www.mcezone.com Open in urlscan Pro
134.119.190.82 Public Scan

zrh04s06-in-f136.1e100.net

Software

cafe /

Resource Hash

3681f1f275583c6d76cf2b4b551c9af82b2470729c4c7d76d7e26d8c00c3feaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50864
x-xss-protection: 0
server: cafe
etag: 3913602824369233326
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Oct 2021 05:21:42 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
39 KB 75ms
39ms Script
application/javascript 172.217.16.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-172397208-2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

286dcb26b1640b2663af060cd00f31ebcd3e6dfed5f38ae0cc3582195b338dfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38923
x-xss-protection: 0
last-modified: Mon, 04 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Oct 2021 05:21:42 GMT

GET
H2 200 e-202140.js Show response
stats.wp.com/ 9 KB
3 KB 22ms
6ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202140.js
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn
date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Wed, 21 Sep 2022 02:00:41 GMT

GET
H2 200 lazyload.min.js Show response
www.mcezone.com/wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/ 8 KB
3 KB 29ms
28ms Script
application/javascript 134.119.190.82
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.mcezone.com/wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/lazyload.min.js
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 134.119.190.82 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),
Reverse DNS: titan.int3rnet.net
Software: LiteSpeed /
Resource Hash: 6e86a52a9858206302e32036d89907e3ac87762055e7f9c6364aec33221b3e41

Request headers

:path: /wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/lazyload.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.mcezone.com
referer: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: br
last-modified: Sun, 03 Oct 2021 14:47:54 GMT
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000,public
accept-ranges: bytes
content-length: 2570
expires: Tue, 04 Oct 2022 05:21:42 GMT

GET
H2 200 f139b77bf4a46a9f81aeca4b21d3da86.js Show response
www.mcezone.com/wp-content/cache/min/1/ 111 KB
32 KB 29ms
28ms Script
application/javascript 134.119.190.82
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.mcezone.com/wp-content/cache/min/1/f139b77bf4a46a9f81aeca4b21d3da86.js
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 134.119.190.82 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),
Reverse DNS: titan.int3rnet.net
Software: LiteSpeed /
Resource Hash: cfbdfc6f64dca88c0a6c65323c443fff0a10f6ff12fa896535c55013c478d22d

Request headers

:path: /wp-content/cache/min/1/f139b77bf4a46a9f81aeca4b21d3da86.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.mcezone.com
referer: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: br
last-modified: Wed, 15 Sep 2021 07:38:59 GMT
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000,public
accept-ranges: bytes
content-length: 32207
expires: Tue, 04 Oct 2022 05:21:42 GMT

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec1566fe4d056ecc3c9fcac6c49d9349493622bca8faaa19935fe10ffa1c2e08

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 704cd1eb4a752b3d9259abb89697825d4df1eb983053088c9066d5dec59bec2d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8277d3b312f84417a05400643587eaa0982065618af9e1cafc8f72316e6fd1e1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 Navbharat%20Times.jpg
static.langimg.com/thumb/msid-76874587,width-540,height-405,resizemode-75/ 1 KB
2 KB 78ms
7ms Image
image/webp 88.221.60.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.langimg.com/thumb/msid-76874587,width-540,height-405,resizemode-75/Navbharat%20Times.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

88.221.60.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a88-221-60-153.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

91570631eacd7c8ecb96625ba4eead8cf5c87ba29e0821c41d43384ceeac5f46

Security Headers

Name	Value
Strict-Transport-Security	max-age=25920000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=25920000; includeSubdomains
x-content-type-options: nosniff
imagemagick_im4java: 1
appgn: 172248015001231628741877010
content-length: 1420
x-xss-protection: 1; mode=block
server: nginx
x-frame-options: sameorigin
date: Mon, 04 Oct 2021 05:21:42 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=26974890
access-control-allow-credentials: false
etag: 14542
access-control-allow-headers: *
expires: Fri, 12 Aug 2022 10:23:12 GMT

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 inactive.svg
www.mcezone.com/wp-content/plugins/kk-star-ratings/public/svg/ 223 B
288 B 17ms
16ms Image
image/svg+xml 134.119.190.82
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mcezone.com/wp-content/plugins/kk-star-ratings/public/svg/inactive.svg
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/wp-content/cache/min/1/4259cb97deb46feee1e4bc52089d53cf.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 134.119.190.82 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),
Reverse DNS: titan.int3rnet.net
Software: LiteSpeed /
Resource Hash: 0d06a8516d69db767242f13cc35e99194cf0d263fd5221673ac5aef02723e3c0

Request headers

:path: /wp-content/plugins/kk-star-ratings/public/svg/inactive.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.mcezone.com
referer: https://www.mcezone.com/wp-content/cache/min/1/4259cb97deb46feee1e4bc52089d53cf.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/wp-content/cache/min/1/4259cb97deb46feee1e4bc52089d53cf.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: br
last-modified: Wed, 15 Sep 2021 07:38:48 GMT
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000,public
accept-ranges: bytes
content-length: 174
expires: Wed, 03 Nov 2021 05:21:42 GMT

GET
H2 200 active.svg
www.mcezone.com/wp-content/plugins/kk-star-ratings/public/svg/ 243 B
217 B 17ms
16ms Image
image/svg+xml 134.119.190.82
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mcezone.com/wp-content/plugins/kk-star-ratings/public/svg/active.svg
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/wp-content/cache/min/1/4259cb97deb46feee1e4bc52089d53cf.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 134.119.190.82 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),
Reverse DNS: titan.int3rnet.net
Software: LiteSpeed /
Resource Hash: c91f2e258df01f2df97b56f638878a261e4c379f44cdb5fd5e1879c8eefcfb07

Request headers

:path: /wp-content/plugins/kk-star-ratings/public/svg/active.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.mcezone.com
referer: https://www.mcezone.com/wp-content/cache/min/1/4259cb97deb46feee1e4bc52089d53cf.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/wp-content/cache/min/1/4259cb97deb46feee1e4bc52089d53cf.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: br
last-modified: Wed, 15 Sep 2021 07:38:48 GMT
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000,public
accept-ranges: bytes
content-length: 184
expires: Wed, 03 Nov 2021 05:21:42 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c

Request headers

Referer
Origin: https://www.mcezone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 g.gif
pixel.wp.com/ 50 B
92 B 6ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.1&blog=188396710&post=57549&tz=0&srv=www.mcezone.com&host=www.mcezone.com&ref=&fcp=176&rand=0.2365257734707824
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 / Show response
www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-a... 3 KB
1 KB 2358ms
2358ms XHR
application/json 134.119.190.82
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/?relatedposts=1

Requested by

Host: www.mcezone.com
URL: https://www.mcezone.com/wp-content/cache/min/1/f139b77bf4a46a9f81aeca4b21d3da86.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

134.119.190.82 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),

Reverse DNS

titan.int3rnet.net

Software

LiteSpeed /

Resource Hash

12485b5d52e45ae4c2bb499e0e415e5bd2d3bc566d45dbba10b47c9b95411e8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/?relatedposts=1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.mcezone.com
x-requested-with: XMLHttpRequest
:scheme: https
sec-fetch-site: same-origin
referer: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
:method: GET
Referer: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
x-requested-with: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
x-pingback: https://www.mcezone.com/xmlrpc.php
content-type: application/json; charset=utf-8
expires: Mon, 04 Oct 2021 05:21:44 GMT
cache-control: public, max-age=0
vary: Accept-Encoding,Accept-Encoding
content-length: 1070
x-ua-compatible: IE=edge

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 96 KB
29 KB 27ms
6ms Script
application/javascript 192.229.233.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/wp-content/cache/min/1/f139b77bf4a46a9f81aeca4b21d3da86.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.233.25 Los Angeles, United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6796) /
Resource Hash: cfd3099998b0c37ace8024cbd802160585ba9be1c0047fefc172035184f074df

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 04 Oct 2021 05:21:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Sep 2021 19:09:26 GMT
Server: ECS (frb/6796)
Age: 173
Etag: "f9ab884058c9d8de47075baa622f0e7e+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 28869

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
3 KB 23ms
7ms Script
application/x-javascript 157.240.236.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.mcezone.com
URL: https://www.mcezone.com/wp-content/cache/min/1/f139b77bf4a46a9f81aeca4b21d3da86.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.236.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-frx5.fbcdn.net

Software

Resource Hash

f961b036c673217d04614e2df1751d78f76af07705c3ca9f0aa2e253780ea53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: Jb9ET0+aULg04Hdop2KLQw==
content-security-policy-report-only: default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy: cross-origin
expires: Mon, 04 Oct 2021 05:24:27 GMT
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1685
x-fb-rlafr: 0
x-fb-debug: YN5HWng5BCfwmVQy09AjTtW/k1hrdgLDp+gyVcqdAohVi58oqLB2Z43hbezWXvz0MOv+O5pqkJcFP3+pXfdl3A==
x-fb-trip-id: 917726464
x-fb-content-md5: 854bf64603849c92a6a2d766e2c2f009
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 04 Oct 2021 05:21:42 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "07f02b42f8aac7aca599f980db44d84d"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H/1.1 200
OK in.js Show response
platform.linkedin.com/ 201 KB
61 KB 78ms
10ms Script
text/javascript 2.16.186.19
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/in.js?async=true
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/wp-content/cache/min/1/f139b77bf4a46a9f81aeca4b21d3da86.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.19 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-19.deploy.static.akamaitechnologies.com
Software: Play /
Resource Hash: 7a66efcd1de2a74241a263e6b8cf91857d0ba106b831bdbd76ad4fa5e88e141d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-LI-UUID: pltcmAy7qhYwYdHjkCsAAA==
Date: Mon, 04 Oct 2021 05:21:42 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV4
Server: Play
X-Li-Pop: prod-eda6
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Cache-Control: public, max-age=3600
Connection: keep-alive
X-LI-Proto: http/1.1
Content-Length: 62394
X-CDN: AKAM
X-Li-Fabric: prod-ltx1
Expires: Mon, 4 Oct 2021 05:57:57 GMT

GET
H2 200 pinit.js Show response
assets.pinterest.com/js/ 361 B
431 B 64ms
7ms Script
application/javascript 104.75.88.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pinterest.com/js/pinit.js
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/wp-content/cache/min/1/f139b77bf4a46a9f81aeca4b21d3da86.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-209.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3faadebc89cdb21d11634a032816f152462d1cb8903eb21d0642501fcad065de

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding: br
x-cdn: akamai
etag: "62d32c28f14783b94192cd8d35bc010d"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=189
accept-ranges: bytes
content-length: 203
access-control-expose-headers: X-CDN

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 284 KB
68 KB 51ms
20ms Script
application/javascript 104.18.225.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151507
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/wp-content/cache/min/1/f139b77bf4a46a9f81aeca4b21d3da86.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.225.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b63fe792eca92d7cb67c652ddc4e76692c7f7f0899316ada620039b6438b8961

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 154
etag: W/"fff10df2ca37ad0e879283b24dd072d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 698bf7e029da21b7-DUS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 07 Oct 2021 05:21:42 GMT

GET
H2 200 Mce-Zone-logo.jpg
www.mcezone.com/wp-content/uploads/2021/01/ 12 KB
12 KB 18ms
17ms Image
image/jpeg 134.119.190.82
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mcezone.com/wp-content/uploads/2021/01/Mce-Zone-logo.jpg
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 134.119.190.82 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),
Reverse DNS: titan.int3rnet.net
Software: LiteSpeed /
Resource Hash: 2565012b65bc10a67a6b4ac3592a4b8e893718b7a008bd54d2361ee9aa15f6ce

Request headers

:path: /wp-content/uploads/2021/01/Mce-Zone-logo.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.mcezone.com
referer: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
last-modified: Sun, 24 Jan 2021 07:34:53 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=10368000,public
accept-ranges: bytes
content-length: 12556
expires: Tue, 01 Feb 2022 05:21:42 GMT

GET
H2 200 pic.jpg
navbharattimes.indiatimes.com/photo/msid-86725999,imgsize-21482/ 51 KB
52 KB 942ms
890ms Image
image/jpeg 104.111.216.79
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://navbharattimes.indiatimes.com/photo/msid-86725999,imgsize-21482/pic.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.111.216.79 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-216-79.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

90b5cc3140da517ea2ae580b6908e3fbe8a7603b58ce969b927b606f0fef1147

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.indiatimes.com https://.samayam.com https://maharashtratimes.com https://vijaykarnataka.com https://m.timesofindia.com https://m.economictimes.com https://www.iamgujarat.com https://www.google.com https://.google.com https://cdn.ampproject.org https://.cdn.ampproject.org https://.ampproject.org https://.newspointapp.com http://.newspointapp.com https://.gadgetsnow.com https://eisamay.com
Strict-Transport-Security	max-age=25920000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=25920000; includeSubdomains
x-content-type-options: nosniff
imagemagick_im4java: 1
appgn: 17229642801231633255172763
content-length: 52009
x-xss-protection: 1; mode=block
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 04 Oct 2021 05:21:43 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2591991
access-control-allow-credentials: false
etag: 21482
content-security-policy: frame-ancestors 'self' https://*.indiatimes.com https://*.samayam.com https://maharashtratimes.com https://vijaykarnataka.com https://m.timesofindia.com https://m.economictimes.com https://www.iamgujarat.com https://www.google.com https://*.google.com https://cdn.ampproject.org https://*.cdn.ampproject.org https://*.ampproject.org https://*.newspointapp.com http://*.newspointapp.com https://*.gadgetsnow.com https://eisamay.com
access-control-allow-headers: *
expires: Wed, 03 Nov 2021 05:21:34 GMT

GET
H2 200 navbharat-times.jpg
static.langimg.com/thumb/msid-86726382,width-680,resizemode-3/ 30 KB
30 KB 34ms
34ms Image
image/webp 88.221.60.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.langimg.com/thumb/msid-86726382,width-680,resizemode-3/navbharat-times.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

88.221.60.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a88-221-60-153.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

789dc3aec5e12d7e0c2864decc9151df9bf69a2153a28bff9fcf9d2fa0515271

Security Headers

Name	Value
Strict-Transport-Security	max-age=25920000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=25920000; includeSubdomains
x-content-type-options: nosniff
imagemagick_im4java: 1
appgn: 17229649401231633255830814
content-length: 30246
x-xss-protection: 1; mode=block
server: nginx
x-frame-options: sameorigin
date: Mon, 04 Oct 2021 05:21:42 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=31489644
access-control-allow-credentials: false
etag: 64200
access-control-allow-headers: *
expires: Mon, 03 Oct 2022 16:29:06 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ 44 KB
44 KB 79ms
24ms Font
font/woff2 142.250.186.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans%3A300%2Cregular%2Citalic%2C600%2C700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f3.1e100.net

Software

sffe /

Resource Hash

538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mcezone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 17:03:52 GMT
x-content-type-options: nosniff
age: 303470
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44760
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 16:50:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 30 Sep 2022 17:03:52 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 80ms
23ms Script
text/javascript 142.250.186.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-172397208-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 4836
date: Mon, 04 Oct 2021 04:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Mon, 04 Oct 2021 06:01:06 GMT

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 261 KB
74 KB 15ms
7ms Script
application/x-javascript 157.240.236.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=9c71d05bd2cf620eea13fca5d70da9c0

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-frx5.fbcdn.net

Software

Resource Hash

2d2c290e9bd99534a7d6f100403878fc290b83a7cd645aadb3ca4c072d1367a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.mcezone.com/
Origin: https://www.mcezone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: K9DKKNFL6uPwBqUdKYxBpQ==
cross-origin-resource-policy: cross-origin
expires: Tue, 04 Oct 2022 05:04:27 GMT
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 75586
x-fb-rlafr: 0
x-fb-debug: Z/8E7KnWtW1vJxi7dgoEHJ8Fyce5h0RNus4HT4okISF0iyyO+a8oU96L/ymJkO29/l1qkakcklk6PeHRID7e4w==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 952ea9904d0a0fa1ea3a42edb9340743
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 04 Oct 2021 05:21:42 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "1a0c4e3a075d659e621632c1c5093609"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H/1.1 200
OK widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html Show response
platform.twitter.com/widgets/ Frame 1903 319 KB
103 KB 7ms
7ms Document
text/html 192.229.233.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html?origin=https%3A%2F%2Fwww.mcezone.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.233.25 Los Angeles, United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67BE) /
Resource Hash: c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.mcezone.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 295791
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 04 Oct 2021 05:21:42 GMT
Etag: "8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified: Thu, 30 Sep 2021 18:56:47 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/67BE)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105433

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/ 257 KB
95 KB 82ms
51ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4453395506634072&plah=www.mcezone.com&bust=31062977

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ece2f1e49029966317aca28a7ef0c89f3149eb3a5aad1b279d84f14002511cff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97133
x-xss-protection: 0
server: cafe
etag: 9661851892806363187
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 04 Oct 2021 05:21:42 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210928/r20190131/ Frame F444 10 KB
5 KB 78ms
23ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210928/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f14.1e100.net

Software

cafe /

Resource Hash

8806d9eaf9e8ca89fa2404e8cb66a9fa115e0a0f687ad0dcd91cabce4c2179c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210928/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 03 Oct 2021 23:27:01 GMT
expires: Sun, 17 Oct 2021 23:27:01 GMT
content-type: text/html; charset=UTF-8
etag: 297313706323796346
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4617
x-xss-protection: 0
age: 21281
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 web Show response
onesignal.com/api/v1/sync/8ddc8999-6ecd-4add-800c-94ea754eb97a/ 3 KB
2 KB 25ms
16ms Script
text/javascript 104.18.225.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/8ddc8999-6ecd-4add-800c-94ea754eb97a/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151507

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.225.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

350ec378a000892aec842366ea128e7c99ea36de11329032d75a35f965aa2065

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 426
cf-polished: origSize=3351
status: 200 OK
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 6da54e50-2e8f-494b-8b42-b0acc4e135e6
x-runtime: 0.023460
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"4faa5b4d284ab396ee525e990750465e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 698bf7e10b8521b7-DUS
access-control-allow-headers: SDK-Version
expires: Mon, 04 Oct 2021 06:21:42 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 60ms
31ms XHR
text/plain 142.250.186.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=937077989&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&ul=en-us&de=UTF-8&dt=flubot%20malware%20hits%20android%20smartphones%3A%20Flubot%20malware%20is%20attacking%20smartphones!%20What%20is%20this%20dangerous%20malware%20and%20how%20to%20protect%20yourself%2C%20know%20everything%20-%20alert%20flubot%20malware%20hit%20android%20smartphones%20what%20is%20it%20know%20how%20to%20save%20from%20this%20dangerous%20malwares%20-%20MCE%20Zone&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=600573641&gjid=1158562210&cid=990100946.1633324903&tid=UA-172397208-2&_gid=2122019277.1633324903&_r=1&gtm=2ou9r0&z=1836263189

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mcezone.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Oct 2021 05:21:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mcezone.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pinit_main.js Show response
assets.pinterest.com/js/ 66 KB
19 KB 7ms
7ms Script
application/javascript 104.75.88.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pinterest.com/js/pinit_main.js?0.21021280741354031
Requested by: Host: assets.pinterest.com
URL: https://assets.pinterest.com/js/pinit.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-209.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 75ad585dd9aeca2614593614f6fd317e98b267e6595ffc18e9675e1c744b7a03

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding: br
x-cdn: akamai
etag: "0c6c6fa4aaa25b5091d9f0d1fe79700b"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=166
accept-ranges: bytes
content-length: 18683
access-control-expose-headers: X-CDN

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 201 B
655 B 77ms
21ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.mcezone.com&callback=_gfp_s_&client=ca-pub-4453395506634072

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4453395506634072&plah=www.mcezone.com&bust=31062977

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s01-in-f2.1e100.net

Software

cafe /

Resource Hash

c4b92111ba766a6435d3177d15c37f2a69db96c13ff5067cef63c6b213d3f9f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&tn=DIV&cls=adace-slideup-slot-wrap%20animate-in&ign=false&pw=1600&ph=1200&x=1575&y=1175

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Oct 2021 05:21:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 65ms
22ms Script
application/javascript 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.mcezone.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s46-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 82ms
32ms Script
application/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.mcezone.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 47C4 23 KB
5 KB 179ms
148ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&adk=1812271804&adf=3025194257&lmt=1633312476&plat=1%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902459&bpp=3&bdt=189&idt=158&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6918164160002&frm=20&pv=2&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=178

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f116e759e1156fc09f8daa49a4fe40b0107ea5d017aeb613310cadfd92bc7a2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&adk=1812271804&adf=3025194257&lmt=1633312476&plat=1%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902459&bpp=3&bdt=189&idt=158&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6918164160002&frm=20&pv=2&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=178
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 5347
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C005 436 B
237 B 164ms
146ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=280&slotname=9554992360&adk=1501605501&adf=1850635622&pi=t.ma~as.9554992360&w=820&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=1&psa=0&format=820x280&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902462&bpp=2&bdt=193&idt=184&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=275&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=7C0OIP6oLR&p=https%3A//www.mcezone.com&dtd=190

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb0abfce2d9954eb6d98c59216d9f6d009a6fc5579a295246cf1f7119e639d1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=280&slotname=9554992360&adk=1501605501&adf=1850635622&pi=t.ma~as.9554992360&w=820&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=1&psa=0&format=820x280&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902462&bpp=2&bdt=193&idt=184&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=275&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=7C0OIP6oLR&p=https%3A//www.mcezone.com&dtd=190
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 214
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 41ms
27ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6578b440409407ca4fa312483a4c8fcd2e7f8d340bd5dffcbe1c9139c34a60f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27600
x-xss-protection: 0
server: sffe
etag: "1633087510445837"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 04 Oct 2021 05:21:42 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6909 436 B
237 B 120ms
120ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=276423106&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902464&bpp=1&bdt=195&idt=207&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=1619&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=CvxBXb70lQ&p=https%3A//www.mcezone.com&dtd=210

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

499772dbf26538e2c42854853f8d7bd68bfda84a97de8bd6bb595ba6d54d7619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=276423106&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902464&bpp=1&bdt=195&idt=207&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=1619&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=CvxBXb70lQ&p=https%3A//www.mcezone.com&dtd=210
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 214
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 1903 232 B
431 B 125ms
110ms Fetch
application/json 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=37c42e04366c8b1dcf85fd22484e940d1651eabd

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html?origin=https%3A%2F%2Fwww.mcezone.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:41 GMT
content-encoding: gzip
last-modified: Mon, 04 Oct 2021 05:21:42 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: 4e51035c244d80c4bdfa5d6ae4e1b1f855706400af7fdcca26d3a9feb21110b4
content-length: 166

GET
H2 200 count.json Show response
widgets.pinterest.com/v1/urls/ 272 B
425 B 117ms
96ms Script
application/javascript 151.101.128.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://widgets.pinterest.com/v1/urls/count.json?url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&callback=PIN_1633324902690.f.callback[0]

Requested by

Host: assets.pinterest.com
URL: https://assets.pinterest.com/js/pinit_main.js?0.21021280741354031

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.84 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

404283a9e7165b4fbf8d50105aad3912752f653e3d6dad3dec9bff3c00ae79cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: accept-encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: must-revalidate, max-age=887
x-envoy-upstream-service-time: 1
accept-ranges: none
x-pinterest-rid: 1677902637784659
expires: Mon, 04 Oct 2021 05:36:42 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 52FB 436 B
235 B 155ms
155ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=2999873263&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902465&bpp=1&bdt=196&idt=229&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=2605&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=YKe7ty9uRW&p=https%3A//www.mcezone.com&dtd=232

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18dc1bff0919dea712c8479fd50e1c94d22d253cd583aa7a420d453413cbe9e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=2999873263&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902465&bpp=1&bdt=196&idt=229&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=2605&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=YKe7ty9uRW&p=https%3A//www.mcezone.com&dtd=232
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3222 436 B
235 B 137ms
137ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=1899118575&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902465&bpp=1&bdt=196&idt=246&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280%2C720x180%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=3220&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=jyONKxDj2h&p=https%3A//www.mcezone.com&dtd=249

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56929ed8030f1e7419bfc59a864bcb25afeaf8aa2069e6bbf7e4ad8fee33f3ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=1899118575&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902465&bpp=1&bdt=196&idt=246&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280%2C720x180%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=3220&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=jyONKxDj2h&p=https%3A//www.mcezone.com&dtd=249
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1BF7 436 B
236 B 139ms
139ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=2795889394&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902466&bpp=1&bdt=197&idt=258&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=3635&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=glc8M6kRfF&p=https%3A//www.mcezone.com&dtd=261

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

06f17cbaa31a3061b3455f5856ed95576fb9031bf28a4e7101c1c0c8befdb9ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=2795889394&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902466&bpp=1&bdt=197&idt=258&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=3635&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=glc8M6kRfF&p=https%3A//www.mcezone.com&dtd=261
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 213
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7711 436 B
235 B 142ms
142ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=4075358438&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902467&bpp=1&bdt=198&idt=264&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=3974&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=2QfR4ce603&p=https%3A//www.mcezone.com&dtd=267

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1c791661257860cf0320e5a15e288246080ab9e45de70037ed78829a002e4c6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=180&slotname=7470882360&adk=3629528273&adf=4075358438&pi=t.ma~as.7470882360&w=720&fwrn=4&lmt=1633312476&rafmt=11&psa=0&format=720x180&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902467&bpp=1&bdt=198&idt=264&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=250&ady=3974&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=2QfR4ce603&p=https%3A//www.mcezone.com&dtd=267
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 58ms
30ms Script
application/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.mcezone.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 81ms
32ms Script
application/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.mcezone.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7F33 436 B
235 B 160ms
160ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=600&slotname=6829590821&adk=266012614&adf=730947038&pi=t.ma~as.6829590821&w=260&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=1&psa=0&format=260x600&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902468&bpp=1&bdt=198&idt=302&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00901f7f5ca0a3dc-229f9f30e5ca00cf%3AT%3D1633324902%3ART%3D1633324902%3AS%3DALNI_MYQSOn5Cua_zE9uAG-aNXrkc9T_wQ&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1090&ady=542&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=9&uci=a!9&fsb=1&xpc=7RMaVdgojP&p=https%3A//www.mcezone.com&dtd=305

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe67d8fde9e7572ae8bd868faf1fd9b67c60be76580b49f96256705303c039cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=600&slotname=6829590821&adk=266012614&adf=730947038&pi=t.ma~as.6829590821&w=260&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=1&psa=0&format=260x600&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902468&bpp=1&bdt=198&idt=302&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00901f7f5ca0a3dc-229f9f30e5ca00cf%3AT%3D1633324902%3ART%3D1633324902%3AS%3DALNI_MYQSOn5Cua_zE9uAG-aNXrkc9T_wQ&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180%2C720x180&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1090&ady=542&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=9&uci=a!9&fsb=1&xpc=7RMaVdgojP&p=https%3A//www.mcezone.com&dtd=305
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A700 436 B
237 B 152ms
152ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=600&slotname=6829590821&adk=3154684932&adf=642444652&pi=t.ma~as.6829590821&w=260&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=1&psa=0&format=260x600&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902468&bpp=1&bdt=199&idt=312&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00901f7f5ca0a3dc-229f9f30e5ca00cf%3AT%3D1633324902%3ART%3D1633324902%3AS%3DALNI_MYQSOn5Cua_zE9uAG-aNXrkc9T_wQ&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180%2C720x180%2C260x600&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1090&ady=2101&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=10&uci=a!a&btvi=6&fsb=1&xpc=eSU32hq0av&p=https%3A//www.mcezone.com&dtd=313

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a065255f47ec78937e4486e2bdd07831c95a6a674f48c435f35661993c89adaf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=600&slotname=6829590821&adk=3154684932&adf=642444652&pi=t.ma~as.6829590821&w=260&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=1&psa=0&format=260x600&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902468&bpp=1&bdt=199&idt=312&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00901f7f5ca0a3dc-229f9f30e5ca00cf%3AT%3D1633324902%3ART%3D1633324902%3AS%3DALNI_MYQSOn5Cua_zE9uAG-aNXrkc9T_wQ&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180%2C720x180%2C260x600&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1090&ady=2101&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=10&uci=a!a&btvi=6&fsb=1&xpc=eSU32hq0av&p=https%3A//www.mcezone.com&dtd=313
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 214
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E73E 436 B
235 B 435ms
434ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=600&slotname=6829590821&adk=2002917884&adf=2391556421&pi=t.ma~as.6829590821&w=260&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=1&psa=0&format=260x600&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902469&bpp=1&bdt=200&idt=317&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00901f7f5ca0a3dc-229f9f30e5ca00cf%3AT%3D1633324902%3ART%3D1633324902%3AS%3DALNI_MYQSOn5Cua_zE9uAG-aNXrkc9T_wQ&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180%2C720x180%2C260x600%2C260x600&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1090&ady=3838&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&ifi=11&uci=a!b&btvi=7&fsb=1&xpc=2CoG4HOooF&p=https%3A//www.mcezone.com&dtd=319

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09e26b33ab0d077467dbf546885f5def8f7da57397ad6e9c69f7b8c47e052dfe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=600&slotname=6829590821&adk=2002917884&adf=2391556421&pi=t.ma~as.6829590821&w=260&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=1&psa=0&format=260x600&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902469&bpp=1&bdt=200&idt=317&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00901f7f5ca0a3dc-229f9f30e5ca00cf%3AT%3D1633324902%3ART%3D1633324902%3AS%3DALNI_MYQSOn5Cua_zE9uAG-aNXrkc9T_wQ&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180%2C720x180%2C260x600%2C260x600&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1090&ady=3838&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&ifi=11&uci=a!b&btvi=7&fsb=1&xpc=2CoG4HOooF&p=https%3A//www.mcezone.com&dtd=319
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:43 GMT
server: cafe
content-length: 212
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:43 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1951 436 B
236 B 160ms
160ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4453395506634072&output=html&h=90&slotname=9554992360&adk=857328127&adf=595833849&pi=t.ma~as.9554992360&w=1200&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=2&psa=0&format=1200x90&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902469&bpp=1&bdt=200&idt=323&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00901f7f5ca0a3dc-229f9f30e5ca00cf%3AT%3D1633324902%3ART%3D1633324902%3AS%3DALNI_MYQSOn5Cua_zE9uAG-aNXrkc9T_wQ&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180%2C720x180%2C260x600%2C260x600%2C260x600&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=0&ady=1200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfeEbr%7C&abl=CF&pfx=0&fu=128&bc=31&ifi=12&uci=a!c&fsb=1&xpc=2Qa4r7WuvT&p=https%3A//www.mcezone.com&dtd=324

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

210174069aee0076f728f810a022fc77a650f05b78a0703e081f9148475f271c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4453395506634072&output=html&h=90&slotname=9554992360&adk=857328127&adf=595833849&pi=t.ma~as.9554992360&w=1200&fwrn=4&fwrnh=100&lmt=1633312476&rafmt=2&psa=0&format=1200x90&url=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&flash=0&fwr=0&rpe=1&resp_fmts=2&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633324902469&bpp=1&bdt=200&idt=323&shv=r20210928&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00901f7f5ca0a3dc-229f9f30e5ca00cf%3AT%3D1633324902%3ART%3D1633324902%3AS%3DALNI_MYQSOn5Cua_zE9uAG-aNXrkc9T_wQ&prev_fmts=0x0%2C820x280%2C720x180%2C720x180%2C720x180%2C720x180%2C720x180%2C260x600%2C260x600%2C260x600&nras=1&correlator=6918164160002&frm=20&pv=1&ga_vid=990100946.1633324903&ga_sid=1633324903&ga_hid=937077989&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=0&ady=1200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062977%2C31062949&oid=2&pvsid=1335646644662869&pem=520&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfeEbr%7C&abl=CF&pfx=0&fu=128&bc=31&ifi=12&uci=a!c&fsb=1&xpc=2Qa4r7WuvT&p=https%3A//www.mcezone.com&dtd=324
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 04 Oct 2021 05:21:42 GMT
server: cafe
content-length: 213
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 04-Oct-2021 05:36:42 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 04 Oct 2021 05:21:42 GMT
cache-control: private

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 30ms
17ms Stylesheet
text/css 104.18.225.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151507
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.225.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:42 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 1902
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=259200
cf-ray: 698bf7e2aee0218d-DUS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 07 Oct 2021 05:21:42 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 859adbfc48bb0b06c58fe109db4909585fbca5df398d49185fc0f486bad1ac96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK button.5d16ecc02fbaf599a24dfb57ab239320.js Show response
platform.twitter.com/js/ 7 KB
3 KB 6ms
6ms Script
application/javascript 192.229.233.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.5d16ecc02fbaf599a24dfb57ab239320.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.233.25 Los Angeles, United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6796) /
Resource Hash: 3ee8351e156e2e80d99018a585c18c0dbd9098e3bea84a131d8cbad1ec72c81e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 04 Oct 2021 05:21:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Sep 2021 18:56:33 GMT
Server: ECS (frb/6796)
Age: 295820
Etag: "6b95f5a9a2ff4b885e2eafdf446d70d0+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2296

GET
H/1.1 200
OK tweet_button.58065ae230495f5d9e4b6a916472b2c1.en.html Show response
platform.twitter.com/widgets/ Frame 97A3 32 KB
12 KB 7ms
6ms Document
text/html 192.229.233.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.58065ae230495f5d9e4b6a916472b2c1.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.233.25 Los Angeles, United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6796) /
Resource Hash: fca9fbc2b7bad4d08e4b4cfe80420df03b1bfa4cc2988540b4e816cc905bf33f

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.mcezone.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 295816
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 04 Oct 2021 05:21:42 GMT
Etag: "a4ee8ee440f819aba90d7a1be062a8d7+gzip"
Last-Modified: Thu, 30 Sep 2021 18:56:41 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/6796)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 12235

GET
DATA 200
OK truncated
/ Frame 97A3 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/8ddc8999-6ecd-4add-800c-94ea754eb97a/ 184 B
637 B 306ms
294ms Fetch
application/json 104.18.225.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/8ddc8999-6ecd-4add-800c-94ea754eb97a/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151507

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.225.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger(R)

Resource Hash

893c3cb64449b9fdc556b1b1d1092544d7aab13e0aa14762f57014ed6a682934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-powered-by: Phusion Passenger(R)
status: 200 OK
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: f46ff25b-2aea-451c-a94e-1389d95ad57c
x-runtime: 0.007540
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"893c3cb64449b9fdc556b1b1d1092544"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=7200
cf-ray: 698bf7e3be40c4db-DUS
access-control-allow-headers: SDK-Version
expires: Mon, 04 Oct 2021 07:21:43 GMT

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
375 B 113ms
113ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22%40Mcezone%22%2C%22widget_creator_screen_name%22%3A%22%40Mcezone%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1633324903034%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%22fcb1942%3A1632982954711%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Mon, 04 Oct 2021 05:21:43 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 4e51035c244d80c4bdfa5d6ae4e1b1f855706400af7fdcca26d3a9feb21110b4
x-transaction: 20f0423366d435a1
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 3af21cf1-6ff9-4b63-8715-6a33a9e16280
img.onesignal.com/permanent/ 47 KB
47 KB 25ms
16ms Image
image/png 104.18.225.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.onesignal.com/permanent/3af21cf1-6ff9-4b63-8715-6a33a9e16280
Requested by: Host: www.mcezone.com
URL: https://www.mcezone.com/flubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.225.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0cd009c46ed4e304909410f4d30a8a747a4ede693df095fff42cdb1c9b2e0cca

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:43 GMT
cf-cache-status: HIT
age: 425
x-amz-meta-cache-control: public, maxage=604800
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 47792
x-amz-id-2: Ugt1GtLH8VNukQME7hSyPtFyzw/HBNBOum+6WAqwksg57gmhPewto/z9rulxVh6xSLqapvNX/Wo=
last-modified: Thu, 29 Apr 2021 04:59:53 GMT
server: cloudflare
etag: "30535049e14820accc7095e7fd2ac59c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 1J0Z71AR78MJSEYA
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 698bf7e59adb21b7-DUS
expires: Thu, 04 Nov 2021 05:21:43 GMT

GET
H2 200 share_button.php Show response
www.facebook.com/v2.3/plugins/ Frame C116 43 KB
15 KB 88ms
73ms Document
text/html 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfaf47de4a5f72c%26domain%3Dwww.mcezone.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.mcezone.com%252Ff2c76becc085254%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&layout=button_count&locale=en_US&sdk=joey

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=9c71d05bd2cf620eea13fca5d70da9c0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6c5b73b5b018f816157d26a7d0f517388bea7e94531da3396bdf28a05259042c

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfaf47de4a5f72c%26domain%3Dwww.mcezone.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.mcezone.com%252Ff2c76becc085254%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&layout=button_count&locale=en_US&sdk=joey
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

vary: Accept-Encoding
content-encoding: br
x-fb-rlafr: 0
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ wss://*.whatsapp.com:* v.whatsapp.net *.fbsbx.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
facebook-api-version: v4.0
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: n/YzGU40uJ8E2j0TlXFzAUjxrP9GACxnGSHKbqJM+jStU8J8lJmzex4bOAGqD37+hCEu0mzl+73/Y0+6NM4/2A==
date: Mon, 04 Oct 2021 05:21:43 GMT
priority: u=3,i
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 68ms
38ms XHR
application/json 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210928&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f161.1e100.net

Software

cafe /

Resource Hash

021adf61f86a818ebeb6f5edcaa4796e7ee3a0338deaf2964130c5cf33ba398a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Oct 2021 05:21:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8626
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 257ms
31ms Script
text/javascript 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.161 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 04 Oct 2021 05:21:43 GMT

GET
H2 200 /
log.pinterest.com/ 0
299 B 102ms
102ms Image
text/plain 151.101.128.84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://log.pinterest.com/?type=pidget&guid=KWuEZwwSL_h7&tv=2021082501&event=init&sub=www&button_count=2&follow_count=0&pin_count=0&button_hover=1&profile_count=0&board_count=0&section_count=0&lang=en&nvl=en-US&via=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&viaSrc=canonical
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.128.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 05:21:43 GMT
via: 1.1 varnish
x-cache: MISS
x-envoy-upstream-service-time: 2
x-cache-hits: 0
content-length: 0
x-served-by: cache-hhn4044-HHN
pragma: no-cache
server: envoy
x-timer: S1633324904.696360,VS0,VE96
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-pinterest-rid: 8796914818283771
accept-ranges: bytes
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 zSKZHMh8mXU.png
www.facebook.com/rsrc.php/v3/yr/r/ Frame C116 388 B
441 B 14ms
6ms Image
image/png 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/rsrc.php/v3/yr/r/zSKZHMh8mXU.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfaf47de4a5f72c%26domain%3Dwww.mcezone.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.mcezone.com%252Ff2c76becc085254%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&layout=button_count&locale=en_US&sdk=joey

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f9a1a0ac26eaf5b7f6cc7223b5dd4b5f545b5a48fb598c7442e5f76384f1be8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfaf47de4a5f72c%26domain%3Dwww.mcezone.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.mcezone.com%252Ff2c76becc085254%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&layout=button_count&locale=en_US&sdk=joey
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fb-debug: GMAhqlKg5g6EEpyt/+pdqZ5plyYG0qOlQpHNzE/SUgiGjtz32qqyumf6//5w9K+Y0dvoV/Qb5uKksjK0sUuQ8A==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: mLIKfuTnwd0c8uA9BXg4cQ==
date: Wed, 29 Sep 2021 23:14:13 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
content-length: 388
x-fb-rlafr: 0
expires: Thu, 29 Sep 2022 23:14:13 GMT

GET
H3 200 oUxSCqnrrt9.js Show response
www.facebook.com/rsrc.php/v3iEpO4/yp/l/en_US/ Frame C116 513 KB
134 KB 14ms
7ms Script
application/x-javascript 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3iEpO4/yp/l/en_US/oUxSCqnrrt9.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

ams15s22-in-f161.1e100.net

Software

Resource Hash

4b258a79eb6d925b4dd816e122de102b214dd0839f221a3474588b8bb82cb2b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfaf47de4a5f72c%26domain%3Dwww.mcezone.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.mcezone.com%252Ff2c76becc085254%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&layout=button_count&locale=en_US&sdk=joey
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 01:37:57 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 0g3vZfqdwahsUO4jGmQdWg==
cross-origin-resource-policy: cross-origin
content-length: 137506
x-fb-rlafr: 0
x-fb-debug: 9bRNGspd6/gPMW2Ml3yiNvVq/25J7sVRa/zAMqErcnOHEA1ki5NreoPHpMXPTUSY9kxox5CafKCSJP5cLRH7EA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 02 Oct 2022 01:37:57 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 8297 12 KB
5 KB 39ms
13ms Document
text/html 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.161 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Sun, 03 Oct 2021 22:50:31 GMT
expires: Mon, 03 Oct 2022 22:50:31 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 23472
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D16D 783 B
1 KB 126ms
34ms Document
text/html 142.250.185.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f4.1e100.net

Software

GSE /

Resource Hash

b744e1423935022ea5b106042547dabec2bd074d3b78263e7424983331ab44b8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-vxzBGzP1eR93tgIAqwznFw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.mcezone.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.mcezone.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 04 Oct 2021 05:21:43 GMT
date: Mon, 04 Oct 2021 05:21:43 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-vxzBGzP1eR93tgIAqwznFw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cavalry_endpoint.php
www.facebook.com/common/ Frame C116 67 B
98 B 42ms
42ms Image
image/png 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/common/cavalry_endpoint.php?t_cstart=1633324903827&t_start=1633324903828&t_domcontent=1633324903837&t_layout=1633324903900&t_onload=1633324903900&t_paint=1633324903900&t_creport=1633324903900&t_tti=1633324903837&lid=7015077043237844803-0

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com data: blob: 'self';script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfaf47de4a5f72c%26domain%3Dwww.mcezone.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.mcezone.com%252Ff2c76becc085254%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.mcezone.com%2Fflubot-malware-hits-android-smartphones-flubot-malware-is-attacking-smartphones-what-is-this-dangerous-malware-and-how-to-protect-yourself-know-everything-alert-flubot-malware-hit-android-smartp%2F&layout=button_count&locale=en_US&sdk=joey
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: br
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com;frame-src *.facebook.com *.fbsbx.com;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: no-cache
x-fb-debug: U53ERENf/ulY+nAlG1A1oHThSXXMfipGgwB3wXu5rgLB55eaB4k+HGjZjdkxrt86lYZmXEXpOaMZBPxaXnkKCA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 04 Oct 2021 05:21:43 GMT
strict-transport-security: max-age=15552000; preload
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: image/png
vary: Accept-Encoding
cache-control: private, no-store, no-cache, must-revalidate
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js Show response
pagead2.googlesyndication.com/bg/ Frame 8297 35 KB
13 KB 35ms
23ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS