combofix.org Open in urlscan Pro
162.241.151.19 Public Scan

URL:
https://combofix.org/
Submission: On November 06 via manual (November 6th 2020, 9:15:43 am UTC) from PL

Summary HTTP 63 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 20 IPs in 4 countries across 16 domains to perform 63 HTTP transactions. The main IP is 162.241.151.19, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is combofix.org.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 4th 2020. Valid for: 3 months.

This is the only time combofix.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
26	162.241.151.19 162.241.151.19	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
3	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2008	15169 (GOOGLE) (GOOGLE)
1	143.204.95.142 143.204.95.142	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:214... 2600:9000:214f:a800:0:93e4:a640:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:820::200a	15169 (GOOGLE) (GOOGLE)
2	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:825::2002	15169 (GOOGLE) (GOOGLE)
1	172.217.21.194 172.217.21.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81f::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	52.94.232.110 52.94.232.110	16509 (AMAZON-02) (AMAZON-02)
1	13.224.191.13 13.224.191.13	16509 (AMAZON-02) (AMAZON-02)
2	2a04:4e42:1b:... 2a04:4e42:1b::272	54113 (FASTLY) (FASTLY)
1	52.94.225.95 52.94.225.95	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:825::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
63	20

26 162.241.151.19 (Provo, United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-151-19.unifiedlayer.com

combofix.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.95.142 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-95-142.fra50.r.cloudfront.net

z-na.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:a800:0:93e4:a640:93a1 (United States)

ASN16509 (AMAZON-02, US)

my.hellobar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.21.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s12-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.94.232.110 (Ashburn, United States)

ASN16509 (AMAZON-02, US)

aax-us-east.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.191.13 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-191-13.fra2.r.cloudfront.net

wms-na.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:1b::272 (Ascension Island)

ASN54113 (FASTLY, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.94.225.95 (Ashburn, United States)

ASN16509 (AMAZON-02, US)

fls-na.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	combofix.org combofix.org	208 KB
6	amazon-adsystem.com z-na.amazon-adsystem.com aax-us-east.amazon-adsystem.com wms-na.amazon-adsystem.com fls-na.amazon-adsystem.com	32 KB
6	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	146 KB
5	doubleclick.net googleads.g.doubleclick.net
3	google.com apis.google.com adservice.google.com	68 KB
2	media-amazon.com m.media-amazon.com	4 KB
2	facebook.net connect.facebook.net	59 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	twitter.com platform.twitter.com	29 KB
1	gstatic.com fonts.gstatic.com	8 KB
1	googletagservices.com www.googletagservices.com	27 KB
1	google.de adservice.google.de	832 B
1	googleadservices.com partner.googleadservices.com	631 B
1	googleapis.com fonts.googleapis.com Failed	684 B
1	hellobar.com my.hellobar.com
1	googletagmanager.com www.googletagmanager.com	38 KB
63	16

	Domain	Requested by
26	combofix.org	combofix.org
5	googleads.g.doubleclick.net	pagead2.googlesyndication.com
4	pagead2.googlesyndication.com	combofix.org pagead2.googlesyndication.com
3	aax-us-east.amazon-adsystem.com	z-na.amazon-adsystem.com combofix.org
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	m.media-amazon.com	combofix.org
2	connect.facebook.net	combofix.org connect.facebook.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	apis.google.com	combofix.org apis.google.com
2	platform.twitter.com	combofix.org platform.twitter.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fls-na.amazon-adsystem.com	combofix.org
1	wms-na.amazon-adsystem.com	combofix.org
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	fonts.googleapis.com	combofix.org
1	my.hellobar.com	combofix.org
1	z-na.amazon-adsystem.com	combofix.org
1	www.googletagmanager.com	combofix.org
63	21

This site contains links to these domains. Also see Links.

Domain
www.combofix.org
link.safecart.com
aax-us-east.amazon-adsystem.com
www.amazon.com
supportz.com

Subject Issuer	Validity	Valid
www.combofix.org Let's Encrypt Authority X3	`2020-11-04` - `2021-02-02`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
z-na.amazon-adsystem.com Amazon	`2020-01-09` - `2021-02-09`	a year	crt.sh
*.hellobar.com DigiCert SHA2 Secure Server CA	`2017-10-26` - `2020-12-07`	3 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
*.apis.google.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
*.googleadservices.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
aax-us-east.amazon-adsystem.com Amazon	`2020-06-15` - `2021-06-15`	a year	crt.sh
wms-na.assoc-amazon.com Amazon	`2020-04-03` - `2021-04-02`	a year	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2020-09-16` - `2021-09-21`	a year	crt.sh
fls-na.amazon-adsystem.com Amazon	`2019-12-31` - `2020-12-24`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://combofix.org/
Frame ID: 66D971CFB448013BDB4F285EB618BE37
Requests: 56 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20201104/r20190131/zrt_lookup.html
Frame ID: 19E8C6EB440C92E55642143DBFDC4F79
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&adk=1812271804&adf=3025194257&lmt=1604654126&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Fcombofix.org%2F&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126168&bpp=12&bdt=872&idt=80&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4718793830668&frm=20&pv=2&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=554050300463&dssz=33&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=100
Frame ID: 552C12D163894EEBCDA9962E7AF75C0C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&h=250&slotname=6157894680&adk=628962043&adf=837003640&pi=t.ma~as.6157894680&w=300&lmt=1604654126&psa=0&format=300x250&url=https%3A%2F%2Fcombofix.org%2F&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126180&bpp=4&bdt=884&idt=97&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4718793830668&frm=20&pv=1&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=35738422389295&dssz=34&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=490&ady=143&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=cj73jed0cb&p=https%3A//combofix.org&dtd=103
Frame ID: B779E0CBD39D9399E7D9F346C585236A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&h=163&slotname=4629896720&adk=1250810111&adf=3459182269&pi=t.ma~as.4629896720&w=650&fwrn=4&lmt=1604654126&rafmt=11&psa=0&format=650x163&url=https%3A%2F%2Fcombofix.org%2F&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126184&bpp=2&bdt=888&idt=126&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250&nras=1&correlator=4718793830668&frm=20&pv=1&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=571814758228735&dssz=37&mdo=0&mso=0&rplot=4&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=315&ady=648&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YjzvnNQtlz&p=https%3A//combofix.org&dtd=129
Frame ID: 5D7BD25F6AB65BEF5C879AB1D070DB46
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&h=250&slotname=8244469145&adk=3883175264&adf=2409015401&pi=t.ma~as.8244469145&w=250&lmt=1604654126&psa=0&format=250x250&url=https%3A%2F%2Fcombofix.org%2F&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126186&bpp=1&bdt=890&idt=130&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C650x163&nras=1&correlator=4718793830668&frm=20&pv=1&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=571814758228735&dssz=37&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=985&ady=107&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&fsb=1&xpc=w1QMhi3fZ8&p=https%3A//combofix.org&dtd=133
Frame ID: 020EEC591BF880F318FBB5D9513DC82E
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fcombofix.org
Frame ID: 3748A8F0AB8501C14E93EFEFEC23ECC6
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Frame ID: 5E6A7919DB26161775A7FBCF733805C3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

63
Requests

97 %
HTTPS

68 %
IPv6

16
Domains

21
Subdomains

20
IPs

4
Countries

639 kB
Transfer

1691 kB
Size

7
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: http://www.combofix.org/
Title: Home

Search URL Search Domain Scan URL

URL: http://www.combofix.org/category/articles
Title: Articles

Search URL Search Domain Scan URL

URL: https://link.safecart.com/22ycp6/aHR0cDovL3d3dy53aXBlcnNvZnQuY29tL2Rvd25sb2Fk
Title: Download Now

Search URL Search Domain Scan URL

URL: https://link.safecart.com/2m556q/aHR0cHM6Ly9idXkuY29tYm9jbGVhbmVyLmNvbS9vZmZlcnMvcncvbHAxLw
Title: Download Now for Mac OS

Search URL Search Domain Scan URL

URL: https://link.safecart.com/22ycp3/aHR0cDovL3d3dy53aXBlcnNvZnQuY29tLw
Title: WiperSoft

Search URL Search Domain Scan URL

URL: https://aax-us-east.amazon-adsystem.com/x/c/QsADfs5H6AR0-vI0RgolyCEAAAF1nNbXFgEAAAE0AfAwi6k/https://www.amazon.com/dp/B00ZSI7Y3U/ref=sm_n_au_dka_DK_pr_con_0_0?adId=B00ZSI7Y3U&creativeASIN=B00ZSI7Y3U&linkId=a4a4a0746be5af4d4465c41f04549a30&tag=combo000-20&linkCode=w70&ref-refURL=https%3A%2F%2Fcombofix.org%2F&slotNum=0&imprToken=7eaqypfQuz2yWjEqZc8DyA&adType=smart&adMode=auto&adFormat=strip&impressionTimestamp=1604654127067
Title: Microsoft OEM Windows 10 Home, 64-Bit, 1-Pack, DVD

Search URL Search Domain Scan URL

URL: https://aax-us-east.amazon-adsystem.com/x/c/QsADfs5H6AR0-vI0RgolyCEAAAF1nNbXFgEAAAE0AfAwi6k/https://www.amazon.com/dp/B079JD7F7G/ref=sm_n_au_dka_DK_pr_con_0_1?adId=B079JD7F7G&creativeASIN=B079JD7F7G&linkId=a4a4a0746be5af4d4465c41f04549a30&tag=combo000-20&linkCode=w70&ref-refURL=https%3A%2F%2Fcombofix.org%2F&slotNum=0&imprToken=7eaqypfQuz2yWjEqZc8DyA&adType=smart&adMode=auto&adFormat=strip&impressionTimestamp=1604654127072
Title: TP-Link AC1750 Smart WiFi Router (Archer A7) - Dual Band Gigabit…

Search URL Search Domain Scan URL

URL: https://aax-us-east.amazon-adsystem.com/x/c/QsADfs5H6AR0-vI0RgolyCEAAAF1nNbXFgEAAAE0AfAwi6k/https://affiliate-program.amazon.com/home/ads/ref=sm_n_au_dka_DK_logo?adId=logo&creativeASIN=logo&linkId=a4a4a0746be5af4d4465c41f04549a30&tag=combo000-20&linkCode=w70&ref-refURL=https%3A%2F%2Fcombofix.org%2F&slotNum=0&imprToken=7eaqypfQuz2yWjEqZc8DyA&adType=smart&adMode=auto&adFormat=strip&impressionTimestamp=1604654127073&ac-ms-src=nsa-ads&cid=nsa-ads
Title: Ads by Amazon

Search URL Search Domain Scan URL

URL: https://www.amazon.com/adprefs
Title:

Search URL Search Domain Scan URL

URL: https://link.safecart.com/2qw4yu/aHR0cHM6Ly93d3cud2F0Y2hkb2dkZXZlbG9wbWVudC5jb20vZW4vaG9tZS9hbnRpLW1hbHdhcmU
Title: Watchdog Anti-Malware

Search URL Search Domain Scan URL

URL: https://link.safecart.com/2qw4z2/aHR0cHM6Ly93YXRjaGRvZ2RldmVsb3BtZW50LmNvbS9lbi9kb3dubG9hZC9hbnRpLW1hbHdhcmU
Title: Download Watchdog Anti-Malware

Search URL Search Domain Scan URL

URL: http://supportz.com/hiding-places-for-malware/
Title: Hiding Places for Malware

Search URL Search Domain Scan URL

URL: http://supportz.com/
Title: Supportz

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

63 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
combofix.org/ 42 KB
15 KB 1563ms
1130ms Document
text/html 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

6536e83fabc048d769f31eaab5ad0c4d0eb5e4c0f85a95189bca53bd1ead929e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Host: combofix.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx/1.16.1
Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Link: <https://combofix.org/wp-json/>; rel="https://api.w.org/", <https://combofix.org/>; rel=shortlink
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Set-Cookie: cookielawinfo-checkbox-necessary=yes; expires=Fri, 06-Nov-2020 10:15:24 GMT; Max-Age=3600; path=/
Strict-Transport-Security: max-age=300
X-Server-Cache: false
Content-Encoding: gzip

GET
H/1.1 200
OK tabbed.css
combofix.org/wp-content/plugins/hmt-clickmissile/css/ 26 KB
7 KB 174ms
172ms Stylesheet
text/css 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/plugins/hmt-clickmissile/css/tabbed.css

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

fa2ff180f17ac917b6d8f1dbce9a0601c7800cd8fc1a6045d2f74d22ff84f6c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Jan 2019 03:25:41 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK style.min.css
combofix.org/wp-includes/css/dist/block-library/ 40 KB
8 KB 361ms
186ms Stylesheet
text/css 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-includes/css/dist/block-library/style.min.css?ver=5.3.6

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

dfd6d929422d1f69a727fb6b525f610562eab183a333576516bec0b0503cb049

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Thu, 11 Jun 2020 09:05:54 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK cookie-law-info-public.css
combofix.org/wp-content/plugins/cookie-law-info/public/css/ 3 KB
1 KB 455ms
180ms Stylesheet
text/css 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=1.8.2

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

81e82457fb12ef9a7b3981eceba4363763a703fd04bbe4da183903fd74e2cbcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 15:26:45 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK cookie-law-info-gdpr.css
combofix.org/wp-content/plugins/cookie-law-info/public/css/ 23 KB
5 KB 449ms
173ms Stylesheet
text/css 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=1.8.2

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

2e313d1901cc92fad67cbf3c0819ad41ccb812e3ed051a0a90444c7a07b6eb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 15:26:45 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK cmam.css
combofix.org/wp-content/plugins/hmt-clickmissile/css/ 1 KB
740 B 440ms
164ms Stylesheet
text/css 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/plugins/hmt-clickmissile/css/cmam.css

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

4a307b23109100a018bd09b57252692174e3b588798c30c4ea65385ceda0a1e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Jan 2019 03:25:41 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK style.css
combofix.org/wp-content/themes/heatmap-adaptive/ 58 KB
13 KB 471ms
195ms Stylesheet
text/css 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/themes/heatmap-adaptive/style.css?ver=20130606

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

f9d3cd5e437d9f5e9861d6bdb7b46fdf8b507f4e85b59b304b2928b0fc299f79

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Jan 2019 03:15:58 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK default.min.css
combofix.org/wp-content/plugins/tablepress/css/ 6 KB
3 KB 441ms
164ms Stylesheet
text/css 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/plugins/tablepress/css/default.min.css?ver=1.10

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

760bc4d420605c167dd90147b0e0d82b4e761a18bc35be7aeffaa4192b371635

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 17:09:41 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK pum-site-styles.css
combofix.org/wp-content/uploads/pum/ 15 KB
4 KB 564ms
203ms Stylesheet
text/css 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/uploads/pum/pum-site-styles.css?generated=1571947672&ver=1.8.14

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

4e7899324890771aef2c1619930694956366786a3f02655d8a0cbb71ea0976c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Oct 2019 20:07:52 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK blue-crunch.css
combofix.org/wp-content/plugins/heatmap-adaptive-pro-plugin/colours/ 11 KB
3 KB 607ms
167ms Stylesheet
text/css 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/plugins/heatmap-adaptive-pro-plugin/colours/blue-crunch.css

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

8dfc46a10219a41225d3d4b28d7312ffcb74760c0fa311717fdd681fc24ca1a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Jan 2019 03:30:26 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK jquery.js Show response
combofix.org/wp-includes/js/jquery/ 95 KB
39 KB 730ms
289ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Oct 2019 20:06:51 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK jquery-migrate.min.js Show response
combofix.org/wp-includes/js/jquery/ 10 KB
5 KB 611ms
162ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Sep 2019 16:56:26 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK cookie-law-info-public.js Show response
combofix.org/wp-content/plugins/cookie-law-info/public/js/ 21 KB
6 KB 630ms
176ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=1.8.2

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

f0dc5a104ad07a87dec3f36b5ff8eb24b974cf484e1d378fdf7d4578ea9f4b9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 15:26:45 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK small-menu.js Show response
combofix.org/wp-content/themes/heatmap-adaptive/js/ 3 KB
1 KB 645ms
174ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/themes/heatmap-adaptive/js/small-menu.js?ver=5.3.6

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

8521827d98882426bbb201e64f00d65b47aaeca0396b022cddff4219d53783cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Jan 2019 03:16:08 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK social.js Show response
combofix.org/wp-content/plugins/heatmap-adaptive-pro-plugin/js/ 476 B
613 B 741ms
177ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/plugins/heatmap-adaptive-pro-plugin/js/social.js?ver=20130606

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

53b498904ee710938ba9e0bdcd6f9a202580333c937ee3a91668c1a9da09fbbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Jan 2019 03:30:32 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 130 KB
45 KB 46ms
25ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d75a4d5837957efab2a6fa9194a5e0715f46529abe866ef2861db2593ad2a63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 09:15:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 45405
x-xss-protection: 0
server: cafe
etag: 12376148264520793524
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 06 Nov 2020 09:15:26 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 95 KB
38 KB 18ms
15ms Script
application/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-111464907-1

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4ef0b7001b92c148a124440ff40b5330c6b067e845ee310b0e599bcf175c977c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 09:15:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38325
x-xss-protection: 0
last-modified: Fri, 06 Nov 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 06 Nov 2020 09:15:26 GMT

GET
H2 200 onejs Show response
z-na.amazon-adsystem.com/widgets/ 25 KB
8 KB 493ms
418ms Script
application/javascript 143.204.95.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=47d1211a-7b20-4f21-a3b6-8f6944069da4
Requested by: Host: combofix.org
URL: https://combofix.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.142 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-142.fra50.r.cloudfront.net
Software: Server /
Resource Hash: ad874cc2404b84f51730d4ef82b77ef4628289dde4a78e93ce5757cde315bbae

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: Public
date: Fri, 06 Nov 2020 09:15:26 GMT
content-encoding: gzip
server: Server
x-amz-cf-pop: FRA50-C1
status: 200
x-cache: Miss from cloudfront
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
charset: UTF-8
cache-control: public,max-age=300,s-maxage=300,no-transform
content-length: 8153
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-amz-cf-id: UZDPU4LVcFbGexd6QB1wLGOgThCKGfYTFNguROrb0XOj1JsZ-YEMwg==
expires: Fri, 06 Nov 2020 09:20:26 GMT

GET
H/1.1 200
OK virus.jpg
combofix.org/wp-content/uploads/ 14 KB
14 KB 305ms
302ms Image
image/jpeg 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://combofix.org/wp-content/uploads/virus.jpg

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

840808ab522d334089f4282d445f00404d2d96e28746d41a64c92c43457d10f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Last-Modified: Tue, 08 Jan 2019 03:33:43 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14439

GET
H/1.1 200
OK blue-network.jpg
combofix.org/wp-content/uploads/ 19 KB
19 KB 167ms
167ms Image
image/jpeg 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://combofix.org/wp-content/uploads/blue-network.jpg

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

929dfb0c7749b8e64d5bfd75877de229832e603c390c53688440e2745d695029

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Last-Modified: Tue, 08 Jan 2019 03:32:37 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19254

GET
H/1.1 200
OK lock.jpg
combofix.org/wp-content/uploads/ 10 KB
10 KB 169ms
169ms Image
image/jpeg 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://combofix.org/wp-content/uploads/lock.jpg

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

f5a4ac15ec2ddc2612aaed028d1317bf4a5bf984669373a3a1950118661f88b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Last-Modified: Tue, 08 Jan 2019 03:32:37 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10388

GET
H/1.1 200
OK Alert-Wipersoft.png
combofix.org/wp-content/uploads/ 24 KB
25 KB 167ms
167ms Image
image/png 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://combofix.org/wp-content/uploads/Alert-Wipersoft.png

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

3fddb5ab2954aa1ae648e55a20e1f23ccc7ca58f758e67c0296b0a0007be4fc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Last-Modified: Tue, 29 Jan 2019 03:36:59 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25057

GET
H/1.1 200
OK cmam-adscript.js Show response
combofix.org/wp-content/plugins/hmt-clickmissile/js/ 176 B
451 B 156ms
155ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/plugins/hmt-clickmissile/js/cmam-adscript.js

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

60ad102a0c16f0706e5d96a6ec94383e6ca9a9eb7f8cf9876ce15875090b93fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Jan 2019 03:25:47 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK core.min.js Show response
combofix.org/wp-includes/js/jquery/ui/ 4 KB
2 KB 195ms
194ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 15:07:10 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK position.min.js Show response
combofix.org/wp-includes/js/jquery/ui/ 6 KB
3 KB 175ms
172ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-includes/js/jquery/ui/position.min.js?ver=1.11.4

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

1e3bd23f892a7823c8419303360e545aa10d63f307d8117abf1fb1b1f756f58a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 15:07:11 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK pum-site-scripts.js Show response
combofix.org/wp-content/uploads/pum/ 47 KB
16 KB 336ms
333ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-content/uploads/pum/pum-site-scripts.js?defer&generated=1571947672&ver=1.8.14

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

22410b8f7fe3c15541e8c1ed038ec8e0debda48561f020dc8d54e10dd77ea9ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Oct 2019 20:07:52 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK wp-embed.min.js Show response
combofix.org/wp-includes/js/ 1 KB
1 KB 207ms
204ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-includes/js/wp-embed.min.js?ver=5.3.6

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 15:07:11 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 403 .js
my.hellobar.com/ 0
0 404ms
380ms Script
application/xml 2600:9000:214f:a800:0:93e4:a640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://my.hellobar.com/.js
Requested by: Host: combofix.org
URL: https://combofix.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:a800:0:93e4:a640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET css
fonts.googleapis.com/ 0
0

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
combofix.org/wp-includes/js/ 14 KB
5 KB 160ms
157ms Script
application/javascript 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://combofix.org/wp-includes/js/wp-emoji-release.min.js?ver=5.3.6

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

1a351abc3f3b435497ddb8a55f09268d3e641dc22455deac06cf0181a4de52ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 15:07:11 GMT
Server: nginx/1.16.1
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET css
fonts.googleapis.com/ 0
0

GET
H2 200 css
fonts.googleapis.com/ 2 KB
684 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Acme|Montserrat

Requested by

Host: combofix.org
URL: https://combofix.org/wp-content/uploads/pum/pum-site-styles.css?generated=1571947672&ver=1.8.14

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

48753aedbb30546012a5413041a6157abed20149d9eeeb62953009a08593ac7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/wp-content/uploads/pum/pum-site-styles.css?generated=1571947672&ver=1.8.14
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 06 Nov 2020 08:25:05 GMT
server: ESF
date: Fri, 06 Nov 2020 09:15:25 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 06 Nov 2020 09:15:25 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 29ms
7ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: combofix.org
URL: https://combofix.org/wp-content/plugins/heatmap-adaptive-pro-plugin/js/social.js?ver=20130606
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/419F) /
Resource Hash: 2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 195
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length: 28698
x-tw-cdn: VZ
Last-Modified: Thu, 01 Oct 2020 21:52:09 GMT
Server: ECS (fcn/419F)
Etag: "a671d4d584ef50954e5cebb21da17065+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2 200 plusone.js Show response
apis.google.com/js/ 49 KB
19 KB 31ms
30ms Script
application/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: combofix.org
URL: https://combofix.org/wp-content/plugins/heatmap-adaptive-pro-plugin/js/social.js?ver=20130606

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8f83ec4847f74e502cf7cb88387326d770877897b977619c93327fc99b244bbd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-s/L+lgrKKDr53F/W6PfJ+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 09:15:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
etag: "3e801f1b1d67e6ea720d7c6a799ff679"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-s/L+lgrKKDr53F/W6PfJ+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Fri, 06 Nov 2020 09:15:26 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-111464907-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 5161
date: Fri, 06 Nov 2020 07:49:25 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Fri, 06 Nov 2020 09:49:25 GMT

GET
H3-Q050 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/ 230 KB
87 KB 60ms
46ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

22f38713e3cb086adc05ce7b3f126b1a3c18d0bd120bafd17c85117de81741b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 09:15:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 88225
x-xss-protection: 0
server: cafe
etag: 10001109163846534958
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Nov 2020 09:15:26 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20201104/r20190131/ Frame 19E8 0
0 6ms
5ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20201104/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20201104/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://combofix.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://combofix.org/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Thu, 05 Nov 2020 18:17:45 GMT
expires: Thu, 19 Nov 2020 18:17:45 GMT
content-type: text/html; charset=UTF-8
etag: 5228831996244654541
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4745
x-xss-protection: 0
age: 53861
cache-control: public, max-age=1209600
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.0_afc8ibZR4.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOPV8Bttuu5r6907bIMhw8f2tfAew/ 138 KB
49 KB 35ms
20ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.0_afc8ibZR4.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOPV8Bttuu5r6907bIMhw8f2tfAew/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e534be2c89e1f740aa5e337494a1c35fa2de8fa8d4d8e4748f403c167e83141

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 22:15:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 17:38:50 GMT
server: sffe
age: 298824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49481
x-xss-protection: 0
expires: Tue, 02 Nov 2021 22:15:02 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
406 B 47ms
13ms XHR
text/plain 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1375310024&t=pageview&_s=1&dl=https%3A%2F%2Fcombofix.org%2F&ul=en-us&de=UTF-8&dt=Home%20-%20COMBOFIX&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1435026706&gjid=1701945281&cid=1469778109.1604654126&tid=UA-111464907-1&_gid=603632516.1604654126&_r=1&gtm=2ouas1&z=739580891

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 06 Nov 2020 09:15:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://combofix.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 202 B
631 B 186ms
66ms Script
text/javascript 172.217.21.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=combofix.org&callback=_gfp_s_&client=ca-pub-2378435975573048

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.21.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s12-in-f2.1e100.net

Software

cafe /

Resource Hash

2bc6e11b9d837822a6d3228ac6b5a03bb033668f6de83617271486f831088f13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 09:15:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 193
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
832 B 35ms
15ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=combofix.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 06 Nov 2020 09:15:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
246 B 17ms
16ms Script
application/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=combofix.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 06 Nov 2020 09:15:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 552C 0
0 68ms
67ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&adk=1812271804&adf=3025194257&lmt=1604654126&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Fcombofix.org%2F&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126168&bpp=12&bdt=872&idt=80&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4718793830668&frm=20&pv=2&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=554050300463&dssz=33&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=100

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&adk=1812271804&adf=3025194257&lmt=1604654126&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Fcombofix.org%2F&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126168&bpp=12&bdt=872&idt=80&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4718793830668&frm=20&pv=2&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=554050300463&dssz=33&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=100
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://combofix.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://combofix.org/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 06 Nov 2020 09:15:26 GMT
server: cafe
content-length: 34
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Fri, 06-Nov-2020 09:30:26 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Fri, 06 Nov 2020 09:15:26 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c83f33217668ea0cf73f32254a7c4f618eb2cd59e17de4f545eae13aaf269b2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 09:15:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1604602186333881"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27601
x-xss-protection: 0
expires: Fri, 06 Nov 2020 09:15:26 GMT

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame B779 0
0 853ms
853ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&h=250&slotname=6157894680&adk=628962043&adf=837003640&pi=t.ma~as.6157894680&w=300&lmt=1604654126&psa=0&format=300x250&url=https%3A%2F%2Fcombofix.org%2F&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126180&bpp=4&bdt=884&idt=97&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4718793830668&frm=20&pv=1&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=35738422389295&dssz=34&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=490&ady=143&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=cj73jed0cb&p=https%3A//combofix.org&dtd=103

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMGLvrnK7ewCFZfHuwgdl0wE5g&gqi=LhSlX5D6EYWE3wPss4fgDA&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&h=250&slotname=6157894680&adk=628962043&adf=837003640&pi=t.ma~as.6157894680&w=300&lmt=1604654126&psa=0&format=300x250&url=https%3A%2F%2Fcombofix.org%2F&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126180&bpp=4&bdt=884&idt=97&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4718793830668&frm=20&pv=1&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=35738422389295&dssz=34&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=490&ady=143&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=cj73jed0cb&p=https%3A//combofix.org&dtd=103
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://combofix.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://combofix.org/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMGLvrnK7ewCFZfHuwgdl0wE5g&gqi=LhSlX5D6EYWE3wPss4fgDA&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_listing.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 06 Nov 2020 09:15:27 GMT
server: cafe
content-length: 31493
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Fri, 06-Nov-2020 09:30:26 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Fri, 06 Nov 2020 09:15:27 GMT
cache-control: private

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 5D7B 0
0 426ms
425ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&h=163&slotname=4629896720&adk=1250810111&adf=3459182269&pi=t.ma~as.4629896720&w=650&fwrn=4&lmt=1604654126&rafmt=11&psa=0&format=650x163&url=https%3A%2F%2Fcombofix.org%2F&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126184&bpp=2&bdt=888&idt=126&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250&nras=1&correlator=4718793830668&frm=20&pv=1&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=571814758228735&dssz=37&mdo=0&mso=0&rplot=4&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=315&ady=648&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YjzvnNQtlz&p=https%3A//combofix.org&dtd=129

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&h=163&slotname=4629896720&adk=1250810111&adf=3459182269&pi=t.ma~as.4629896720&w=650&fwrn=4&lmt=1604654126&rafmt=11&psa=0&format=650x163&url=https%3A%2F%2Fcombofix.org%2F&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126184&bpp=2&bdt=888&idt=126&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250&nras=1&correlator=4718793830668&frm=20&pv=1&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=571814758228735&dssz=37&mdo=0&mso=0&rplot=4&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=315&ady=648&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YjzvnNQtlz&p=https%3A//combofix.org&dtd=129
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://combofix.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://combofix.org/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 06 Nov 2020 09:15:26 GMT
server: cafe
content-length: 22765
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Fri, 06-Nov-2020 09:30:26 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Fri, 06 Nov 2020 09:15:26 GMT
cache-control: private

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 020E 0
0 487ms
487ms Document
text/html 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&h=250&slotname=8244469145&adk=3883175264&adf=2409015401&pi=t.ma~as.8244469145&w=250&lmt=1604654126&psa=0&format=250x250&url=https%3A%2F%2Fcombofix.org%2F&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126186&bpp=1&bdt=890&idt=130&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C650x163&nras=1&correlator=4718793830668&frm=20&pv=1&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=571814758228735&dssz=37&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=985&ady=107&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&fsb=1&xpc=w1QMhi3fZ8&p=https%3A//combofix.org&dtd=133

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-2378435975573048&output=html&h=250&slotname=8244469145&adk=3883175264&adf=2409015401&pi=t.ma~as.8244469145&w=250&lmt=1604654126&psa=0&format=250x250&url=https%3A%2F%2Fcombofix.org%2F&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1604654126186&bpp=1&bdt=890&idt=130&shv=r20201104&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C650x163&nras=1&correlator=4718793830668&frm=20&pv=1&ga_vid=1469778109.1604654126&ga_sid=1604654126&ga_hid=1375310024&ga_fc=0&iag=0&icsg=571814758228735&dssz=37&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=985&ady=107&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068434%2C21066705&oid=3&pvsid=3241852005844817&pem=299&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=8192&bc=31&ifi=3&uci=a!3&fsb=1&xpc=w1QMhi3fZ8&p=https%3A//combofix.org&dtd=133
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://combofix.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://combofix.org/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 06 Nov 2020 09:15:26 GMT
server: cafe
content-length: 22763
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Fri, 06-Nov-2020 09:30:26 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Fri, 06 Nov 2020 09:15:26 GMT
cache-control: private

GET
H2 200 all.js Show response
connect.facebook.net/en_GB/ 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js

Requested by

Host: combofix.org
URL: https://combofix.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2e2ad4a01d1a5ceec3bff3d9798f6ee787ecf9723fa68b97a9a21e0da44ae0d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: LadgiScKL6jEF7178KeSNw==
status: 200
cross-origin-resource-policy: cross-origin
content-length: 1780
etag: "1c381e2eebd0257bb034706fce697d92"
x-fb-debug: EknOyM+1/RkeItEgxDioFENULxkTbiZErzdlflm3qCWlffXMNU097aNmoWUGVcNmIZ+D2ZMMhVLeRhCOKTpaGQ==
x-fb-trip-id: 2042748335
x-fb-content-md5: 9a6263bf4b17f81ca7a0a2bce0215baf
x-frame-options: DENY
date: Fri, 06 Nov 2020 09:15:26 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 06 Nov 2020 09:25:46 GMT

GET
H/1.1 200
OK widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html
platform.twitter.com/widgets/ Frame 3748 0
0 7ms
7ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fcombofix.org
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40EA) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://combofix.org/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://combofix.org/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 1943123
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Fri, 06 Nov 2020 09:15:26 GMT
Etag: "9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified: Thu, 01 Oct 2020 21:50:01 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40EA)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 5825

GET
H2 200 all.js Show response
connect.facebook.net/en_GB/ 188 KB
57 KB 17ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js?hash=3a88bcb8a03b79c13792af5c1b5c0c24&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b752a30a3812a8312f838af5debaf601fab9c335dd870afe916dc0e3043efc16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://combofix.org
Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: Djtzz+4nlSEZTokfamDVrg==
status: 200
cross-origin-resource-policy: cross-origin
content-length: 57668
etag: "f60c6e01d3a53524bfc5d55631f3e130"
x-fb-debug: UgK2FiqrVFjVuy0w8lLdCp6JakV3KVvNaPFR8onlo+4gLpdxKs3bMm1Sr5nK5a/2ZMKEZWB6f8Fn3Quc0MTqdA==
x-fb-trip-id: 664085054
x-fb-content-md5: 9b40c0bd35615d4356bd355b91c99ee6
x-frame-options: DENY
date: Fri, 06 Nov 2020 09:15:26 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
expires: Sat, 06 Nov 2021 09:02:16 GMT

GET
H/1.1 200
OK getad Show response
aax-us-east.amazon-adsystem.com/x/ 85 KB
18 KB 401ms
179ms Script
text/javascript 52.94.232.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax-us-east.amazon-adsystem.com/x/getad?src=308&c=100&sz=1x1&apiVersion=2.0&pj=%7B%22placement%22%3A%22adunit0%22%2C%22enable_interest_ads%22%3A%22true%22%2C%22div_name%22%3A%22amzn-assoc-ad-47d1211a-7b20-4f21-a3b6-8f6944069da4%22%2C%22tracking_id%22%3A%22combo000-20%22%2C%22fallback_mode%22%3A%7B%22type%22%3A%22search%22%2C%22value%22%3A%22software%22%7D%2C%22ad_mode%22%3A%22auto%22%2C%22ad_type%22%3A%22smart%22%2C%22emphasize_categories%22%3A%2213900861%2C2335752011%2C13900871%2C229534%2C228013%2C165793011%22%2C%22marketplace%22%3A%22amazon%22%2C%22region%22%3A%22US%22%2C%22linkid%22%3A%22a4a4a0746be5af4d4465c41f04549a30%22%2C%22default_category%22%3A%22All%22%2C%22design%22%3A%22in_content%22%2C%22viewerCountry%22%3A%22DK%22%2C%22textlinks%22%3A%22%22%2C%22debug%22%3A%22false%22%2C%22acap_publisherId%22%3A%22combo000-20%22%2C%22acap_categoryConstraints%22%3A%5B%7B%22category%22%3A%2213900861%22%2C%22emphasis%22%3A%22Strong%22%2C%22type%22%3A%22AmazonBrowse%22%7D%2C%7B%22category%22%3A%222335752011%22%2C%22emphasis%22%3A%22Strong%22%2C%22type%22%3A%22AmazonBrowse%22%7D%2C%7B%22category%22%3A%2213900871%22%2C%22emphasis%22%3A%22Strong%22%2C%22type%22%3A%22AmazonBrowse%22%7D%2C%7B%22category%22%3A%22229534%22%2C%22emphasis%22%3A%22Strong%22%2C%22type%22%3A%22AmazonBrowse%22%7D%2C%7B%22category%22%3A%22228013%22%2C%22emphasis%22%3A%22Strong%22%2C%22type%22%3A%22AmazonBrowse%22%7D%2C%7B%22category%22%3A%22165793011%22%2C%22emphasis%22%3A%22Strong%22%2C%22type%22%3A%22AmazonBrowse%22%7D%5D%2C%22slotNum%22%3A0%2C%22ead%22%3A5%7D&u=https%3A%2F%2Fcombofix.org%2F&jscb=amzn_assoc_jsonp_callback_adunit0_0
Requested by: Host: z-na.amazon-adsystem.com
URL: https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=47d1211a-7b20-4f21-a3b6-8f6944069da4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.94.232.110 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: 8ad73ef5c7ae1ea7782690ee5810671b487748158af27d584b9c6d3f6496ab0f

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: Server
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Type: text/javascript;charset=UTF-8

GET
H2 200 amzn-nsa-sprite-2x.png
wms-na.amazon-adsystem.com/panda/20070822/US/img/ 4 KB
5 KB 106ms
32ms Image
image/png 13.224.191.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wms-na.amazon-adsystem.com/panda/20070822/US/img/amzn-nsa-sprite-2x.png
Requested by: Host: combofix.org
URL: https://combofix.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.191.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-191-13.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 3d363721e733cd455560f59c74cffdb28148623c7c716a23403bd6b85696b4fa

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 17 Oct 2020 00:51:15 GMT
via: 1.1 d8328954e51c0912a8419c1a67cea1dc.cloudfront.net (CloudFront)
age: 1758252
x-cache: Hit from cloudfront
status: 200
content-length: 4335
last-modified: Mon, 06 Jul 2020 09:51:28 GMT
server: Server
etag: "10ef-5a9c2d198c40e"
content-type: image/png
charset: UTF-8
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: TevSoSQ1SeMbU4Cnl09payMiDTcFCyYmOWEOuwrq6xCKQmHTuAOcdw==
expires: Sat, 24 Oct 2020 00:51:15 GMT

GET
H2 200 41us3IirK-L._AC_SL85_.jpg
m.media-amazon.com/images/I/ 2 KB
2 KB 22ms
6ms Image
image/jpeg 2a04:4e42:1b::272
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.media-amazon.com/images/I/41us3IirK-L._AC_SL85_.jpg
Requested by: Host: combofix.org
URL: https://combofix.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6dcb6d0140cd70285a244cf105e210dddf57a3430812543aa1bc09574711e9e0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 09:15:27 GMT
last-modified: Tue, 30 Jun 2015 04:50:21 GMT
age: 798466
status: 200
x-cache: HIT from fastly, HIT from fastly
content-type: image/jpeg
access-control-allow-origin: *
expires: Sat, 06 Oct 2040 01:35:40 GMT
cache-control: max-age=630720000,public
x-amz-ir-id: 4214f6ce-e751-42d8-b36e-b8f7f5af591b
accept-ranges: bytes
timing-allow-origin: https://www.amazon.in, https://www.amazon.com
content-length: 1657
x-served-by: cache-dca17726-DCA, cache-hhn4071-HHN

GET
H2 200 415vAIn9uEL._AC_SL85_.jpg
m.media-amazon.com/images/I/ 2 KB
2 KB 21ms
6ms Image
image/jpeg 2a04:4e42:1b::272
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.media-amazon.com/images/I/415vAIn9uEL._AC_SL85_.jpg
Requested by: Host: combofix.org
URL: https://combofix.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b6aa9c12d4f97e819043687f7c00a9ae0e5fec9c424f76576dfe1269ea657ed3

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 09:15:27 GMT
last-modified: Wed, 24 Jan 2018 14:33:31 GMT
age: 324658
status: 200
x-cache: HIT from fastly, HIT from fastly
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 28 Oct 2040 15:04:28 GMT
cache-control: max-age=630720000,public
x-amz-ir-id: 17a6b375-a7ac-4510-86a7-5beaec327789
accept-ranges: bytes
timing-allow-origin: https://www.amazon.in, https://www.amazon.com
content-length: 1663
x-served-by: cache-dca17777-DCA, cache-hhn4071-HHN

GET
H/1.1 200
OK /
aax-us-east.amazon-adsystem.com/x/px/QsADfs5H6AR0-vI0RgolyCEAAAF1nNbXFgEAAAE0AfAwi6k/ 43 B
245 B 117ms
117ms Image
image/gif 52.94.232.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aax-us-east.amazon-adsystem.com/x/px/QsADfs5H6AR0-vI0RgolyCEAAAF1nNbXFgEAAAE0AfAwi6k/?assoc_payload=%7B%22regionId%22%3A%221%22%2C%22ref%22%3A%22sm_n_au_dka_DK_%22%2C%22adMode%22%3A%22auto%22%2C%22linkCode%22%3A%22w70%22%2C%22trackingId%22%3A%22combo000-20%22%2C%22linkId%22%3A%22a4a4a0746be5af4d4465c41f04549a30%22%2C%22country%22%3A%22DK%22%2C%22deviceType%22%3A%22BROWSER%22%2C%22defaultCategory%22%3A%22All%22%2C%22defaultSearchPhrase%22%3A%22%22%2C%22givenWidth%22%3A%22auto%22%2C%22givenHeight%22%3A%22auto%22%2C%22visibleItemCount%22%3A2%2C%22axfExperiment%22%3A%22%5B%5D%22%2C%22slotNum%22%3A%220%22%2C%22items%22%3A%5B%7B%22itemType%22%3A%22ASIN%22%2C%22id%22%3A%22B00ZSI7Y3U%22%2C%22source%22%3A%22ContX%22%2C%22column%22%3A0%2C%22extraInfo%22%3A%7B%22opc%22%3A%2212.30%22%2C%22cl%22%3A%22ASIN%22%2C%22cr%22%3A%22.10%22%7D%7D%2C%7B%22itemType%22%3A%22ASIN%22%2C%22id%22%3A%22B079JD7F7G%22%2C%22source%22%3A%22ContX%22%2C%22column%22%3A1%2C%22extraInfo%22%3A%7B%22opc%22%3A%22.18%22%2C%22cl%22%3A%22GL%22%2C%22cr%22%3A%22.00%22%7D%7D%5D%2C%22logType%22%3A%22smart_impressions%22%2C%22design%22%3A%22in_content%22%2C%22eperf%22%3A%7B%22eCTR%22%3A%220.00944%22%2C%22eOPC%22%3A%220.6623999999999999%22%2C%22eeCPM%22%3A%22156327.0%22%2C%22bidComputationCode%22%3A%22V1-CTR3-OPC3-BFC1%22%2C%22asinAttributes%22%3A%22%5B%5D%22%2C%22ead%22%3A%225%22%7D%2C%22eCTR%22%3A%220.00944%22%2C%22eOPC%22%3A%220.6623999999999999%22%2C%22eeCPM%22%3A%22156327.0%22%2C%22bidComputationCode%22%3A%22V1-CTR3-OPC3-BFC1%22%2C%22asinAttributes%22%3A%22%5B%5D%22%2C%22ead%22%3A%225%22%2C%22livePoolPCScore%22%3A0.1145132604088083%2C%22livePoolModelVersion%22%3A%22PRODUCT_CENTRICITY_ENSEMBLE_CLASS-v1%22%2C%22contXPCScore%22%3A-1%2C%22contXModelVersion%22%3A%22ContXV1%22%2C%22KEYWORD%22%3A%5B%7B%22id%22%3A%22combofix%22%2C%22rs%22%3A0.874%7D%2C%7B%22id%22%3A%22spy%20camera%20detector%22%2C%22rs%22%3A0.796%7D%2C%7B%22id%22%3A%22windows%208.1%22%2C%22rs%22%3A0.668%7D%2C%7B%22id%22%3A%22spyware%22%2C%22rs%22%3A0.6%7D%2C%7B%22id%22%3A%22download%20now%22%2C%22rs%22%3A0.598%7D%2C%7B%22id%22%3A%22wireless%20router%22%2C%22rs%22%3A0.565%7D%2C%7B%22id%22%3A%22malware%20removal%22%2C%22rs%22%3A0.52%7D%2C%7B%22id%22%3A%22computer%20desktop%22%2C%22rs%22%3A0.453%7D%2C%7B%22id%22%3A%22malware%20protection%22%2C%22rs%22%3A0.434%7D%2C%7B%22id%22%3A%22spyware%20detector%22%2C%22rs%22%3A0.425%7D%2C%7B%22id%22%3A%22combofix%22%2C%22rs%22%3A0.874%7D%2C%7B%22id%22%3A%22spy%20camera%20detector%22%2C%22rs%22%3A0.796%7D%2C%7B%22id%22%3A%22windows%208.1%22%2C%22rs%22%3A0.668%7D%2C%7B%22id%22%3A%22spyware%22%2C%22rs%22%3A0.6%7D%2C%7B%22id%22%3A%22download%20now%22%2C%22rs%22%3A0.598%7D%2C%7B%22id%22%3A%22wireless%20router%22%2C%22rs%22%3A0.565%7D%2C%7B%22id%22%3A%22malware%20removal%22%2C%22rs%22%3A0.52%7D%2C%7B%22id%22%3A%22computer%20desktop%22%2C%22rs%22%3A0.453%7D%2C%7B%22id%22%3A%22malware%20protection%22%2C%22rs%22%3A0.434%7D%2C%7B%22id%22%3A%22spyware%20detector%22%2C%22rs%22%3A0.425%7D%5D%2C%22totalDocHeight%22%3A3128%2C%22totalDocWidth%22%3A1600%2C%22actualWidth%22%3A650%2C%22actualHeight%22%3A136%2C%22atfInFirstLoad%22%3Afalse%2C%22posX%22%3A315%2C%22posY%22%3A1349.46875%2C%22refUrl%22%3A%22https%3A%2F%2Fcombofix.org%2F%22%7D
Requested by: Host: combofix.org
URL: https://combofix.org/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.94.232.110 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 06 Nov 2020 09:15:27 GMT
Server: Server
Vary: User-Agent
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43

GET
H/1.1 204
No Content cm_:onejs_load_evt@v=2824,onejs_exec_time@v=2,aax_load_time@v=500,aax_load_time_smart@v=500,wdgt_load_time@v=3344,wdgt_load_time_DK@v=3344,wdgt_load_time_smart@v=3344,wdgt_load_time_invoke@v=520,wd...
fls-na.amazon-adsystem.com/1/action-impressions/1/OE/associates-adsystems/action/ 0
146 B 437ms
108ms Image
text/plain 52.94.225.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fls-na.amazon-adsystem.com/1/action-impressions/1/OE/associates-adsystems/action/cm_:onejs_load_evt@v=2824,onejs_exec_time@v=2,aax_load_time@v=500,aax_load_time_smart@v=500,wdgt_load_time@v=3344,wdgt_load_time_DK@v=3344,wdgt_load_time_smart@v=3344,wdgt_load_time_invoke@v=520,wdgt_load_time_invoke_smart@v=519,wdgt_load_time_invoke_smart_DK@v=519?marketplace=US&service=AmazonWidgets&method=Widgets_Render_Time&marketplaceId=ATVPDKIKX0DER&requestId=f263e1bf-4995-49a5-95b8-0e464fc15b4d&session=07ce4165-6424-4d02-a288-b4ce49b89939
Requested by: Host: combofix.org
URL: https://combofix.org/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 52.94.225.95 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:26 GMT
x-amzn-RequestId: 79a773cb-4a0b-4322-a07e-bb4519a657e8
Content-Type: text/plain

GET
H/1.1 200
OK %7B%22adViewability%22:[%7B%22above_the_fold%22:false,%22topPos%22:1.1258333333333332,%22leftPos%22:0.198125%7D]%7D&cb=7777440
aax-us-east.amazon-adsystem.com/x/px/QsADfs5H6AR0-vI0RgolyCEAAAF1nNbXFgEAAAE0AfAwi6k/ 43 B
245 B 231ms
113ms Image
image/gif 52.94.232.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aax-us-east.amazon-adsystem.com/x/px/QsADfs5H6AR0-vI0RgolyCEAAAF1nNbXFgEAAAE0AfAwi6k/%7B%22adViewability%22:[%7B%22above_the_fold%22:false,%22topPos%22:1.1258333333333332,%22leftPos%22:0.198125%7D]%7D&cb=7777440
Requested by: Host: combofix.org
URL: https://combofix.org/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.94.232.110 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 06 Nov 2020 09:15:27 GMT
Server: Server
Vary: User-Agent
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 47ms
34ms XHR
application/json 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20201104&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bffc035bfdd76b6232f47d978bead7834d4dd8e1126559820d3c5b1e311b3581

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 06 Nov 2020 09:15:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6428
x-xss-protection: 0

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 16 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201104/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 09:15:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603823857801521"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6015
x-xss-protection: 0
expires: Fri, 06 Nov 2020 09:15:27 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/219/ Frame 5E6A 0
0 7ms
6ms Document
text/html 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/219/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://combofix.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://combofix.org/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4867
date: Fri, 06 Nov 2020 09:06:20 GMT
expires: Sat, 06 Nov 2021 09:06:20 GMT
last-modified: Mon, 05 Oct 2020 22:33:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 547
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
640 B 17ms
16ms Image
image/gif 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gda_r20201104&jk=3241852005844817&bg=!LC-lLw_NAAXuKKZk7ljPDJT4dJktLwIAAABgUgAAABZoAQcKAX6Y5cGgQ1-iB0LvyhmtZV9d_MHWEftfoz2jkIkTBKYkto5g40uLacaNc7gZ3C6pMjI0utNn5hveXGJ1VBoR9yBAJJpNW9ESz-F38clhdXvKkMSqESvhft_SDvUe9HHj7By1cdgblztDbTNcCMC7oR8b-O-BwRtSYC5TO9R-MFE8agz0wE8fYiDSH9MdEJXqdvuhBMVWPz3CXyJVwiwK6Bvd93PHFPd7kcFo-NLPjXRf40j--LO8e6upwwkPruVPZJRqvHu1OKDa_GV-t3GEcqrm6t5UfC3vhzY_0poUG8d1natvs-J5qe-k0MbzOPeOFBqKbZDWvb-MIIjrBbLAjs1ydPU4eQFmHTLbz4qL-rWeKBXoIW-ol5SYn2iMwI0xsav6RvSvrPF-jbQC0oHRzRsphmJx7YEPWBU8CDwrabdPNmKT6Ze_7LuMLMbMQ-O_2pc-_N8YSikD01b-kfIH4hrsTpozUZdKw8YPxt51wNCsNDazSE9ImTWiDW0SEhy-mQG1B_w81ozr5fCbclX1DOsn_8AgT7SQekl_50naSxfZv5r8urQEeNfBSyjPOb7Bui_NrX0f8QQXaJbF-NOaqdcEtLmVVEpbmSb8bZSvw0nvGUeV4zOnJ9ArJAGZZ4qUUmgwwRijX8aw3sjQLRdmkj-JAlKkZbVaeHO_0jIj2rnYizkHjOtlUW_QJpU7hGVcxUx5o3J34bYlBvODKLbPbFOkAoOfDn_XaEVj1x2ChTCNoF3I4mga-vnm0Z1PQAP9ye6L-kJgsJaV6PndEm23dqy4Y8HB9scVNphUms_E2StPPOHfmmfaGnSEZ5EBCq6QB2OiLPSfaUuWf6gtwpKIpC8CSoE5EKhJZsSnfwBZRp-ZIIT0RwxtA0z9odEpCl8vQ_ZunZnsamOcuN0ZhBj_mqcx3KJEFqHPEBU54HcW7Ee7Y2Z9R6QdfCcDElWtZejLPHHHWCgzz-qYpvZeUCk4pQCUkBwPFUBhwwjJapRKrXadieaisQMEtX9eF371NzGlgCQoqB2QwpcAK2504ubVWIEpYYPWpQGngkSjpyJXQNEHwTLMXKVYTlP4IbZAJn4BQQOau7_2cXY

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Nov 2020 09:15:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 RrQfboBx-C5_XxrBbk_m3Lg.woff2
fonts.gstatic.com/s/acme/v11/ 8 KB
8 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/acme/v11/RrQfboBx-C5_XxrBbk_m3Lg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Acme|Montserrat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

940ecc7c4c50c60ba93cdf8f73428cc545a8e16b5e5fa786a7252b6944175e38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://combofix.org
Referer: https://fonts.googleapis.com/css?family=Acme|Montserrat
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 31 Oct 2020 19:17:27 GMT
x-content-type-options: nosniff
last-modified: Thu, 22 Oct 2020 18:55:31 GMT
server: sffe
age: 482285
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8232
x-xss-protection: 0
expires: Sun, 31 Oct 2021 19:17:27 GMT

GET
H/1.1 204
No Content /
combofix.org/wp-json/pum/v1/analytics/ 0
506 B 1597ms
1597ms Image
text/plain 162.241.151.19
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://combofix.org/wp-json/pum/v1/analytics/?event=open&pid=2846&_cache=1604654133321

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

162.241.151.19 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-241-151-19.unifiedlayer.com

Software

nginx/1.16.1 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Referer: https://combofix.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 06 Nov 2020 09:15:34 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.16.1
Link: <https://combofix.org/wp-json/>; rel="https://api.w.org/"
X-Server-Cache: false
Strict-Transport-Security: max-age=300
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: keep-alive
X-Robots-Tag: noindex
Access-Control-Allow-Headers: Authorization, Content-Type
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Lato:300,400,300italic,400italic

Verdicts & Comments Add Verdict or Comment

135 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 13:44:17	Name: DSID Value: NO_DATA
.combofix.org/	1970-01-19 23:05:50	Name: __gads Value: ID=84dde923b6cd83ae-22278c9923b900f4:T=1604654126:RT=1604654126:S=ALNI_MY67ob1fNygxjzXtMhUCQfKG_V0_Q
.combofix.org/	1970-01-19 13:45:40	Name: _gid Value: GA1.2.603632516.1604654126
.combofix.org/	1970-01-19 13:44:14	Name: _gat_gtag_UA_111464907_1 Value: 1
.combofix.org/	1970-01-20 07:15:26	Name: _ga Value: GA1.2.1469778109.1604654126
.doubleclick.net/	1970-01-19 23:05:50	Name: IDE Value: AHWqTUn9bz7ahRVkjS14IDGA6BGApwaJsxWIJYgTibjRsZl0gBFhqqNV7iLA1iC_
combofix.org/	1970-01-19 13:44:17	Name: cookielawinfo-checkbox-necessary Value: yes

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://combofix.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=300

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-us-east.amazon-adsystem.com
adservice.google.com
adservice.google.de
apis.google.com
combofix.org
connect.facebook.net
fls-na.amazon-adsystem.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
m.media-amazon.com
my.hellobar.com
pagead2.googlesyndication.com
partner.googleadservices.com
platform.twitter.com
tpc.googlesyndication.com
wms-na.amazon-adsystem.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
z-na.amazon-adsystem.com
fonts.googleapis.com
13.224.191.13
143.204.95.142
162.241.151.19
172.217.21.194
2600:9000:214f:a800:0:93e4:a640:93a1
2606:2800:234:46c:e8b:1e2f:2bd:694
2a00:1450:4001:800::200e
2a00:1450:4001:801::2002
2a00:1450:4001:803::2008
2a00:1450:4001:803::200e
2a00:1450:4001:814::2003
2a00:1450:4001:81f::2002
2a00:1450:4001:820::200a
2a00:1450:4001:825::2001
2a00:1450:4001:825::2002
2a03:2880:f01c:8012:face:b00c:0:3
2a04:4e42:1b::272
52.94.225.95
52.94.232.110
0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
1a351abc3f3b435497ddb8a55f09268d3e641dc22455deac06cf0181a4de52ee
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e3bd23f892a7823c8419303360e545aa10d63f307d8117abf1fb1b1f756f58a
1e534be2c89e1f740aa5e337494a1c35fa2de8fa8d4d8e4748f403c167e83141
22410b8f7fe3c15541e8c1ed038ec8e0debda48561f020dc8d54e10dd77ea9ca
22f38713e3cb086adc05ce7b3f126b1a3c18d0bd120bafd17c85117de81741b8
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15
2bc6e11b9d837822a6d3228ac6b5a03bb033668f6de83617271486f831088f13
2e2ad4a01d1a5ceec3bff3d9798f6ee787ecf9723fa68b97a9a21e0da44ae0d3
2e313d1901cc92fad67cbf3c0819ad41ccb812e3ed051a0a90444c7a07b6eb41
3d363721e733cd455560f59c74cffdb28148623c7c716a23403bd6b85696b4fa
3fddb5ab2954aa1ae648e55a20e1f23ccc7ca58f758e67c0296b0a0007be4fc7
46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251
48753aedbb30546012a5413041a6157abed20149d9eeeb62953009a08593ac7b
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4a307b23109100a018bd09b57252692174e3b588798c30c4ea65385ceda0a1e8
4d75a4d5837957efab2a6fa9194a5e0715f46529abe866ef2861db2593ad2a63
4e7899324890771aef2c1619930694956366786a3f02655d8a0cbb71ea0976c5
4ef0b7001b92c148a124440ff40b5330c6b067e845ee310b0e599bcf175c977c
53b498904ee710938ba9e0bdcd6f9a202580333c937ee3a91668c1a9da09fbbb
60ad102a0c16f0706e5d96a6ec94383e6ca9a9eb7f8cf9876ce15875090b93fe
6536e83fabc048d769f31eaab5ad0c4d0eb5e4c0f85a95189bca53bd1ead929e
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6dcb6d0140cd70285a244cf105e210dddf57a3430812543aa1bc09574711e9e0
760bc4d420605c167dd90147b0e0d82b4e761a18bc35be7aeffaa4192b371635
81e82457fb12ef9a7b3981eceba4363763a703fd04bbe4da183903fd74e2cbcd
840808ab522d334089f4282d445f00404d2d96e28746d41a64c92c43457d10f4
8521827d98882426bbb201e64f00d65b47aaeca0396b022cddff4219d53783cb
8ad73ef5c7ae1ea7782690ee5810671b487748158af27d584b9c6d3f6496ab0f
8dfc46a10219a41225d3d4b28d7312ffcb74760c0fa311717fdd681fc24ca1a2
8f83ec4847f74e502cf7cb88387326d770877897b977619c93327fc99b244bbd
929dfb0c7749b8e64d5bfd75877de229832e603c390c53688440e2745d695029
940ecc7c4c50c60ba93cdf8f73428cc545a8e16b5e5fa786a7252b6944175e38
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
ad874cc2404b84f51730d4ef82b77ef4628289dde4a78e93ce5757cde315bbae
b6aa9c12d4f97e819043687f7c00a9ae0e5fec9c424f76576dfe1269ea657ed3
b752a30a3812a8312f838af5debaf601fab9c335dd870afe916dc0e3043efc16
bffc035bfdd76b6232f47d978bead7834d4dd8e1126559820d3c5b1e311b3581
c83f33217668ea0cf73f32254a7c4f618eb2cd59e17de4f545eae13aaf269b2d
dfd6d929422d1f69a727fb6b525f610562eab183a333576516bec0b0503cb049
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
f0dc5a104ad07a87dec3f36b5ff8eb24b974cf484e1d378fdf7d4578ea9f4b9d
f5a4ac15ec2ddc2612aaed028d1317bf4a5bf984669373a3a1950118661f88b4
f9d3cd5e437d9f5e9861d6bdb7b46fdf8b507f4e85b59b304b2928b0fc299f79
fa2ff180f17ac917b6d8f1dbce9a0601c7800cd8fc1a6045d2f74d22ff84f6c2

combofix.org Open in urlscan Pro 162.241.151.19 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

63 Requests

97 %HTTPS

68 %IPv6

16 Domains

21 Subdomains

20 IPs

4 Countries

639 kBTransfer

1691 kBSize

7 Cookies

13 Outgoing links

Redirected requests

63 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

combofix.org Open in urlscan Pro
162.241.151.19 Public Scan

Screenshot
Live screenshot

Full Image

63
Requests

97 %
HTTPS

68 %
IPv6

16
Domains

21
Subdomains

20
IPs

4
Countries

639 kB
Transfer

1691 kB
Size

7
Cookies

63 HTTP transactions
0 data transactions