; Version=1; Expires=Thu, 18-Mar-2021 14:20:49 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1584541249|kimWfcgqiysLomgemOgun0gi; Version=1; Expires=Thu, 02-Apr-2020 14:20:49 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.179.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 18 Mar 2020 14:20:49 GMT
content-type: text/html
content-length: 355
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK w_640_005.ts Show response
video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/ Frame 8EC9 452 KB
453 KB 35ms
34ms XHR
video/mp2t 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/w_640_005.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 91d1a7e27186d345ee7388612637231461303d0529f6e89e729b072a80041f38

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:14 GMT
Last-Modified: Tue, 17 Mar 2020 19:43:00 GMT
Server: Tengine
ETag: "5e712844-710c4"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Wed, 25 Mar 2020 14:20:14 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 463044
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 767E 0
379 B 29ms
29ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=36&serverTime=1584541247&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e722e3e7eddc&contentFileId=0&mediaPlayListId=0&cbuster=1584541250034&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:49 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C866 7 KB
5 KB 20ms
19ms XHR
application/json 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200312&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0a7f757e5cc5961acb13ccb713f48fa94746dd8b28ad3fe451331e8a1d02ef5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 18 Mar 2020 14:20:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5176
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C866 14 KB
5 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:20:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Wed, 18 Mar 2020 14:20:51 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 39A4 0
0 6ms
6ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Wed, 18 Mar 2020 13:52:41 GMT
expires: Thu, 18 Mar 2021 13:52:41 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1690
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C866 0
58 B 15ms
15ms Image
image/gif 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200312&jk=447436609624923&bg=!np2lnYVYQOpDpxH4buICAAAAUFIAAAAOmQFgM5wj0Aib55HBE2PrOy-FuNzXPBCnDthKfBcjLwQh5Xr_gN8pTvckX-xNgfd_mtxN6BAFW6GsZqzdVFO8zzYoLU5bzm-jbnmzupO2u2tJBPc4AvBBUhAbnKEjMzkCcznPTOLBNStCsLZKftF4Xjo8j5ialY9FwKHJV2KaYxgGB9ecUXYNokbn0nyMWcNSdfJ9RgggEPsEQpbnySsK-CW7oJ1sxbI4XUHzNMmE8Zb2AnhnPEausX4xYYrC9QFQYRn-ZKg38V-RiBgHz2S3gc-nQET8WCNtXlL5q7uvlffYkxOOf7JMSVn9YrvkJSOQkq_15g8JWvkFdfs5_Zw_8cL_hcATh1AVWQXQ7en_cOasaA5ZOWD_egSTwhsQn7Zpjc9kDBP8JtJfwk23wUIVdwOL2VTH4iJVvK2ivRSkyp7CxaC3CIW46QDdHw3HrOVoANfCrxLuoKAf3aYowtVTlGwX3Q

Requested by

Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:20:51 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 767E 0
379 B 22ms
21ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1584541247&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e722e3e7eddc&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1584541252977&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:52 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_006.ts Show response
video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/ Frame 8EC9 445 KB
445 KB 144ms
144ms XHR
video/mp2t 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/w_640_006.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),
Reverse DNS
Software: Tengine /
Resource Hash: baf71292155967085a3b6a585cc9a84942bdc4a7cc35c129ca32a1230f51dc9e

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:19 GMT
Last-Modified: Tue, 17 Mar 2020 19:43:01 GMT
Server: Tengine
ETag: "5e712845-6f364"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Wed, 25 Mar 2020 14:20:19 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 455524
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 767E 0
379 B 82ms
28ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1584541247&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e722e3e7eddc&contentFileId=0&mediaPlayListId=0&dur=1000&cbuster=1584541257661&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:57 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 767E 0
379 B 28ms
27ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1584541247&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e722e3e7eddc&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1584541257977&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:20:57 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_007.ts Show response
video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/ Frame 8EC9 124 KB
124 KB 32ms
32ms XHR
video/mp2t 185.127.16.54
CLOUDWEBMANAGE-UK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn1/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7127991052d395665459.mp4/w_640_007.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.127.16.54 London, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, GB),
Reverse DNS
Software: Tengine /
Resource Hash: aa2c4c7d0eabe61d2602244b535f021672e8e1cb9c2018d0d85eb2fb99a80d74

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 18 Mar 2020 14:20:25 GMT
Last-Modified: Tue, 17 Mar 2020 19:43:01 GMT
Server: Tengine
ETag: "5e712845-1f070"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Wed, 25 Mar 2020 14:20:25 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 127088
X-Proxy-Cache: HIT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 8EC9 21 B
711 B 62ms
26ms XHR
application/json 185.33.223.80
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

aaaabde3f68c325033b37bb3ebff887e3b589b7137e717e96648a52221881429

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:21:04 GMT
X-Proxy-Origin: 85.159.237.65; 85.159.237.65; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.41:80
AN-X-Request-Uuid: 44bdb344-b786-425f-b96a-51fc0e9ff17d
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 21
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 8EC9 0
215 B 74ms
31ms XHR
application/json 18.194.129.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.129.81 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-129-81.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Server: adaptv/1.0
Connection: keep-alive
Content-Length: 0
Content-Type: application/json

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 8EC9 0
59 B 20ms
20ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 18 Mar 2020 14:21:02 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 8EC9 25 B
1 KB 468ms
164ms XHR
application/json 95.101.185.51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435870&v=8.1&r=%7B%22id%22%3A%22261e6d7a12a701c%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22277f6415c9ed7e3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22320x180%22%7D%2C%22bidfloor%22%3A0.78%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22api%22%3A%5B1%2C2%5D%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22w%22%3A320%2C%22h%22%3A180%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&nf=1&
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1e1f6e12bc0069f4e5827a25ae6d190ce87f03d69263aa24e2ac8ae4761759b4

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:21:02 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 45
Expires: Wed, 18 Mar 2020 14:21:02 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 8EC9 140 B
360 B 34ms
33ms XHR
application/json 52.58.85.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.85.190 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-85-190.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 69d4f235977ecebc785af1a8aa14653479f3298627502811b23a58ded0df1061

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:21:02 GMT
content-encoding: gzip
status: 200
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 147
expires: 0

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 8EC9 92 B
292 B 39ms
39ms XHR
application/json 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=460ed267-3d13-4dd0-8ea8-783348c0565b&nocache=1584541262285&gdpr_consent=&gdpr=1&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&skip=1&auid=540882779&vwd=320&vht=180&
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.179.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:21:02 GMT
via: 1.1 google
server: OXGW/16.179.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 767E 0
379 B 1091ms
30ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1584541247&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e722e3e7eddc&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1584541262977&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:21:03 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 767E 0
379 B 94ms
30ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1584541247&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e722e3e7eddc&contentFileId=0&mediaPlayListId=0&dur=1000&cbuster=1584541267660&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:21:07 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 767E 0
379 B 33ms
33ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1584541247&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e722e3e7eddc&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1584541267977&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:21:07 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
5 KB 18ms
18ms XHR
application/json 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

835130222d68d8d3f753b7c0fd94592f0e321df9ae2ee2d2edbd91a6477deddd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
Origin: https://threatpost.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 18 Mar 2020 14:21:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5231
x-xss-protection: 0

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 211ms
154ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fconvincing-google-impersonation-opens-door-to-mitm-phishing%2F153745%2F

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:21:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Wed, 18 Mar 2020 14:21:10 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 0ebbeb07159809ac39f84d41622093f2
x-transaction: 00b7849e00461b68
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 18 Mar 2020 14:21:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Wed, 18 Mar 2020 14:21:10 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame D787 0
0 6ms
6ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Wed, 18 Mar 2020 13:52:41 GMT
expires: Thu, 18 Mar 2021 13:52:41 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1709
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
58 B 14ms
14ms Image
image/gif 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=576105367550663&bg=!zs2lzdVYk40-UKBudUoCAAAATlIAAAAPmQFasBteq1Dtysz1F5dL_cGdrf1TKz_XuoZUf8qjFuPU954JnJWY6iI7_FPhIxInk6VXkCvQ8Zyflp4Q2JyoQMnXA-2gogzXu9gagyvSF95mztluYpohaXF3fkim8zGXkc1qNzlF3Wf4fCQpJJCPefLesWdDV6Ijt3OytWjFrh80xDaKTowx3gyZZmSUveafD0GBF3NB3hKqDC5YkQ79UNXaRGH52_6EZ4isXQ5bcd_rxwbztvrVS8n9f4uWcfLDiqdCswuAdHR1MYp4UZQaBhxmLdTpzIJuOYNBaD9XB6vL1Du3ixDCUoSPmEOhh4UnzcAnm3bpNb_HaDSCxxq4ZQSDnzK3iD2Wlmh2L-bAYQYJ6q9pEK8SkiLpA7uZANYNBqQ3qpYiEznfcR79JLzo6oD3MIn-iDcECv5W6d3WhaJlbLbe8i0ZStA79fCYeuSZlZnhIxyc_FPjTVFIog

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Wed, 18 Mar 2020 14:21:10 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 767E 0
379 B 254ms
254ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1584541247&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=85.159.237.65&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e722e3e7eddc&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1584541272977&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Wed, 18 Mar 2020 14:21:13 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.14
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

263 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.pubmatic.com/	1970-01-19 08:52:13	Name: KRTBCOOKIE_699 Value: 22727-AALJHU685F0AABGhqj89wA&KRTB&22744-AALJHU685F0AABGhqj89wA
.pubmatic.com/	1970-01-19 10:18:37	Name: PUBMDCID Value: 3
.pubmatic.com/	1970-01-19 08:52:13	Name: PugT Value: 1584541269
.pubmatic.com/	1970-01-19 08:52:13	Name: KRTBCOOKIE_1101 Value: 23040-6805552929553381521

27 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 315) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 340) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 340) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 340) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 340) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 3) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 3) Message: GDPR is not applicable, skipping initialization of CMP
console-api	log	(Line 3) Message: Not calling apstag.init() typeof(kAmazonPublisherID)=undefined
console-api	log	(Line 3) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	(Line 3) Message: Initial Ad Load
console-api	log	(Line 3) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	(Line 3) Message: pbjs bids returned
console-api	log	(Line 3) Message: gPBJSTimeoutTimer cleared
console-api	log	(Line 3) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	(Line 3) Message: sendAdserverRequest()
console-api	log	(Line 3) Message: Not calling apstag.setDisplayBids() gAmazonBidsBack=false
console-api	log	(Line 3) Message: pbjs.getAdserverTargeting: >> Prebid
console-api	log	(Line 3) Message: [object Object]
console-api	log	(Line 3) Message: pbjs.getBidResponses:
console-api	log	(Line 3) Message: [object Object]
console-api	log	(Line 3) Message: gThisRefreshSlots=
console-api	log	(Line 3) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	(Line 3) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	(Line 3) Message: console.groupEnd
console-api	info	URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js(Line 407) Message: Powered by AMP ⚡ HTML – Version 2003031842100 https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
console-api	info	URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js(Line 407) Message: Powered by AMP ⚡ HTML – Version 2003031842100 https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/
console-api	info	URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js(Line 407) Message: Powered by AMP ⚡ HTML – Version 2003031842100 https://threatpost.com/convincing-google-impersonation-opens-door-to-mitm-phishing/153745/

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
cdn.ampproject.org
cm.g.doubleclick.net
e.serverbid.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
ib.adnxs.com
kasperskycontenthub.com
live.sekindo.com
match.adsrvr.org
math-aids-threatpost-tagan.adlightning.com
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid-server.rubiconproject.com
qd.admetricspro.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.adap.tv
sync.adaptv.advertising.com
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
video.sekindo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
104.244.42.5
104.244.42.67
13.224.194.45
151.101.113.140
151.101.12.157
151.101.14.49
152.199.21.89
165.227.252.242
172.217.16.194
172.217.22.2
178.128.135.80
18.156.0.31
18.194.129.81
185.127.16.54
185.220.204.204
185.33.223.80
185.64.189.112
205.185.216.42
23.37.55.184
2600:9000:206e:4400:6:44e3:f8c0:93a1
2600:9000:206e:c000:2:9275:3d40:93a1
2600:9000:214f:a400:0:5c46:4f40:93a1
2606:4700:3036::681f:4fc2
2a00:1288:110:c305::8000
2a00:1450:4001:800::2003
2a00:1450:4001:80b::200a
2a00:1450:4001:815::2002
2a00:1450:4001:817::2008
2a00:1450:4001:818::2002
2a00:1450:4001:818::200e
2a00:1450:4001:81a::2003
2a00:1450:4001:81c::2001
2a00:1450:4001:81d::2003
2a00:1450:4001:820::2002
2a00:1450:4001:824::2004
2a00:1450:400c:c0c::9c
2a03:2880:f02d:e:face:b00c:0:2
2a05:f500:11:101::b93f:9001
34.95.120.147
35.173.160.135
52.0.180.19
52.203.99.84
52.29.20.136
52.58.85.190
63.32.144.14
69.173.144.142
72.251.249.14
91.228.74.137
91.228.74.248
95.101.184.231
95.101.184.244
95.101.185.51
99.86.234.82
99.86.243.30
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7
027ef26dead3109a62a194fdce626cf25a25f0eb950635749754e64c3acdbec4
03d95929b0703d04e46b6957a7d8794f27214673987b91c56a020dabe35e8a10
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
08c47f7e7337123387bc5a59a05749e09abc65f767c49ffdd4aed0181636a3a1
0a1b5a439d79947cc5db6aa52347627ed146b7710af2ce042804a8a259ea966c
0b4b6edbb9dfa923bde86147c294879a60493c25e315b728abd03ebb7967add1
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0dc8eedc05c0c074b318d49d20a99915a0dc418187342d6f9ee081778bc51b0d
1149ad543186f9342aa8723f3cd76be284854a600e1d2c862db6ca2b5d0ff2ad
1410917920bec60eefe6ef0983b2c8569a421f22ab0ad71c262e08113385730d
1559e425e28a54611f84a10c4a1cf691af538809d48bdc5a157fd89592548fa3
1aed87072b3ad1e8bede086e65fddd450a76628f35c7c6e3e14bac16ebd2d50d
1d36800d5a9c72e02424db4f2ee2d3e3391388e8b7e863533f73c788df14ab5e
1d7fe0f9bb86a16f6cdbca71a61b250ec61d838cb0cdb2bdd061ee0247783183
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e1f6e12bc0069f4e5827a25ae6d190ce87f03d69263aa24e2ac8ae4761759b4
2ab721173b48a6c10e5038cdb90476c5a73959f63ff36873f10140bb482efbad
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2ca96ead8fc47853db84cc77e185134d554f75a5fcbe59323e65fb9c776c1369
2ce2129da582125d26c643bfa3ad19f6f2532b7c2a57da274139de2c79b48af7
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2ed8662cb6ca4b48b146127db22ebd71f824d54fb6ca11601bd8fa97ff572cf2
2eed704516967d8dc76ba196eeb291e766472d219951b26cec272ccdb41c998e
2ffc331dd3351f5bd16051454e43e4f138886c774294be85f8be45f844f82c72
30b448bcf3866f20a816d889462a3e99484f49a184eba4d65002fa412c11836f
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
35fd5522615ac33058d953b0ae613133140ea57d678729abbb1aae09f5e7757f
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3663dead35753fccb3080139938612e9768e6b6cb4bf2176e3beaa42c956d6bc
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3a2372e21f48a6f47108ad1f4639fb29431789cbaa644f47ae64c52ab2abec8a
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
42e2bdfb6f2641ab97b6a586c31e591246a5240bc86e504d6ec02c616aeb8e4e
43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec
45bb946a23f977d5139f76d588c777c8e3a971c18db05970997197bc5f2900ac
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
46c6ad10f098bfb55b3f43896fa0155181a286b1bc84414e8601ebf93428d3cd
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4ac390e47336cd2930da23c6eab0ea1910f3a195c4e5f023dfff00cde17fa525
4dd9e0a5c2c130a37cf39303f73e8ed58a62829066574bb4af16fdbccec5678a
4e273fd46ad93529dc90e39c09aa9e0d2f33cac2cd73ba3ac0d6200e69cdd7bb
4ee36d77a67f176a8468c3fafd5c230a2b8584293b81221b004619e700f84106
4f68b13965aca7240d1fa7aa4526a872138e15acf8dab4af6374309db830416e
54c87afb1cd6ab4d835474b1b97d75bb118cce9fbb3f05a5d2cb1ea824a4dee8
56ab0f61f8ed6030bdd684f3752233177da0555b07cb172e0abffe8e02978bc5
56fb012c459c714ef7d38cea2a8afb470c9077f898c7ba1f34604770b972ef28
5993b3bd67380a8234b3145cf6ee13e23797f14a34c5504d8c79ae72e36c7b49
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5f86b50febe2140f6e5d60798aeb3f9da6cd0e9012e6508203ea6494648c2973
617448d837ea26846be612fbf4fe0a0bc6f798c2cde941cbaf5d6ce5b9f623f0
6583635d9e469fd71fe79e0c9b20fc33d0184e68a68564eb6da6b058d60fa035
663ac3773e9741ad638447e6e9478f83e10e073c5ee433c5de3c640c7dae8c32
69d4f235977ecebc785af1a8aa14653479f3298627502811b23a58ded0df1061
6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e
76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099
7889b14367dfcfae75df125c6189cdf0a6db2c163958ffcb5300de3badb6ebb0
7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb
7e9467c15a95120c678114b68b7a342dd320cc28d77ac2cd1aa822e18e0ea3d1
7fa58b512176de3de4ee84324c9cb545d4ee79937b6a3518af6ed1a5e61378db
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8134600d920994244917b3eaa9029ff820fe587c3bee8282002d68297d50f4fc
835130222d68d8d3f753b7c0fd94592f0e321df9ae2ee2d2edbd91a6477deddd
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
85f887bfc15021f9668c2fd09eee69af9bc795ac7ec2f90c99eb7ebf6a3d4b39
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451
8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
8fa3dc8d99f9c768dab8377000d306d6c3795c024993ab8a7f42e29f5f236ddd
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
909009056877bdbc198a45c7adec7d4b0615aa97d0a4d61ac493472dd0b4a97f
91d1a7e27186d345ee7388612637231461303d0529f6e89e729b072a80041f38
92236ba12e109fff1e82ecabec1eda229af59c8374c54374a38a46dc01f53559
940e0c3385928422aae38e1a74f1d84b462d8ce1a056c686fde505a0bf3162bb
993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093
9a678dbc06cec5ef33041e7c9b699d32b2df15e19536e3eb5e453be932e7559b
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9e679a848ff7efd13c99bda68f0e721c27ec6c092a54a3898971023479ce269a
9f40f7297122393e1425eec62e78a75c3211f7ad3f6b09a356aa317fcedc2cf3
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2e2059610101cb4718d6d9cf8d6e44243838304968710f35ed7f44188a9c279
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a519a1e5dbf70e322138ea492c71bdadae357cfab95bf924598dc708e4096da3
a70ceb6ff4a5c3959d630f11458a34f204bca08683a0963fd7db7b5897790977
a783d2ad42c380bc896219c080fa845d1e9f2e77483558103aeb296b95b85701
a968b405c5b4dcd85f76e5400c41930968710351102d83a80cf114ad7549b5d0
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13
aa2c4c7d0eabe61d2602244b535f021672e8e1cb9c2018d0d85eb2fb99a80d74
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
aaaabde3f68c325033b37bb3ebff887e3b589b7137e717e96648a52221881429
aaf45a172ec90c76bcecd61c68d998c2256fe9b1700371e80011d1161c5ab629
ab03c12ea6a9ab3cbd42d0e99aea371b69a483a3e3efba236bd9e07b48c91289
ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
ae6ff79046f9ee8c299dabd799c885729b480ed1df8fcda01e62f5b74892d9b8
b14b26b4f9dfea337c9b706964d07db8723f630a38f1587b3966fc90854773cd
b546be5b42d65b5d2eb3ef247886a1d692512462946bac11547df2a0a5ed02a2
b68cacefacedf9810bd8f97411ecaab17809bd5dc194ad01384c99e3e5746fbb
b7c460dea77f900c0d2373b5a15c2fa35efcde552ad279ab33a443694d12036f
b9bf85aa47770831122466d8e31ce103915caae610dbf66df0eb914a6d732aaa
baf71292155967085a3b6a585cc9a84942bdc4a7cc35c129ca32a1230f51dc9e
bcf391dd0b006a87698ac0894d71039d610480913d24fcdaa1f2fdeeeda943e3
be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e
c0a7f757e5cc5961acb13ccb713f48fa94746dd8b28ad3fe451331e8a1d02ef5
c186afbbc35854b1c3bf5949da665292c070571b3ba15aaf2f54b5faa4a3f6a0
c6f82014ed1bf97fc0ac74d2a0c213cad2d625e7195893ec8f5297a1f1a9b315
c749fac7a9b0c903abb651292d4c1eac95411fd75ad08c89e6c4ad9e3680959b
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d69f97510d506fdff62059b955a572bfebc93e9c0a243ec79beaf245e737b59a
d6ee16771e7ff43c300e2f8ffc93ac5dc3413055a96ea559d49d843516916ac7
d8313e2445f2a598fa325438da046d8335091dd9f45d6ed7d45996c12f2af678
dab98b1d5558dd15c7db5ada4438fe03a424a7c1f5e0f29567d39a0a892bcc41
dccf135d70257ff7c8c5d547e6f89e057c39e4cce8f0040264f986f4a2f1f8f5
dceefa4f83a42c4c354684cafa23683ba920a03f1b1bdad91973477420a9c5f4
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
dfe167944349de2fd31c4ec28ed11ebdea7c21bb6d1555deb6fd87813ba09e98
e15b8ebfdd477e003797e04ca7052dccf866592ca37f40aabe567d630ec14857
e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796
e2b81f17863fe79aefc02b3aa36acbc5a4d95f0c61d447eebbbc39a0eb93ee6a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e05b274c76d548e39c6633af671d715bd1be28a929ab47a5ae8d29ff120df7
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e69b4aedd4ba4df00f7340e4a299dacca0abd06295d6c871f6816ea07db2507c
e8d7c60749c1d62942a8e0a6f901800bd14ff3094251373626cd99a8875c6391
e90430e076a6c0aa15cff9e63081ae3b5503c048cf0f4f45fdcaf9f5e2763251
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ed8348ad255986ca08204cc5d4bd3a58e8173a0588b47d89895f77af07c9adaf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f026ff57bddc5af4162c23b3c33ffee2def39216fc770159d2263021c60de0a7
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f4054948ea84019439df4231eabb9a1eefd11ec625fb9d5c3bf8008fea36dfd6
f89d17dc2e4ecb385243b7b4cdaf5d8d9f6d4b9829e2be80afb66d01721835e3
fa44fc6db3fa817bb1e946d2e907e7dc30097a30d6d6069966fa41cdf37efa1e
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

230 Requests

100 %HTTPS

35 %IPv6

37 Domains

60 Subdomains

49 IPs

7 Countries

9198 kBTransfer

13500 kBSize

4 Cookies

15 Outgoing links

Page URL History

Redirected requests

230 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

230
Requests

100 %
HTTPS

35 %
IPv6

37
Domains

60
Subdomains

49
IPs

7
Countries

9198 kB
Transfer

13500 kB
Size

4
Cookies

230 HTTP transactions
6 data transactions