labs.guard.io Open in urlscan Pro
162.159.153.4 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516...
Effective URL:
https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516...
Submission: On December 30 via api (December 30th 2024, 6:51:10 am UTC) from IN — Scanned from DE

Summary HTTP 81 Redirects Links 80 Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 9 domains to perform 81 HTTP transactions. The main IP is 162.159.153.4, located in and belongs to CLOUDFLARENET, US. The main domain is labs.guard.io.
TLS certificate: Issued by WE1 on November 10th 2024. Valid for: 3 months.

This is the only time labs.guard.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 35	162.159.153.4 162.159.153.4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:7::... 2606:4700:7::a29f:9804	13335 (CLOUDFLAR...) (CLOUDFLARENET)
38	2606:4700:7::... 2606:4700:7::a29f:9904	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:4f49	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
2	142.250.185.100 142.250.185.100	15169 (GOOGLE) (GOOGLE)
1	108.138.26.79 108.138.26.79	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206f:0:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2600:9000:249... 2600:9000:2491:ca00:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02)
81	10

35 162.159.153.4 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

labs.guard.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:7::a29f:9804 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

38 2606:4700:7::a29f:9904 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4f49 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.100 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.26.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-26-79.fra56.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:0:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2491:ca00:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02, US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
53	medium.com 1 redirects medium.com — Cisco Umbrella Rank: 12543 glyph.medium.com — Cisco Umbrella Rank: 26306 cdn-client.medium.com — Cisco Umbrella Rank: 27661 miro.medium.com — Cisco Umbrella Rank: 18542	3 MB
21	guard.io 2 redirects labs.guard.io	82 KB
3	branch.io cdn.branch.io — Cisco Umbrella Rank: 981 api2.branch.io — Cisco Umbrella Rank: 1477	24 KB
2	google.com www.google.com — Cisco Umbrella Rank: 3	1 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3353
1	app.link app.link — Cisco Umbrella Rank: 2501	668 B
1	gstatic.com www.gstatic.com	218 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	100 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 617	7 KB
81	9

	Domain	Requested by
36	cdn-client.medium.com	labs.guard.io cdn-client.medium.com
21	labs.guard.io	2 redirects cdn-client.medium.com labs.guard.io static.cloudflareinsights.com
10	glyph.medium.com	glyph.medium.com
6	miro.medium.com	labs.guard.io
2	api2.branch.io	cdn.branch.io
2	www.google.com	cdn-client.medium.com www.gstatic.com
1	region1.google-analytics.com	www.googletagmanager.com
1	app.link	cdn.branch.io
1	www.gstatic.com	www.google.com
1	cdn.branch.io	labs.guard.io
1	www.googletagmanager.com	cdn-client.medium.com
1	static.cloudflareinsights.com	labs.guard.io
1	medium.com	1 redirects
81	13

This site contains links to these domains. Also see Links.

Domain
rsci.app.link
medium.com
www.linkedin.com
www.guard.io
blogs.infoblox.com
www.darkreading.com
www.infoblox.com
www.digitalcitizensalliance.org
developers.cloudflare.com
www.semrush.com
guard.io
policy.medium.com
uxdesign.cc
kindenvy.medium.com
annietrevaskis.medium.com
entrylevelrebel.medium.com
help.medium.com
medium.statuspage.io
blog.medium.com
speechify.com

Subject Issuer	Validity	Valid
labs.guard.io WE1	`2024-11-10` - `2025-02-09`	3 months	crt.sh
medium.com WE1	`2024-11-25` - `2025-02-23`	3 months	crt.sh
cloudflareinsights.com WE1	`2024-11-01` - `2025-01-30`	3 months	crt.sh
*.google-analytics.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.branch.io Amazon RSA 2048 M03	`2024-08-11` - `2025-09-09`	a year	crt.sh
*.gstatic.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
appipv4.link Amazon RSA 2048 M03	`2024-03-25` - `2025-04-22`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f
Frame ID: FCF997FF852DB76F9CCE6B6ACE6EBE8B
Requests: 78 HTTP requests in this frame

Frame: https://labs.guard.io/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js
Frame ID: 979C968978ABA069ACEE6F4FFADD2196
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Le-uGgpAAAAAPprRaokM8AKthQ9KNGdoxaGUvVp&co=aHR0cHM6Ly9sYWJzLmd1YXJkLmlvOjQ0Mw..&hl=de&v=zIriijn3uj5Vpknvt_LnfNbF&size=invisible&cb=2qbnr05r10ne
Frame ID: 9E0269CF1C7881BCFBA43D01DAD702D5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising | by Guardio | Dec, 2024 | Medium

Page URL History Show full URLs

https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-th... HTTP 307
https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-f... HTTP 307
https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-th... Page URL

Detected technologies

Medium (Blogs) Expand

Overall confidence: 100%
Detected patterns

medium\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

81
Requests

99 %
HTTPS

73 %
IPv6

9
Domains

13
Subdomains

10
IPs

3
Countries

3555 kB
Transfer

6359 kB
Size

10
Cookies

80 Outgoing links

These are links going to different origins than the main page.

URL: https://rsci.app.link/?%24canonical_url=https%3A%2F%2Fmedium.com%2Fp%2F0c516f4dc0b6&%7Efeature=LoOpenInAppButton&%7Echannel=ShowPostUnderUser&source=---top_nav_layout_nav----------------------------------
Title: Open in app

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&source=post_page---top_nav_layout_nav-----------------------global_nav-----------
Title: Sign up

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&source=post_page---top_nav_layout_nav-----------------------global_nav-----------
Title: Sign in

Search URL Search Domain Scan URL

URL: https://medium.com/?source=---top_nav_layout_nav----------------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav-----------
Title: Write

Search URL Search Domain Scan URL

URL: https://medium.com/search?source=---top_nav_layout_nav----------------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fsubscribe%2Fuser%2F6a038e71ff0f&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&user=Guardio&userId=6a038e71ff0f&source=post_page-6a038e71ff0f--byline--0c516f4dc0b6---------------------post_header-----------
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F0c516f4dc0b6&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&user=Guardio&userId=6a038e71ff0f&source=---header_actions--0c516f4dc0b6---------------------clap_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F0c516f4dc0b6&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&source=---header_actions--0c516f4dc0b6---------------------bookmark_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2Fplans%3Fdimension%3Dpost_audio_button%26postId%3D0c516f4dc0b6&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&source=---header_actions--0c516f4dc0b6---------------------post_audio_button-----------
Title: Listen

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/natital/
Title: Nati Tal

Search URL Search Domain Scan URL

URL: http://www.guard.io/
Title: Guardio Labs

Search URL Search Domain Scan URL

URL: https://blogs.infoblox.com/
Title: Infoblox

Search URL Search Domain Scan URL

URL: https://www.darkreading.com/cyberattacks-data-breaches/trick-captcha-lumma-stealer-malware
Title: news coverage

Search URL Search Domain Scan URL

URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vast-malvertising-network-hijacks-browser-settings-to-spread-riskware/
Title: Omnatuor/Vane Viper

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/
Title: Infoblox

Search URL Search Domain Scan URL

URL: https://www.digitalcitizensalliance.org/issues/unholy-triangle-report-propellerad-case-study/
Title: cyber security community in the past

Search URL Search Domain Scan URL

URL: https://developers.cloudflare.com/r2/
Title: Cloudflare’s R2

Search URL Search Domain Scan URL

URL: https://www.semrush.com/website/hianime.com/overview/
Title: 100k+ unique visits last month

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&source=---post_footer_upsell--0c516f4dc0b6---------------------lo_non_moc_upsell-----------
Title: Sign up for free

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fplans&source=---post_footer_upsell--0c516f4dc0b6---------------------lo_non_moc_upsell-----------
Title: Try for 5 $/month

Search URL Search Domain Scan URL

URL: https://medium.com/tag/malvertising?source=post_page-----0c516f4dc0b6--------------------------------
Title: Malvertising

Search URL Search Domain Scan URL

URL: https://medium.com/tag/phishing?source=post_page-----0c516f4dc0b6--------------------------------
Title: Phishing

Search URL Search Domain Scan URL

URL: https://medium.com/tag/cybersecurity?source=post_page-----0c516f4dc0b6--------------------------------
Title: Cybersecurity

Search URL Search Domain Scan URL

URL: https://medium.com/tag/safe-browsing?source=post_page-----0c516f4dc0b6--------------------------------
Title: Safe Browsing

Search URL Search Domain Scan URL

URL: https://medium.com/tag/stealer-malware?source=post_page-----0c516f4dc0b6--------------------------------
Title: Stealer Malware

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F0c516f4dc0b6&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&user=Guardio&userId=6a038e71ff0f&source=---footer_actions--0c516f4dc0b6---------------------clap_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F0c516f4dc0b6&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&source=---footer_actions--0c516f4dc0b6---------------------bookmark_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fsubscribe%2Fuser%2F6a038e71ff0f&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&user=Guardio&userId=6a038e71ff0f&source=post_page-6a038e71ff0f--post_author_info--0c516f4dc0b6---------------------follow_profile-----------
Title: Follow

Search URL Search Domain Scan URL

URL: https://guard.io/
Title: https://guard.io

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-rules-30e5502c4eb4?source=post_page---post_responses--0c516f4dc0b6--------------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&source=---post_responses--0c516f4dc0b6---------------------respond_sidebar-----------
Title: What are your thoughts?

Search URL Search Domain Scan URL

URL: https://medium.com/@nailaabdulrehman8438?source=post_page---post_responses--0c516f4dc0b6----0----------------------------
Title: Nailaabdulrehman

Search URL Search Domain Scan URL

URL: https://medium.com/@nailaabdulrehman8438/great-58d37c135280?source=post_page---post_responses--0c516f4dc0b6----0----------------------------
Title: 13 days ago

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F58d37c135280&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40nailaabdulrehman8438%2Fgreat-58d37c135280&user=Nailaabdulrehman&userId=ad451b61d182&source=---post_responses--58d37c135280----0-----------------respond_sidebar-----------

Search URL Search Domain Scan URL

URL: https://medium.com/@theotao?source=post_page---post_responses--0c516f4dc0b6----1----------------------------
Title: Theo Tao

Search URL Search Domain Scan URL

URL: https://medium.com/@theotao/woaw-a240a123cf15?source=post_page---post_responses--0c516f4dc0b6----1----------------------------
Title: 12 days ago

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2Fa240a123cf15&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40theotao%2Fwoaw-a240a123cf15&user=Theo+Tao&userId=6ebc0d26fcfa&source=---post_responses--a240a123cf15----1-----------------respond_sidebar-----------

Search URL Search Domain Scan URL

URL: https://medium.com/@mbjan143?source=post_page---post_responses--0c516f4dc0b6----2----------------------------
Title: Manan Bukhari

Search URL Search Domain Scan URL

URL: https://medium.com/@mbjan143/good-056d3978fe7f?source=post_page---post_responses--0c516f4dc0b6----2----------------------------
Title: 12 days ago

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F056d3978fe7f&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40mbjan143%2Fgood-056d3978fe7f&user=Manan+Bukhari&userId=b0dd6abd5a50&source=---post_responses--056d3978fe7f----2-----------------respond_sidebar-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F3dd6b5417db6&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fechospoofing-a-massive-phishing-campaign-exploiting-proofpoints-email-protection-to-dispatch-3dd6b5417db6&source=---author_recirc--0c516f4dc0b6----0-----------------bookmark_preview----d6801da2_eba0_403f_ab5b_96aec71aa2a5-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fa2225e51898e&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fscammers-paradise-exploring-telegrams-dark-markets-breeding-ground-for-modern-phishing-a2225e51898e&source=---author_recirc--0c516f4dc0b6----1-----------------bookmark_preview----d6801da2_eba0_403f_ab5b_96aec71aa2a5-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F32024ad4b5fa&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fphishforce-vulnerability-uncovered-in-salesforces-email-services-exploited-for-phishing-32024ad4b5fa&source=---author_recirc--0c516f4dc0b6----2-----------------bookmark_preview----d6801da2_eba0_403f_ab5b_96aec71aa2a5-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F65ea78efad16&operation=register&redirect=https%3A%2F%2Flabs.guard.io%2Fetherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16&source=---author_recirc--0c516f4dc0b6----3-----------------bookmark_preview----d6801da2_eba0_403f_ab5b_96aec71aa2a5-------

Search URL Search Domain Scan URL

URL: https://medium.com/@harendra21?source=post_page---read_next_recirc--0c516f4dc0b6----0---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://medium.com/@harendra21/how-i-am-using-a-lifetime-100-free-server-bd241e3a347a?source=post_page---read_next_recirc--0c516f4dc0b6----0---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------
Title: How I Am Using a Lifetime 100% Free ServerGet a server with 24 GB RAM + 4 CPU + 200 GB Storage + Always Free

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fbd241e3a347a&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40harendra21%2Fhow-i-am-using-a-lifetime-100-free-server-bd241e3a347a&source=---read_next_recirc--0c516f4dc0b6----0-----------------bookmark_preview----78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://uxdesign.cc/?source=post_page---read_next_recirc--0c516f4dc0b6----1---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://kindenvy.medium.com/?source=post_page---read_next_recirc--0c516f4dc0b6----1---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------
Title: Rita Kind-Envy

Search URL Search Domain Scan URL

URL: https://kindenvy.medium.com/goodbye-immortal-design-6d2a70035d14?source=post_page---read_next_recirc--0c516f4dc0b6----1---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------
Title: Goodbye, immortal designThis is the end for Bialetti — an immortal design that outlived and buried (literally) its owner.

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F6d2a70035d14&operation=register&redirect=https%3A%2F%2Fuxdesign.cc%2Fgoodbye-immortal-design-6d2a70035d14&source=---read_next_recirc--0c516f4dc0b6----1-----------------bookmark_preview----78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://medium.com/@wearedelicious/list/tech-tools-541154dfb3ae?source=post_page---read_next_recirc--0c516f4dc0b6--------------------------------
Title: Tech & Tools22 stories·375 saves

Search URL Search Domain Scan URL

URL: https://medium.com/@MediumStaff/list/mediums-huge-list-of-publications-accepting-submissions-7c0ec8037e61?source=post_page---read_next_recirc--0c516f4dc0b6--------------------------------
Title: Medium's Huge List of Publications Accepting Submissions377 stories·4272 saves

Search URL Search Domain Scan URL

URL: https://medium.com/@MediumStaff/list/staff-picks-c7bc6e1ee00f?source=post_page---read_next_recirc--0c516f4dc0b6--------------------------------
Title: Staff picks791 stories·1533 saves

Search URL Search Domain Scan URL

URL: https://medium.com/@AMGAS14/list/natural-language-processing-0a856388a93a?source=post_page---read_next_recirc--0c516f4dc0b6--------------------------------
Title: Natural Language Processing1881 stories·1509 saves

Search URL Search Domain Scan URL

URL: https://medium.com/@anandrishav2228?source=post_page---read_next_recirc--0c516f4dc0b6----0---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://medium.com/@anandrishav2228/learn-cloud-pentesting-roadmap-and-earn-in-100-000-150-000-bf76340ccb68?source=post_page---read_next_recirc--0c516f4dc0b6----0---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------
Title: Learn Cloud Pentesting (Roadmap) and earn in $100,000—$150,000Cloud Penetration Testing (or Cloud Pentesting) involves testing the security of cloud environments, infrastructure, applications, and…

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fbf76340ccb68&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40anandrishav2228%2Flearn-cloud-pentesting-roadmap-and-earn-in-100-000-150-000-bf76340ccb68&source=---read_next_recirc--0c516f4dc0b6----0-----------------bookmark_preview----78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://medium.com/fourth-wave?source=post_page---read_next_recirc--0c516f4dc0b6----1---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://medium.com/@monalazzar?source=post_page---read_next_recirc--0c516f4dc0b6----1---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------
Title: Mona Lazar

Search URL Search Domain Scan URL

URL: https://medium.com/@monalazzar/if-youre-planning-to-leave-trump-s-america-don-t-come-to-europe-5aa04e79bf04?source=post_page---read_next_recirc--0c516f4dc0b6----1---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------
Title: If You’re Planning to Leave Trump’s America, Don’t Come To EuropeReality looks different on the other side of the Atlantic

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F5aa04e79bf04&operation=register&redirect=https%3A%2F%2Fmedium.com%2Ffourth-wave%2Fif-youre-planning-to-leave-trump-s-america-don-t-come-to-europe-5aa04e79bf04&source=---read_next_recirc--0c516f4dc0b6----1-----------------bookmark_preview----78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://annietrevaskis.medium.com/?source=post_page---read_next_recirc--0c516f4dc0b6----2---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://annietrevaskis.medium.com/only-1-of-people-can-see-the-hidden-squirrel-in-this-picture-dab17bd61549?source=post_page---read_next_recirc--0c516f4dc0b6----2---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------
Title: Only 1% of People Can See the Hidden Squirrel in This PictureIn under 15 seconds

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fdab17bd61549&operation=register&redirect=https%3A%2F%2Fannietrevaskis.medium.com%2Fonly-1-of-people-can-see-the-hidden-squirrel-in-this-picture-dab17bd61549&source=---read_next_recirc--0c516f4dc0b6----2-----------------bookmark_preview----78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://entrylevelrebel.medium.com/?source=post_page---read_next_recirc--0c516f4dc0b6----3---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://entrylevelrebel.medium.com/jeff-bezos-says-the-1-hour-rule-makes-him-smarter-new-neuroscience-says-hes-right-84bf0a6755cf?source=post_page---read_next_recirc--0c516f4dc0b6----3---------------------78654051_9691_4075_ae0c_7f970cb9cefa-------
Title: Jeff Bezos Says the 1-Hour Rule Makes Him Smarter. New Neuroscience Says He’s RightJeff Bezos’s morning routine has long included the one-hour rule. New neuroscience says yours probably should too.

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F84bf0a6755cf&operation=register&redirect=https%3A%2F%2Fentrylevelrebel.medium.com%2Fjeff-bezos-says-the-1-hour-rule-makes-him-smarter-new-neuroscience-says-hes-right-84bf0a6755cf&source=---read_next_recirc--0c516f4dc0b6----3-----------------bookmark_preview----78654051_9691_4075_ae0c_7f970cb9cefa-------

Search URL Search Domain Scan URL

URL: https://medium.com/?source=post_page---read_next_recirc--0c516f4dc0b6--------------------------------
Title: See more recommendations

Search URL Search Domain Scan URL

URL: https://help.medium.com/hc/en-us?source=post_page-----0c516f4dc0b6--------------------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://medium.statuspage.io/?source=post_page-----0c516f4dc0b6--------------------------------
Title: Status

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----0c516f4dc0b6--------------------------------
Title: About

Search URL Search Domain Scan URL

URL: https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e?source=post_page-----0c516f4dc0b6--------------------------------
Title: Careers

Search URL Search Domain Scan URL

URL: https://blog.medium.com/?source=post_page-----0c516f4dc0b6--------------------------------
Title: Blog

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-privacy-policy-f03bf92035c9?source=post_page-----0c516f4dc0b6--------------------------------
Title: Privacy

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-terms-of-service-9db0094a1e0f?source=post_page-----0c516f4dc0b6--------------------------------
Title: Terms

Search URL Search Domain Scan URL

URL: https://speechify.com/medium?source=post_page-----0c516f4dc0b6--------------------------------
Title: Text to speech

Search URL Search Domain Scan URL

URL: https://medium.com/business?source=post_page-----0c516f4dc0b6--------------------------------
Title: Teams

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-privacy-policy-f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=132ea9970714 HTTP 307
https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6 HTTP 307
https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 66

https://labs.guard.io/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://labs.guard.io/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js

81 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6 Show response
labs.guard.io/
Redirect Chain

https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=132ea9970714
https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

288 KB
62 KB

492ms
492ms

Document
text/html

162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46d5f583e419ece197ec489d9d89d1e934de1e5e7c9c888856fb950597f2eee1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://medium.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8fa0196acc291d94-FRA
content-encoding: gzip
content-security-policy: frame-ancestors 'self' https://medium.com
content-type: text/html; charset=utf-8
date: Mon, 30 Dec 2024 06:51:05 GMT
link: <https://glyph.medium.com/css/unbound.css>; as="style"; rel="preload"
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, lite/main-20241218-235912-1e3024e5b3, rito/main-20241213-204950-a2cb2a3eef, tutu/main-20241216-162301-91c2bf1b82
medium-missing-time: 190
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-envoy-upstream-service-time: 358
x-request-received-at: 1735541464860

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8fa01969ee32dca8-FRA
content-length: 0
content-type: text/plain;charset=UTF-8
date: Mon, 30 Dec 2024 06:51:04 GMT
location: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
worker-missing-cookies: 1
x-content-type-options: nosniff
x-envoy-upstream-service-time: 17

GET
H3 200 unbound.css
glyph.medium.com/css/ 19 KB
2 KB 24ms
24ms Stylesheet
text/css 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45dbf060ec052a3b0ca5ae7211eaa27c950db65b019aa456e1e686a85f8a327e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 2846
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 08:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: text/css
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
cf-ray: 8fa0196dd962901c-FRA
access-control-allow-origin: *
server: cloudflare

GET
H2 200 manifest.48bdf878.js Show response
cdn-client.medium.com/lite/static/js/ 13 KB
6 KB 60ms
51ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.48bdf878.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65b06113767b237340b84c1a780ccb8cae2543a752b8e048468caa20874a756d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 1a_IPaDFFc2zGH2M.itf2vE6nIZQhVyb
etag: W/"be390f2979c2ebd2b40df7cee3aa7952"
age: 346784
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Mon, 16 Dec 2024 14:44:28 GMT
vary: Accept-Encoding
x-amz-id-2: yL0zqgDz+V8RTrYb3F2o1xr0DPIjCSIGH2YEK9mSt89TNfNAYYpGoZUmF7M8staOeM3TySa6nBU=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: 9VZFXWRGW4EBV1GD
cf-ray: 8fa0196e0a956916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 9865.1496d74a.js Show response
cdn-client.medium.com/lite/static/js/ 618 KB
192 KB 63ms
54ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b436fafd50c4a34bb5478d817e964e3ee611849abbbe6557063140f9555f8931

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 961vTxAP_4lmeUByLjRWeGFpTSLxcslW
etag: W/"cc9a9e5111ad77aabf3f379d0135b3cd"
age: 363037
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 22 Aug 2024 12:31:40 GMT
vary: Accept-Encoding
x-amz-id-2: ky3JGQHkQllWURjjDzzwuVLDYJc9B2UPksocizMRI/gHST9Q9xqD+9vq2pEJyWb5zSdyF6K2BnoJQnx0tf6PABNTBaIF7a5zAOaNF58pvq0=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: 7X1PP03KVMDCHZDA
cf-ray: 8fa0196e0a986916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 main.872afbe3.js Show response
cdn-client.medium.com/lite/static/js/ 879 KB
202 KB 75ms
67ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.872afbe3.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1e3f148494df431f833926a1b42d57a4530db288a93cf6fd798035f190f7f56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: JhmteJfMakbh4Y0IsuJZZ_CJNoIl78wH
etag: W/"e2bddb0fadfe6ea204971c5e844d63b0"
age: 528345
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Mon, 16 Dec 2024 15:28:46 GMT
vary: Accept-Encoding
x-amz-id-2: oLJwh06w1x/HPWPPZ+dtOnHhE6pGFV7dNS3gpLdIvQKYoI0LOd4xCVKhMX8gvXjvORvI69rzSu0=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: XAR1YB3EVKA3TJTX
cf-ray: 8fa0196e1aad6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 instrumentation.d9108df7.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 3 KB
2 KB 54ms
46ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/instrumentation.d9108df7.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3edb3930e433b6ee76c26ed156d44196652363b4fa881a3e140b3e0b43d2a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: .o.5Xe59BjAug.2i7CIo5xR8KvX9Uh6Q
etag: W/"4d3916cdf704b083082b21a733ef176c"
age: 351836
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Mon, 01 Jul 2024 15:12:51 GMT
vary: Accept-Encoding
x-amz-id-2: +z2nSFjHfEyFZk/4ZCuJS4PTpZNZ0rRcvYyU34AA0AabBIHrXZyieOhJksEhWp6Q32HQFR3ezMzlhvDXqkQjMtST9o4TtdekDT+z+pk6sjI=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: 3DEY2A645TBKTXZ4
cf-ray: 8fa0196e0a976916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 reporting.ff22a7a5.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 1 KB
916 B 60ms
52ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/reporting.ff22a7a5.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eada6d1c06b5d675e0c143a2fbef8bf83e3060e9ba20ceeb37ec9415ce9bdbaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: WdqYVC5hKfoxJxknk7bO0he3xYL6sW.H
etag: W/"d5998f5c1de61a2837a52be8d7d89310"
age: 449438
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Mon, 27 May 2024 12:15:10 GMT
vary: Accept-Encoding
x-amz-id-2: NhwC05U1cO1uqH3uV0AZIt8iJwQsy+pdjZgT1jxmHL4zvP1RyphOB3n7bOzc66MiGe0qg1HAqXo=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: C2M95N2H1Y56ZQJN
cf-ray: 8fa0196e0a9e6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 5049.d1ead72d.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 28 KB
12 KB 36ms
28ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5049.d1ead72d.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3985e3779ce6d21045b715324bc4837fc966d0c762a479e5da9764b438e41d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: lXRfPpt5JdTbUioBJcZxfOnTjjaqCp3p
etag: W/"c5c86c25fc0ad2a68f611bb580b457bd"
age: 529133
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Tue, 02 Jul 2024 17:39:38 GMT
vary: Accept-Encoding
x-amz-id-2: X+sc+0j1XCZzFg8n4lZsA1tbHCDUewAx+qQQjKeTjknaDZ3wcECmH0dda/llSYEO/bI66UTr4oI=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: GHRS0Q5E0MB1WD2K
cf-ray: 8fa0196dfa816916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 4810.6318add7.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 6 KB
3 KB 60ms
52ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4810.6318add7.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1e3543a0133bd553f2dcd79a947b6eec53c2b16c46a3ebb63a77283ed0768f39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: yL6ku3JinKR_0fAx.RxWdA0QoAz1R0iH
etag: W/"fee516db8548635142e0001d18f09104"
age: 271171
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Fri, 16 Aug 2024 20:57:37 GMT
vary: Accept-Encoding
x-amz-id-2: Byv/Ea20oN/U4bKkrjLgb5K0aWmf2i539zPkQQZOQYxCSpNCnmWdeCh47aWxU1PeO/nIiyvzv199SZvonYAUxfjQz4W3mVY98d30Jh3FvNE=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: A7S41A76GNEG447Z
cf-ray: 8fa0196e0aa06916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 6618.db187378.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 3 KB
2 KB 61ms
53ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6618.db187378.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12c333a76ec82d35a4541956e0e8b4591b55d76f1d1ee4e47f3dd0ec33229e43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: ZwCMHuCQ5h9dAQvOvOTD_48maUvIlL_r
etag: W/"7bbe09830788bb18d63591d1a7e255ce"
age: 262317
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 04 Jul 2024 13:33:59 GMT
vary: Accept-Encoding
x-amz-id-2: KuBVMW1uunWyx1g6WUs6yf0yKxxi1kuHurXR6laloc8XpToHWdcLly47pk+uxqv1bv+X69bBw94=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: PFS92D688QMNAJKE
cf-ray: 8fa0196e0aa16916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 2707.a4e221ac.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 13 KB
5 KB 63ms
56ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2707.a4e221ac.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0e25c79be454504b1a69e6c701dd4c0d88511ca6a4275502cddd29b2e37f853

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: c_mp1mIuAyoYWx51fV1ZU62WC2hZ_QZU
etag: W/"92b130b8745cc2edf98a97c2480ad37c"
age: 301822
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:46 GMT
vary: Accept-Encoding
x-amz-id-2: QrmfCeUgZkyzIuxiqNz6AHuwEj+4YRvjIggmkIkc9x4ObRPs3yNqayFFg7rIqBuRjogIz4pD8kw=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: E2R5117CF1AQ70P3
cf-ray: 8fa0196e0aa26916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 9977.933c1c9a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 9 KB
4 KB 39ms
31ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9977.933c1c9a.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e1c65ae1bee1318c629db0d7d24f5ca778f8d65d18a1c654c6279698774b049

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 7wxLh8KNJqtJ5_kaLYr2H3EHhWgXxGeF
etag: W/"f907a3c5fa2743fdec31448b826a3ce0"
age: 170030
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:54 GMT
vary: Accept-Encoding
x-amz-id-2: NhCs0wwkLwhSDd6JNE3FN9oqkp9OdkMu69dq5D1whutboW3EN++R4qiXIXpLvPcFBMDfETgUsT4=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: FQM5HZ3EKGE0WAGX
cf-ray: 8fa0196dfa826916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 8599.73cb8339.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 9 KB
3 KB 36ms
29ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8599.73cb8339.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e634d6f7cedddaff3630e4d1235df9dd2ae4e26153338afcc2b0abfe070c4eb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: H0tpgM0L8PB6Uwi3eEUA8JrnBK4YztYp
etag: W/"eaed4909d5b59be3ae12da40eacce3df"
age: 91083
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:53 GMT
vary: Accept-Encoding
x-amz-id-2: 8kK/MyIHDnqhWO2miO6RkLVRwUuZt3inLQx5ZkuQvZ5369YZE7PyAYNQACIpPMw+30wKBqZ663A=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: ZT4WYF5PN9ZY4WPA
cf-ray: 8fa0196dfa836916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 5250.9f9e01d2.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 33 KB
7 KB 37ms
30ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5250.9f9e01d2.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c526ee08811f04d7f0d5b393cd69c73d19d9fffe61773071deef3f364f00fa9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 21R8z5oaOHicCDfQ9u19rdxA8jsmxuEX
etag: W/"559305b0cc3ed475000d0105eef44baf"
age: 535860
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Tue, 17 Sep 2024 20:25:41 GMT
vary: Accept-Encoding
x-amz-id-2: D/scwHinK3l+wezRD3YtDsfwX+O4Ri3JQE16cZazyCedNJAUS6moeReKJOjIvpRIXra4rxzzhvA=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: HYGZ25460ZP7JH6A
cf-ray: 8fa0196dfa856916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 9898.d9e26c5e.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 22 KB
6 KB 37ms
30ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9898.d9e26c5e.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7bbe9729aea4e1cc625dd0599b5f1ff38e077219318b0c4e066f8acebb56b0a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: mhUsVDjQ8Hx4qZcKvpAA5.3mngufi8N4
etag: W/"81b9d228bb39aff05b51462d00c87345"
age: 436028
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 19:03:38 GMT
vary: Accept-Encoding
x-amz-id-2: R30tQPv0OMmHo6FFwfJrbyJGEBfETto7UXNYP0fnwGOTcT07zHVEkqoZOEiEB1/RX2R31JvhjQo=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: DE41Z1CXG5X0BSTK
cf-ray: 8fa0196dfa866916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 2648.26563adf.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 13 KB
4 KB 59ms
52ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2648.26563adf.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57291da4c35041eeea04c8e251fd16bbf673f2f1322ce08a88411bf23c0ae6f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: Dg71tHMESiDiyad9_ofwQFtIM_W.JfWh
etag: W/"b5fedea948f4858727c9357b5baefaed"
age: 434277
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Tue, 08 Oct 2024 15:24:24 GMT
vary: Accept-Encoding
x-amz-id-2: UgotwUB254EG1pP3mzeEDn1NF+/6s7VIxrGHri4Cf0C4QvxpOJfIRXN306fINJuMkg3Vr2YsAmE=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: N5TXCDH02XH3HWKE
cf-ray: 8fa0196e0a9a6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 8393.826a25fb.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 21 KB
7 KB 60ms
53ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8393.826a25fb.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6903f50388d3d1ad9b3e67033f700ba4ff5b89f89e80fdd7c04b427daa6b4c72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: _6xkcoUI57wT1Jb5c2gsa3tBJ9OYEVsu
etag: W/"d5bcd37fbd5aa3233a9aec731befac41"
age: 431511
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Tue, 08 Oct 2024 15:24:31 GMT
vary: Accept-Encoding
x-amz-id-2: Rrwh6Q725/US/bBUm9Mi7tN624fQsz/tTpo1KQkm3bGEcnu+N76edDrlfb3Gx0chQT4vSxu0DC8=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: 4AN6P2NAD801PMWT
cf-ray: 8fa0196e0a9c6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 4863.28ab43f6.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 28 KB
8 KB 63ms
56ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4863.28ab43f6.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6117f6757bc371c3235bf86ac2c5765800bbc7e6d56b1b303f9fa21a62c03d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 2Nvj7dNi3wJRP6pNA4MXf4oDetF6_k3u
etag: W/"b64e9818435312d2f9e06468c3d096fb"
age: 536791
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 20:24:57 GMT
vary: Accept-Encoding
x-amz-id-2: Ux5xAkBKF71uqEq0Jj+KA5n7AFlcMaIeDI/47GBMYgUS3/DO1D1D7g7AkoiFuMUfl+JX/3uyrPw=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: ZDKJY5X5R30476S6
cf-ray: 8fa0196e0a9d6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 6589.247b1d02.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 64 KB
16 KB 54ms
47ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6589.247b1d02.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6fe46ed9b725526a3df9099621591ce778f335a2bd590eed8c05bb04d3004148

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: vAgbv0BkR0koLOY4d93gENrSAixSK4uj
etag: W/"4f302814a20296c54cf825103a0a7cc2"
age: 349785
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:51 GMT
vary: Accept-Encoding
x-amz-id-2: ufA1EllVCL8WIJOtrx0FaHFyNxM66LreqlQ6I1ul1kRIiA4H+iRT6oGKLEK8nAjtsJ05cryDJHk=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: E2RA17QHMJAWV2JP
cf-ray: 8fa0196dfa876916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 5642.0f82ef97.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 23 KB
8 KB 48ms
41ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5642.0f82ef97.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07df63a85bbe08da7d74d041dd785652040ecdf20add2a22791523975be0cb06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: iYYd0wdNrke5eFZSU33AwuHmBoUVi.iJ
etag: W/"69cd47d061d59f74e68a93a6b3fdeae6"
age: 301822
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:50 GMT
vary: Accept-Encoding
x-amz-id-2: 0JpvPPm25AEXmKd1kZMFcLVzQxyX3ohl7PoRw94nJG62OfJ/iGUUMBoaf4oFH/CECCLYGGlHYKs=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: E2R47CTMHZV2QV5S
cf-ray: 8fa0196dfa886916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 6546.cd03f950.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 134 KB
36 KB 44ms
37ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6546.cd03f950.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cc38817027860ed5e04f9e11e01cac05094175d8d4c87caac335dde7d10e7a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: MYjLVaBNF99bOHh1B3EzIlWdqdlBo8U3
etag: W/"34e298e305719d7f87d7a4901a792fa3"
age: 271385
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Tue, 17 Sep 2024 20:25:43 GMT
vary: Accept-Encoding
x-amz-id-2: 8Sjp1nc9yuBQh2OCkmlhQzgz6esQIynmzh7l/wEA84R8EVhw2pfNIwr9pkuOov2EKx9cR5dtaho=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: BDC9FRHHKYWPV6G5
cf-ray: 8fa0196dfa896916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 6834.8aa8d357.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
7 KB 49ms
42ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6834.8aa8d357.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

962dea3467b0f154420709829450f21ff6efa600704c954fde551bcd78d1ae3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: M6AwjBLlLMwjTizoml95tCJn9TUMD8Bx
etag: W/"83752408b961bffad1988be2d7bb5cdb"
age: 517828
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Tue, 10 Dec 2024 17:37:24 GMT
vary: Accept-Encoding
x-amz-id-2: 4acnMzJI5CLGG6TGK17wmUNMXqcCdgkhBca1qE1rV0H4jF+cHy2ZNnKqzIa+ahXC0fSmqN152wFlBst6CyNzEA==
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: M69YNP0JSYAKJF1Q
cf-ray: 8fa0196dfa8a6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 2420.2a5e2d95.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 25 KB
4 KB 46ms
39ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2420.2a5e2d95.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

760cb9c0454718a324890d0be2f00c4fe36408c4a67e7b32d979f0600173928f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: y95e8KcIPrnBZaKU40GIcXfcYxwUd1G9
etag: W/"d8f65a32188a5773f2713086e105e6a7"
age: 352872
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Wed, 30 Oct 2024 20:32:57 GMT
vary: Accept-Encoding
x-amz-id-2: LaxOCXIlUvdFMDWhkZMfaX0KbxNyEbJaXk4Z9fCqXlQ23MKM3hUPkeZPvb7qiAHWAY8c1QCGNNU=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: NQ9874EVKKTXDTY5
cf-ray: 8fa0196dfa8b6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 839.1c286b32.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 26 KB
10 KB 47ms
40ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/839.1c286b32.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2eefa0c79ae536591c09f0825fe70c977a822b215422ce50102e05f6174a8096

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: hVz0e04Wk6kXmPYBA.BFFLyU.VghuswD
etag: W/"f149d4462ed93e8e7f0b07c66fe171e4"
age: 345593
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:52 GMT
vary: Accept-Encoding
x-amz-id-2: Tjo1mxv0C8JGa+tGjSzGxT9aJK3Hm8ascCHYM24MWBy9myiJrfBG5tZ5GySZ95y8omLzqrPUIUU=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: E2R7PPG3WN1BF3XC
cf-ray: 8fa0196e0a8d6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 7975.60bcefe8.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 8 KB
3 KB 48ms
41ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/7975.60bcefe8.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

983906e1c4e9041ef5259d8d3168bf91bd009b385fee92eb9566b8ec5645e934

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: k8mIS2PZLx9sbcbX.C0YSY.BDS5KoooA
etag: W/"78fa3475c323ef0f146d61c0d7e5636f"
age: 450185
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:52 GMT
vary: Accept-Encoding
x-amz-id-2: Tvs9Up1x9hbsHkt45LMm7X7iyEOOkgPt5seRe5GLltUReVWNkY1fV06Mm0oqrazUwaT+wjs2SMM=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: E2RAGDN3GDPJNVAS
cf-ray: 8fa0196e0a8f6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 2106.0350840b.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 19 KB
5 KB 52ms
45ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2106.0350840b.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10050d9ac4f3c23f08fbf5902c23fe01fbadbae74c8b72ce6c58589e404b0c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: .1AyessM4F9YqzJ2ZNFLnByez2kzedxf
etag: W/"a6a29f007baf539f769b128bab39bbf5"
age: 523521
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Mon, 09 Dec 2024 20:16:59 GMT
vary: Accept-Encoding
x-amz-id-2: KjhY+nYQhO7tNFOf2mQF7GuqXYVBM9E2UWwWj1BrZx7ow11gSqd0baxj4+aniwhEr3HSc7MhmKw=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: HK3M8JJETW04JDCC
cf-ray: 8fa0196e0a916916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 7394.73a57633.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 53 KB
18 KB 53ms
46ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/7394.73a57633.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f8b9aacde1287587f8777f1da7b109ca441d3c5f35cbbad562bde755619e41b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: Zxw0tkKPmSz0BNX.qubevBmxBtWJV6Da
etag: W/"8005414673d99def4f4fa2fe98dc6891"
age: 435673
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:51 GMT
vary: Accept-Encoding
x-amz-id-2: s7HLYJvXKjAHYjRdGUtHIqx8azG75YT5qwimmuberLqm8mlNkQC2FxIubTJFazQAdF8IbEKVxuQ=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: E2R4YPN3WVWB52NS
cf-ray: 8fa0196e0a926916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 5794.9e8ff5dd.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 23 KB
7 KB 58ms
51ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5794.9e8ff5dd.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

332d6bf140a58a273d7822739a9c0d743de3ff02dc560b9639c5d00d35cf6ffe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: sIOvbNM1Ckr6O8uToAzZTl966Xq0VP.c
etag: W/"e8bbf072b7456c90591046edd2a23ff4"
age: 297614
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 19:04:59 GMT
vary: Accept-Encoding
x-amz-id-2: PqAL6SazY4u4Hw7Ch5G7NdiAOcrrdShkSRtuYihr9QmVJd6udlcVEKNdt6edHJikORPSjz4Y6nqe1JrAAM/UI1GzcB8hyWaktj8QySTmTMA=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: NSTE1Z74NQ549KGC
cf-ray: 8fa0196e0a936916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 8204.7749bc66.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 39 KB
6 KB 60ms
53ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8204.7749bc66.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

033d6d9a6111f3b69923e7cec931f1827de2cbd0c37bcdeb898dc5b71b8f1c4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: pDXCstkeX6wXIv.n0tOPW0MXsJSXGRP7
etag: W/"0d388150a8346ae489ab35c646d6ac61"
age: 430221
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:52 GMT
vary: Accept-Encoding
x-amz-id-2: /B2RLEe/ZLk1IxmcJfAmxtedFqXWe1o/3/bUFOBb4YCW1A1ECU9BwzL/9Y8nWvMjU5xGfLiEsq4=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: E2RFT7SBVS29S7XG
cf-ray: 8fa0196e0aa36916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 4391.59acaed3.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 24 KB
7 KB 62ms
56ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4391.59acaed3.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bde116ab519b4d0da72e48403035e2dc408f9baab3b829c59b5cca8b75a5b03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: z50cGdf89dT8LWKW28ub_XfUlKXskRgH
etag: W/"40e962a4338753f39b26019883addfe2"
age: 18801
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Tue, 17 Sep 2024 20:25:40 GMT
vary: Accept-Encoding
x-amz-id-2: KLzsNs22/7W4wLXgGD3xl5xL2TSN8dyUD5SoqbXp5BSNcXlRhrkcRmgQb9QaXaUmDjChR1XP7GEPR5I4zvQ5+wHUkspB7hQApynP2dqnTzE=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: JZVEX5DGH814S5RE
cf-ray: 8fa0196e1aa56916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 PostPage.MainContent.2dc8b1c6.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 196 KB
43 KB 62ms
55ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/PostPage.MainContent.2dc8b1c6.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

454bc523caa85bc20ef259d9fb8e309d9fed9fb117dd31bc3bc75165d90a7dc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 5A8FLO_ErdhG4O2LrJrvXWPdPbstJfXS
etag: W/"7eb38a7e859f4dd3e35584471f2e2525"
age: 6440
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 20:54:50 GMT
vary: Accept-Encoding
x-amz-id-2: Tq50T3qdET1k0mS/3pchmMFHnUPa5LQ96A5+BDl2tXaF0lMyUvt+0XsZB+CJa/A2YtrTrRn5XtiomgCHfxlku0u6GVUDM49omWGxUSdlTL4=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: 7808ENGEYJMJ2M5V
cf-ray: 8fa0196e1aa76916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 8414.6565ad5f.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 191 KB
52 KB 68ms
61ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8414.6565ad5f.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

349f1d96fb1d40d020bbfa84ff666a4774ec59ceca7c83350c2177e3f51d280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 7P1J9AXtUQDZeWmZscvPEB0shzre3VUC
etag: W/"ddfc06291f86c1a0027a1241ea3f6c7e"
age: 528360
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 06 Jun 2024 12:33:07 GMT
vary: Accept-Encoding
x-amz-id-2: ARBIenWtA921L07QzzIXy/27EHSv6Mt454veQrH1pGyQq7Y42xzewZyvFYQ5DYMcOUWDOhOvTQE=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: WDJN5ZKYGVTEMPH4
cf-ray: 8fa0196e1aa86916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 3974.8d3e0217.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
8 KB 73ms
67ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/3974.8d3e0217.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb40a15715435f35f41cfa1072f99186f039e11c935d21722d426a513cfdbeb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: Ye6ydUPwPOvQsdvqw6PJeYAyt9Q_1VUp
etag: W/"2c2fb6b63947eef1dd3c3cae62df7b84"
age: 83274
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Wed, 06 Nov 2024 22:02:54 GMT
vary: Accept-Encoding
x-amz-id-2: X2LPYvVs+Ekf9JKQer+ckvvcVTOqVDondog+KrfcJCTlOMMIiXR2XQKhYSy/u2XKUc1cn16FlaI=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: PKXN4E2A9VGMN6E1
cf-ray: 8fa0196e1aa96916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 2527.d5e0c2f5.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 85 KB
24 KB 73ms
67ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2527.d5e0c2f5.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99ce92a575272b3ebd1f8ee0005388b792ff8139959c3cab7a6f2d6a54ebfeaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: BmEEA6g98LP_zfaM_0w7Dm_7zEtK2Mwy
etag: W/"9613387b67f422a5551154136f3e0708"
age: 301821
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:32:46 GMT
vary: Accept-Encoding
x-amz-id-2: P6VeA7tGbDFeK6lZQJX74znf3zka0FTkUOvD1Pf5dHuFtPQ4/aI0WCRgGGL9Y3N+WZTIZcEWYDU=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: E2R2CGE0J84EWSEP
cf-ray: 8fa0196e1aaa6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 PostResponsesContent.7ad7ca92.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 13 KB
4 KB 70ms
64ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/PostResponsesContent.7ad7ca92.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84ca5b6f957866c2f06f1bacbbcaefe44c5e92d74dcfc932de7f225ffa8396d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: rKIfxdnTqPf4COG1l_ZIeCYbckyoi.1L
etag: W/"a15d9f560d2a97cee396d5e72a09c228"
age: 449718
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 12 Dec 2024 18:33:07 GMT
vary: Accept-Encoding
x-amz-id-2: IrK1OlcLTrk3tYDjYAmPfojXIQ8hYLG/7knH1lsVa0VKPlczEYT99Cay161fYGxCXoloAdc3l+s=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: Y78Q6EJ6XGCRKZ32
cf-ray: 8fa0196e1aab6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 responses.editor.5a11f4da.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 16 KB
6 KB 62ms
56ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/responses.editor.5a11f4da.chunk.js

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

03650f29ed19b8bf7c6a8e728f0c2f670f81750eb2ac05b58a764d29a84dc64e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: vJBYlw6moQ_a4eIhfwNhZWHREdiuERMR
etag: W/"0ff7b02d8fdc32318dc0a198ee791076"
age: 528344
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Thu, 21 Nov 2024 20:00:39 GMT
vary: Accept-Encoding
x-amz-id-2: XdvgbXTeksXWEPEMiXaGE/CXVFl+19c9HevwQplZAa8qTyDtbNi05JiAwHNYp8JmfSIxMRy+R/Q=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: JMMRT35FBDH641WS
cf-ray: 8fa0196e1aac6916-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 38ms
21ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 8fa0196e0a103689-FRA
access-control-allow-origin: *
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 sohne-400-normal.woff
glyph.medium.com/font/b492c44/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
13 KB 111ms
101ms Font
application/font-woff 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/b492c44/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f6e7bfd316a160cd611c23c79c3d0cf8fcbfe22e16592f4afffd03eedf45756

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://glyph.medium.com/css/unbound.css

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 1183948
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/font-woff
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 20
access-control-allow-credentials: true
cf-ray: 8fa0196e4bb88edb-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 sohne-700-normal.woff
glyph.medium.com/font/cf896f3/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 13 KB
13 KB 110ms
100ms Font
application/font-woff 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/cf896f3/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-700-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d63477fd28c0476d71f7d94269d37ebc13ee81002807b40bdcee28351da2019

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://glyph.medium.com/css/unbound.css

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 1193084
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/font-woff
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 17
access-control-allow-credentials: true
cf-ray: 8fa0196e4bb68edb-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 source-serif-pro-400-normal.woff
glyph.medium.com/font/8e059b2/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
12 KB 63ms
53ms Font
application/font-woff 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/8e059b2/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-serif-pro-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7cb0607a963a4d571ab612d010e4c124c2bb4cc0fd27048efa5f92eedab98ebe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://glyph.medium.com/css/unbound.css

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 856278
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/font-woff
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 14
access-control-allow-credentials: true
cf-ray: 8fa0196e4bb58edb-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 source-serif-pro-700-normal.woff
glyph.medium.com/font/b156742/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
13 KB 61ms
51ms Font
application/font-woff 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/b156742/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-serif-pro-700-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b579cb06b725609666aeb9fec66152efd7e687c9ba13096c2ce7c1db44c82558

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://glyph.medium.com/css/unbound.css

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 1193084
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/font-woff
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 16
access-control-allow-credentials: true
cf-ray: 8fa0196e4bb38edb-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 source-serif-pro-400-italic.woff
glyph.medium.com/font/76c214a/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
13 KB 60ms
50ms Font
application/font-woff 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/76c214a/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-serif-pro-400-italic.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7725f2e70b6a54d4e4f93c2ea20bdc4ac549a289a806828e73dfcd3a2969b870

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://glyph.medium.com/css/unbound.css

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 1183948
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/font-woff
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 15
access-control-allow-credentials: true
cf-ray: 8fa0196e3bb08edb-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 source-serif-pro-700-italic.woff
glyph.medium.com/font/7f2eb60/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 13 KB
14 KB 63ms
52ms Font
application/font-woff 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/7f2eb60/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-serif-pro-700-italic.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

977eec4907b2febc92ad36328ad86edf074e4a4e2d8476a2db9a2001b9a6cadb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://glyph.medium.com/css/unbound.css

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 1193084
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/font-woff
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 20
access-control-allow-credentials: true
cf-ray: 8fa0196e4bb48edb-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 source-code-pro-400-normal.woff
glyph.medium.com/font/3bd49b7/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 7 KB
7 KB 38ms
28ms Font
application/font-woff 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/3bd49b7/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-code-pro-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07e3ee7afcbc3462ebf2164763c7f050fc4195d5efa4b039646ae0192c49e2fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://glyph.medium.com/css/unbound.css

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 1183948
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/font-woff
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 16
access-control-allow-credentials: true
cf-ray: 8fa0196e4bb28edb-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 sohne-500-normal.woff
glyph.medium.com/font/df9ba7f/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
13 KB 39ms
29ms Font
application/font-woff 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/df9ba7f/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-500-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45bd34ce2bf3511cc126b1b12bc1597486e925141c10b05627857cb79810140c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://glyph.medium.com/css/unbound.css

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 1183948
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/font-woff
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 18
access-control-allow-credentials: true
cf-ray: 8fa0196e4bb18edb-FRA
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1*dmbNkD5D-u45r44go_cf0g.png
miro.medium.com/v2/resize:fill:64:64/ 1 KB
2 KB 41ms
31ms Image
image/png 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:64:64/1*dmbNkD5D-u45r44go_cf0g.png

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d19259478cca4381bea7e760845de9bcf2155ee96cd8b06049add894022d3

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

x-request-id: 1b061076-198b-4a51-ac36-e9dd53c3d8e8
cf-cache-status: HIT
etag: "qUlGJkYhB4LINmyi_TVOvM25Dy409gGbmK5EqrHhPd0/RImNiNjU3ZGRlN2RhNjI0NjU3YTVmNmQ0ZDdhNzEyMDM3Ig"
age: 358027
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: image/png
content-disposition: inline; filename="1*dmbNkD5D-u45r44go_cf0g.png"
medium-fulfilled-by: miro-v2/main-20241125-190609-795bd7e319
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: script-src 'none'
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 37
cf-ray: 8fa0196e3ab56916-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1310
server: cloudflare

GET
H2 200 1*s7SJaF9dODo7rWqa2rFQ6Q.png
miro.medium.com/v2/resize:fill:88:88/ 6 KB
6 KB 42ms
32ms Image
image/png 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:88:88/1*s7SJaF9dODo7rWqa2rFQ6Q.png

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3177c0013737d38f7a9fc5f06b3e7ba3d6d7ea0d02406d8c5beb176d26b701ab

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

x-request-id: 18d0b395-e39d-4ca8-891e-248899ee5f68
cf-cache-status: HIT
etag: "9ivaNyhTKaKecaYmZr68Fn9V98S0df7YQu7TMR33mwc/RImIzYjQ4OTY4NWY1ZDM4M2EzYmFkNmE5YWRhYjE1MGU5Ig"
age: 243223
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: image/png
content-disposition: inline; filename="1*s7SJaF9dODo7rWqa2rFQ6Q.png"
medium-fulfilled-by: miro-v2/main-20241212-224453-ca902b15cc
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: script-src 'none'
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 161
cf-ray: 8fa0196e3ab86916-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5653
server: cloudflare

GET
H2 200 1*yc_P9igPa1fOFQB7Cr_JBg.png
miro.medium.com/v2/resize:fit:720/format:webp/ 25 KB
25 KB 44ms
34ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:720/format:webp/1*yc_P9igPa1fOFQB7Cr_JBg.png

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53177e56ade1da3eddade4fc20d235125a915aba11679e6a2ff5aa67cc879a03

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

x-request-id: a450963d-ade8-46c8-ab6b-63d80aea2da8
cf-cache-status: HIT
etag: "YXzh1miX4qndlYVobhq_bxorivcuaUlJ2JfvURNm1xU/RImM5Y2ZjZmY2MjgwZjZiNTdjZTE1MDA3YjBhYmZjOTA2Ig"
age: 556389
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: image/webp
content-disposition: inline; filename="1*yc_P9igPa1fOFQB7Cr_JBg.webp"
medium-fulfilled-by: miro-v2/main-20241212-224453-ca902b15cc
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: script-src 'none'
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 761
cf-ray: 8fa0196e3ab66916-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25492
server: cloudflare

GET
H2 200 1*g2QpNZJcXv1zXSaso-uy8w.gif
miro.medium.com/v2/resize:fit:720/format:webp/ 2 MB
2 MB 47ms
37ms Image
image/gif 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:720/format:webp/1*g2QpNZJcXv1zXSaso-uy8w.gif

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ffb591ef51edd1982c3f5f393508eceb2a8a964e76ba1f794e97ebf06499955

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f

Response headers

x-request-id: 9fd8700b-8c58-4655-8d5d-a3639e8fa4a2
cf-cache-status: HIT
etag: "83642935925c5efd735d26aca3ebb2f3"
age: 474821
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: image/gif
content-disposition: inline; filename="1*g2QpNZJcXv1zXSaso-uy8w.gif"
medium-fulfilled-by: miro-v2/main-20241212-224453-ca902b15cc
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: script-src 'none'
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 97
cf-ray: 8fa0196e3ab46916-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1983713
server: cloudflare

POST
H3 200 /
labs.guard.io/_/clientele/reports/performance/ 0
0 136ms
135ms Fetch
text/plain 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/clientele/reports/performance/

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.872afbe3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Medium-Clientele-Client: lite
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
worker-missing-cookies: 0
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 14
x-content-type-options: nosniff
cf-ray: 8fa01970bb903631-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, clientele/main-20241212-224453-ca902b15cc
priority: u=1,i

GET
H3 200 11.51005c90.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
8 KB 24ms
24ms Script
application/javascript 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/11.51005c90.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.48bdf878.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0451a587442fca6a380afc042f676122b442146e9aa1feae9e49b0e1151a4d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: 36cCO0pOnWiejNqRlW7IWOfErAeUvPZN
etag: W/"05baeb0cc66e723dd05d50bed964c411"
age: 1129222
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Mon, 27 May 2024 12:14:27 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-amz-id-2: b96Wr8ZbJZD6PIt9mufqf89MzBCV2VpFRRuH0Ji25BAU0Dcg/93vs5SYpZpYzIreIZw20uopdjk=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: 09AGN793A0QBNJEE
cf-ray: 8fa01970baa2901c-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H3 200 /
labs.guard.io/_/clientele/reports/performance/ 0
0 139ms
137ms Fetch
text/plain 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/clientele/reports/performance/

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.872afbe3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Medium-Clientele-Client: lite
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
worker-missing-cookies: 0
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 14
x-content-type-options: nosniff
cf-ray: 8fa01970bb943631-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, clientele/main-20241212-224453-ca902b15cc
priority: u=1,i

GET
H3 200 GiveTipButton.7aab6761.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 5 KB
3 KB 20ms
20ms Script
application/javascript 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/GiveTipButton.7aab6761.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.48bdf878.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3cbe11384e7d7c8b3d65a7ef12d1ad010a5fd8ca33338162a7afc0eefe0ace8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: AIwLAfLc9j1zy7f18lDwzg3hxhh9RZje
etag: W/"1b6b1c9d7cf2982ac07f4974af89535d"
age: 887846
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript
last-modified: Tue, 17 Sep 2024 20:25:56 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-amz-id-2: rX5D6b6BcvfexdqkBdUMbW0KVnkqXab55DJaVNMmkmZUfIYS36B7VpQmG5Z0b0Lp4uIskV7tnUmmJkjfgofJ+HoX59UnZzwr+iO1buOY13A=
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-amz-request-id: F68KPDEDJ6C06PZ0
cf-ray: 8fa019711ac3901c-FRA
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 gt-super-400-normal.woff
glyph.medium.com/font/4a44748/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 13 KB
13 KB 20ms
20ms Font
application/font-woff 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/4a44748/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/gt-super-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40c05a07ac09c244b63a1755d524e094c32a18072335fb6cfc7f13da9cfe3eb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://glyph.medium.com/css/unbound.css

Response headers

access-control-max-age: 86400
content-encoding: gzip
cf-cache-status: HIT
age: 1183947
access-control-allow-methods: GET, POST, PUT, DELETE
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/font-woff
vary: Accept-Encoding
priority: u=0,i=?0
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 17
access-control-allow-credentials: true
cf-ray: 8fa019712d428edb-FRA
access-control-allow-origin: *
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 285 KB
100 KB 39ms
16ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-7JY7T788PK

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

92081ecde6e02d9969b62cba34f72605a942624bb281eaf6b95ee076e2f2eff5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 30 Dec 2024 06:51:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 101252
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 enterprise.js Show response
www.google.com/recaptcha/ 2 KB
1 KB 34ms
18ms Script
text/javascript 142.250.185.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?render=6Le-uGgpAAAAAPprRaokM8AKthQ9KNGdoxaGUvVp

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f4.1e100.net

Software

ESF /

Resource Hash

d7e439482aaad79687cfe37ff195368f438fb8a0ce8b9d7de909bf20b2f92154

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 06:51:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Mon, 30 Dec 2024 06:51:05 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 branch-latest.min.js Show response
cdn.branch.io/ 75 KB
23 KB 30ms
7ms Script
text/javascript 108.138.26.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.26.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-26-79.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 713d3ed16aa25766cbe30c5f306e4249512ca897ed4d6f0f2f92797ab3a21be6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

cache-control: max-age=300
content-encoding: gzip
x-amz-version-id: wzveiSyFOOCX_BWdj9sJpkyOGvsZ9yPo
etag: "020d67e6b4ccd787b18ee8d3817631e9"
age: 99
via: 1.1 3199fed6c4260c9448326645d333530a.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 23538
x-amz-cf-id: u0jc2FC6JEFKTo47DvXMvZ96zDxIDXEf12esBl14if9WfgxtjiLQ6Q==
date: Mon, 30 Dec 2024 06:49:27 GMT
content-type: text/javascript
last-modified: Mon, 18 Nov 2024 15:53:53 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P7

GET
H3 200 5c50caa54067fd622d2f0fac18392213bf92f6e2fae89b691e62bceb40885e74
miro.medium.com/v2/da:true/resize:fit:0/ 300 KB
300 KB 30ms
30ms Image
image/png 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/da:true/resize:fit:0/5c50caa54067fd622d2f0fac18392213bf92f6e2fae89b691e62bceb40885e74

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67c2e60e6e47776cd0394b8dca668b89acaadee5198bbf9172a61ecc33dec97a

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

x-request-id: 78e36c0b-732c-475b-8cbb-ec4abf585d64
cf-cache-status: HIT
etag: "_89iZTbMWFrDAXoszgLV1LA1pq4J7sBwEDXleeW4l1U/RIjIwZDEwN2Y4NjUyZGRjYWYzMDBkNGYxNjllNjMwODQ5Ig"
age: 444336
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: image/png
content-disposition: inline; filename="5c50caa54067fd622d2f0fac18392213bf92f6e2fae89b691e62bceb40885e74.png"
medium-fulfilled-by: miro-v2/main-20241212-224453-ca902b15cc
priority: u=3,i
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: script-src 'none'
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 192
cf-ray: 8fa019713ad6901c-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 306868
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 129 B
529 B 159ms
159ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5afffeea41fa0798bf389af4a87b663ffb368789f7141dfc566e9c539dde8041

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: VisitorQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"81-qZzMULUxlF7Gyqyjemt/XSJLJqk"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541465950
worker-missing-cookies: 0
x-envoy-upstream-service-time: 38
cf-ray: 8fa01971ac2e3631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 80 B
513 B 148ms
148ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6adb47c34f420ef114d5ecdb9b7daab2948c5e9c6d7e3441fee907e5a8fef3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: AvatarMenuQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"50-uwdNQiS1cauYvMsRotgPVGuGSSE"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541465951
worker-missing-cookies: 0
x-envoy-upstream-service-time: 23
cf-ray: 8fa01971ac2f3631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 808 B
822 B 186ms
185ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a77052b66fa091773eef65b2e12b15fc18c5d5f545f51f4d308e1d5df1fc9a33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: ClapCountQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"328-fNnzJZ6BCWZrrHvmlmXYdoesTcI"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef, tutu/main-20241216-162301-91c2bf1b82
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541465952
worker-missing-cookies: 0
x-envoy-upstream-service-time: 63
cf-ray: 8fa01971ac323631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 96 B
543 B 282ms
280ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25949c3a36c2fbf885ff0e85fdf787a87988e8c561d1ef065eeaf7fce4543436

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: InteractivePostBodyQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"60-fPoM3e7VAx8V3PERwa6aRszJ5E4"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef, tutu/main-20241216-162301-91c2bf1b82
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541465979
worker-missing-cookies: 0
x-envoy-upstream-service-time: 155
cf-ray: 8fa01971ac333631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 5 KB
2 KB 587ms
582ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

453963d5e0a8700b88bfad4f77cc8a9a4879f9a82c469969010b495397cb309e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: PostResponsesQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"157c-dWrNg9V2Ii8dbstPhwW5MtdYox4"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef, tutu/main-20241216-162301-91c2bf1b82
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541465976
worker-missing-cookies: 0
x-envoy-upstream-service-time: 458
cf-ray: 8fa01971ac343631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 25 KB
6 KB 972ms
963ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

670d6989f14554f4367e927ea10b94bc58b7902200f6b699e553893ba9437383

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: MoreFromMediumRecircQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"6202-dg+bOZw1bro+tvcDbb3bKLPoXd4"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef, tutu/main-20241216-162301-91c2bf1b82
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541465958
worker-missing-cookies: 0
x-envoy-upstream-service-time: 841
cf-ray: 8fa01971ac383631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 27 B
430 B 157ms
155ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

706e568e0c4a22004a1c177674ae9489b5a3ca9f5a97e4addb3c626c03016548

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: ViewerQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

cf-cache-status: DYNAMIC
etag: W/"1b-zcE2qsOE110W+7rHoTa9C+cwT68"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541465962
worker-missing-cookies: 0
x-envoy-upstream-service-time: 29
cf-ray: 8fa01971ac393631-FRA
access-control-allow-origin: *
content-length: 27
x-xss-protection: 0
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 85 B
507 B 152ms
150ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a62e1c6204b43650e24e533767e5448bb082f64d1ba270dc85a924758051fa88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: LogExperimentExposure
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"55-HK70iqmrNw06UAqLaT/azNbkcrs"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541465957
worker-missing-cookies: 0
x-envoy-upstream-service-time: 28
cf-ray: 8fa01971ac3a3631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 79 B
502 B 156ms
155ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52d25ab4a53674b721be8fa2983c6b0f2b6821618f6d4fbc3472fec02b5e67d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: LogGateExposure
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"4f-PyDyq/vz3tkRgbZXHMnLXcJrsR4"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541465952
worker-missing-cookies: 0
x-envoy-upstream-service-time: 29
cf-ray: 8fa01971ac3b3631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

GET
H3

200

main.js Show response
labs.guard.io/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/ Frame 979C
Redirect Chain

https://labs.guard.io/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://labs.guard.io/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?

9 KB
4 KB

15ms
15ms

Script
application/javascript

162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Protocol

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17216517c68b827e9d44d31d16b9175e74005321f9b47c58887d6066a97f4c61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: gzip
x-content-type-options: nosniff
cf-ray: 8fa019721c6f3631-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
x-content-type-options: nosniff
cf-ray: 8fa01971dc4b3631-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:05 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/ 549 KB
218 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=6Le-uGgpAAAAAPprRaokM8AKthQ9KNGdoxaGUvVp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8694091227f6f34a6acb8dda867cab6f129cb19ee794a75ebd434793d4066e5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://labs.guard.io
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

content-encoding: gzip
age: 30713
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Mon, 29 Dec 2025 22:19:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Dec 2024 22:19:12 GMT
last-modified: Tue, 10 Dec 2024 23:05:10 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
access-control-allow-origin: *
content-length: 222469
x-xss-protection: 0
server: sffe

GET
H2 200 _r Show response
app.link/ 91 B
668 B 197ms
164ms Script
text/javascript 2600:9000:206f:0:19:9934:6a80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.86.0&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:0:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

openresty /

Resource Hash

389720f76769da51b7ad8a36093c0c73b2cc0b00b7f9480329cd04b7b6e398c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
etag: W/"5b-ioqUTKQmSQVk0IVQ7ZOxbnKqDa0"
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
via: 1.1 910fc18161f0602555cc5b6397ca26f2.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 91
x-amz-cf-id: 6OMM2U0B_6Q0EuP_J23OJzm8PKjydmmtqzPbxcFBSRAqBgiZfJvQ5g==
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: text/javascript; charset=utf-8
x-amz-cf-pop: FRA56-C1
server: openresty

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 41ms
14ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-7JY7T788PK&gtm=45je4cc1v9123887712za200&_p=1735541465786&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=409349184.1735541466&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1735541465&sct=1&seg=0&dl=https%3A%2F%2Flabs.guard.io%2Fdeceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6&dt=%E2%80%9CDeceptionAds%E2%80%9D%20%E2%80%94%20Fake%20Captcha%20Driving%20Infostealer%20Infections%20and%20a%20Glimpse%20to%20the%20Dark%20Side%20of%20Internet%20Advertising%20%7C%20by%20Guardio%20%7C%20Dec%2C%202024%20%7C%20Medium&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1509
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-7JY7T788PK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://labs.guard.io
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 06:51:05 GMT
content-type: text/plain
server: Golfe2

POST
H3 200 8fa0196acc291d94 Show response
labs.guard.io/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 979C 0
735 B 23ms
19ms XHR
text/plain 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/cdn-cgi/challenge-platform/h/b/jsd/r/8fa0196acc291d94

Requested by

Host: labs.guard.io
URL: https://labs.guard.io/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-ray: 8fa019728cb83631-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

POST
H3 200 graphql Show response
labs.guard.io/_/ 81 B
507 B 165ms
164ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14630d61ff002f2fc564d00a080ba2cef7e0811be983a192549c43335b1d706e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: PostGiveTipOnExternalPlatformQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"51-hbfNDSGVO0/XLJV9LgsKsOBLP4E"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541466090
worker-missing-cookies: 0
x-envoy-upstream-service-time: 39
cf-ray: 8fa019728cbb3631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

GET
H3 200 anchor
www.google.com/recaptcha/enterprise/ Frame 9E02 0
0 36ms
22ms Document
text/html 142.250.185.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Le-uGgpAAAAAPprRaokM8AKthQ9KNGdoxaGUvVp&co=aHR0cHM6Ly9sYWJzLmd1YXJkLmlvOjQ0Mw..&hl=de&v=zIriijn3uj5Vpknvt_LnfNbF&size=invisible&cb=2qbnr05r10ne

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-YT60Z9W9VBYQqTq02SVxQQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-YT60Z9W9VBYQqTq02SVxQQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 30 Dec 2024 06:51:06 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 open Show response
api2.branch.io/v1/ 316 B
709 B 195ms
164ms XHR
application/json 2600:9000:2491:ca00:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/open

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2491:ca00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Branch

Resource Hash

4387c472cabc931e4e166fb8ca521d1017b526b7a294f7be942f07afadb95c2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-id: X5JwSMaVxjik2IQ0BEzpGvGgDuDKlT73StDx4jcIFuZFKdZxf7W7Fw==
cache-control: no-cache
via: 1.1 fa87f2173bfe5d35fd73cec71ab12a32.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 316
x-branch-request-id: 72e3c769-7589-4b9b-b3e1-714670cc132a-2024123006
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
x-powered-by: Branch
x-amz-cf-pop: FRA56-P7

POST
H3 200 /
labs.guard.io/_/clientele/reports/performance/ 0
0 133ms
132ms Fetch
text/plain 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/clientele/reports/performance/

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.872afbe3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Medium-Clientele-Client: lite
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
worker-missing-cookies: 0
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 14
x-content-type-options: nosniff
cf-ray: 8fa01973bd593631-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, clientele/main-20241212-224453-ca902b15cc
priority: u=1,i

POST
H3 204 rum Show response
labs.guard.io/cdn-cgi/ 0
139 B 12ms
10ms XHR
text/plain 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 8fa01973bd5b3631-FRA
access-control-allow-origin: https://labs.guard.io
date: Mon, 30 Dec 2024 06:51:06 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H3 200 5d8de952517e8160e40ef9841c781cdc14a5db313057fa3c3de41c6f5b494b19
miro.medium.com/v2/ 1 KB
1 KB 21ms
21ms Other
image/png 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://miro.medium.com/v2/5d8de952517e8160e40ef9841c781cdc14a5db313057fa3c3de41c6f5b494b19

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9411b4c73533eca5265a7da90e4e6fcb7352082368b11f0470d1f2a43ca4904

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

x-request-id: 2e60eb2a-6f28-45b0-ae4b-e8a1e3c9f25c
cf-cache-status: HIT
etag: "yj0WO6sFU4GCciYUBWjzvvfqrBh869doeOC2Pp5EI1Y/RIjI2M2E1NThhOTdjN2U0YzEwNjFlZGI0NjBjODU4Mjk0Ig"
age: 536354
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 06:51:06 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: image/png
content-disposition: inline; filename="5d8de952517e8160e40ef9841c781cdc14a5db313057fa3c3de41c6f5b494b19.png"
medium-fulfilled-by: miro-v2/main-20241212-224453-ca902b15cc
priority: u=1,i
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: script-src 'none'
cache-control: public, max-age=31536000
x-envoy-upstream-service-time: 79
cf-ray: 8fa01973bbf9901c-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1037
server: cloudflare

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
350 B 181ms
180ms XHR
application/json 2600:9000:2491:ca00:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/pageview

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2491:ca00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Branch

Resource Hash

a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fa87f2173bfe5d35fd73cec71ab12a32.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 28
x-amz-cf-id: whZC9aoHvg1wjai1SXIiiFCGalcjNFwCt_1RiPSaeFXK5GOZE_VNHQ==
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
x-powered-by: Branch
x-amz-cf-pop: FRA56-P7

POST
H3 200 graphql Show response
labs.guard.io/_/ 1 KB
720 B 263ms
261ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dcc5857de0eca9c19c46ecbd92d629a7c333cbdc7f0f3fe8280c7eb15ac0145a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: ClapCountQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"411-YHuTw5OD+U3Ad/qHthGvMMya5Ik"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef, tutu/main-20241216-162301-91c2bf1b82
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541466600
worker-missing-cookies: 0
x-envoy-upstream-service-time: 133
cf-ray: 8fa01975be823631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

POST
H3 200 graphql Show response
labs.guard.io/_/ 828 B
641 B 165ms
163ms Fetch
application/json 162.159.153.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://labs.guard.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.153.4 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae32ade73c9953af693ca3f0c5709a215ba27738d1815834091a68222085d488

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

graphql-operation: ClapCountQuery
Referer: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
medium-frontend-path: /deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: */*
medium-frontend-route: post
content-type: application/json
apollographql-client-version: main-20241218-235912-1e3024e5b3
apollographql-client-name: lite
medium-frontend-app: lite/main-20241218-235912-1e3024e5b3

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"33c-fggLo91e6FKj4HMha48YA1bJAQE"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 06:51:07 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
medium-fulfilled-by: edgy/8.9.0, valencia/main-20241212-224453-ca902b15cc, rito/main-20241213-204950-a2cb2a3eef
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-request-received-at: 1735541467104
worker-missing-cookies: 0
x-envoy-upstream-service-time: 40
cf-ray: 8fa01978e8643631-FRA
access-control-allow-origin: *
x-xss-protection: 0
server: cloudflare

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.labs.guard.io/	1969-12-31 23:59:59	Name: _cfuvid Value: 0fXreBRQWGfh8e26Wnww8KF4UgiEowh9ZpXBMxmfv8w-1735541464594-0.0.1.1-604800000
.medium.com/	1970-01-21 11:41:41	Name: uid Value: lo_bfc772b98f23
.medium.com/	1970-01-21 11:41:41	Name: sid Value: 1:muPyKik2zcFfrwakeALAV1vYaDkT7BUH+uh3Xonb/2LOII54CTWiM7EWm5y2C0O3
labs.guard.io/	1970-01-21 11:41:41	Name: uid Value: lo_bfc772b98f23
labs.guard.io/	1970-01-21 11:41:41	Name: sid Value: 1:0Q7iT5zXpeB0DTgQk7b910Qm5SoFimUaC4QtlYFeHBtIOWBDZWSEI8jmWRVyZVGu
.medium.com/	1969-12-31 23:59:59	Name: _cfuvid Value: xV42tq8KX9x.XaSrAEkg2YlLsDunRPxwMwtXFHtwDG0-1735541465727-0.0.1.1-604800000
.guard.io/	1970-01-21 11:41:41	Name: _ga_7JY7T788PK Value: GS1.1.1735541465.1.0.1735541465.0.0.0
.guard.io/	1970-01-21 11:41:41	Name: _ga Value: GA1.1.409349184.1735541466
.labs.guard.io/	1970-01-21 10:51:17	Name: cf_clearance Value: eb6Rq5CNYjEB_YtDXX8gyqN2VqJ56AcaVmeLH4bN3m0-1735541466-1.2.1.1-KED7utkx5VDidBFyHAUzawmGLtjlB_M3fnHjUnX8WI4EEutB2OMD2RHcFxing_Z9QcHPZ2mfbLsfynAClurwXqfRHVLSgPRU5TcJ.nU9rxgQ_7hRiBzW9KdRr.QtR46vyLBidCg63WeI42kDS5ZT.d5WxEM17Z_6JE6ezmEE2cFOa4j_ZaqqrEsPezy_kh1tLC.wmCLUjOcAGmbO_KAh6ASyWpHSkU2LNW95DZ6cNZM2L7wxnpoO99pTSlEDjQUeTjsEBpg3efOS7xfP982zTWmq1Cwig09YeLqHWmKQxMB280P2eVA.N8Fu6pVDuPN67YdypIBqWVj1EBsveN.hbdzaDUIeGJNzylL8ySfJrctGXOrhXdKp5AOyq8b3Y9cw
.app.link/	1970-01-21 10:51:17	Name: _s Value: ZSulHrHprbAcOMnVUrhXa87xxHeXxSpT3HqRqLFWLx6xen7fkBh1k%2BfnwxNK8%2FKm

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6?gi=22a8e47c1b5f(Line 41) Message: document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://medium.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.branch.io
app.link
cdn-client.medium.com
cdn.branch.io
glyph.medium.com
labs.guard.io
medium.com
miro.medium.com
region1.google-analytics.com
static.cloudflareinsights.com
www.google.com
www.googletagmanager.com
www.gstatic.com
108.138.26.79
142.250.185.100
162.159.153.4
2001:4860:4802:34::36
2600:9000:206f:0:19:9934:6a80:93a1
2600:9000:2491:ca00:11:f728:3040:93a1
2606:4700:7::a29f:9804
2606:4700:7::a29f:9904
2606:4700::6810:4f49
2a00:1450:4001:810::2003
2a00:1450:4001:828::2008
033d6d9a6111f3b69923e7cec931f1827de2cbd0c37bcdeb898dc5b71b8f1c4a
03650f29ed19b8bf7c6a8e728f0c2f670f81750eb2ac05b58a764d29a84dc64e
07df63a85bbe08da7d74d041dd785652040ecdf20add2a22791523975be0cb06
07e3ee7afcbc3462ebf2164763c7f050fc4195d5efa4b039646ae0192c49e2fb
0d63477fd28c0476d71f7d94269d37ebc13ee81002807b40bdcee28351da2019
10050d9ac4f3c23f08fbf5902c23fe01fbadbae74c8b72ce6c58589e404b0c56
12c333a76ec82d35a4541956e0e8b4591b55d76f1d1ee4e47f3dd0ec33229e43
14630d61ff002f2fc564d00a080ba2cef7e0811be983a192549c43335b1d706e
17216517c68b827e9d44d31d16b9175e74005321f9b47c58887d6066a97f4c61
1bde116ab519b4d0da72e48403035e2dc408f9baab3b829c59b5cca8b75a5b03
1e3543a0133bd553f2dcd79a947b6eec53c2b16c46a3ebb63a77283ed0768f39
25949c3a36c2fbf885ff0e85fdf787a87988e8c561d1ef065eeaf7fce4543436
2eefa0c79ae536591c09f0825fe70c977a822b215422ce50102e05f6174a8096
3177c0013737d38f7a9fc5f06b3e7ba3d6d7ea0d02406d8c5beb176d26b701ab
332d6bf140a58a273d7822739a9c0d743de3ff02dc560b9639c5d00d35cf6ffe
349f1d96fb1d40d020bbfa84ff666a4774ec59ceca7c83350c2177e3f51d280a
389720f76769da51b7ad8a36093c0c73b2cc0b00b7f9480329cd04b7b6e398c2
3f8b9aacde1287587f8777f1da7b109ca441d3c5f35cbbad562bde755619e41b
40c05a07ac09c244b63a1755d524e094c32a18072335fb6cfc7f13da9cfe3eb9
4387c472cabc931e4e166fb8ca521d1017b526b7a294f7be942f07afadb95c2c
453963d5e0a8700b88bfad4f77cc8a9a4879f9a82c469969010b495397cb309e
454bc523caa85bc20ef259d9fb8e309d9fed9fb117dd31bc3bc75165d90a7dc8
45bd34ce2bf3511cc126b1b12bc1597486e925141c10b05627857cb79810140c
45dbf060ec052a3b0ca5ae7211eaa27c950db65b019aa456e1e686a85f8a327e
46d5f583e419ece197ec489d9d89d1e934de1e5e7c9c888856fb950597f2eee1
52d25ab4a53674b721be8fa2983c6b0f2b6821618f6d4fbc3472fec02b5e67d0
53177e56ade1da3eddade4fc20d235125a915aba11679e6a2ff5aa67cc879a03
57291da4c35041eeea04c8e251fd16bbf673f2f1322ce08a88411bf23c0ae6f3
5afffeea41fa0798bf389af4a87b663ffb368789f7141dfc566e9c539dde8041
65b06113767b237340b84c1a780ccb8cae2543a752b8e048468caa20874a756d
670d6989f14554f4367e927ea10b94bc58b7902200f6b699e553893ba9437383
67c2e60e6e47776cd0394b8dca668b89acaadee5198bbf9172a61ecc33dec97a
6903f50388d3d1ad9b3e67033f700ba4ff5b89f89e80fdd7c04b427daa6b4c72
6fe46ed9b725526a3df9099621591ce778f335a2bd590eed8c05bb04d3004148
6ffb591ef51edd1982c3f5f393508eceb2a8a964e76ba1f794e97ebf06499955
706e568e0c4a22004a1c177674ae9489b5a3ca9f5a97e4addb3c626c03016548
713d3ed16aa25766cbe30c5f306e4249512ca897ed4d6f0f2f92797ab3a21be6
760cb9c0454718a324890d0be2f00c4fe36408c4a67e7b32d979f0600173928f
7725f2e70b6a54d4e4f93c2ea20bdc4ac549a289a806828e73dfcd3a2969b870
7bbe9729aea4e1cc625dd0599b5f1ff38e077219318b0c4e066f8acebb56b0a3
7c526ee08811f04d7f0d5b393cd69c73d19d9fffe61773071deef3f364f00fa9
7cb0607a963a4d571ab612d010e4c124c2bb4cc0fd27048efa5f92eedab98ebe
7e1c65ae1bee1318c629db0d7d24f5ca778f8d65d18a1c654c6279698774b049
84ca5b6f957866c2f06f1bacbbcaefe44c5e92d74dcfc932de7f225ffa8396d6
8694091227f6f34a6acb8dda867cab6f129cb19ee794a75ebd434793d4066e5a
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8cc38817027860ed5e04f9e11e01cac05094175d8d4c87caac335dde7d10e7a6
8f6e7bfd316a160cd611c23c79c3d0cf8fcbfe22e16592f4afffd03eedf45756
92081ecde6e02d9969b62cba34f72605a942624bb281eaf6b95ee076e2f2eff5
962dea3467b0f154420709829450f21ff6efa600704c954fde551bcd78d1ae3f
977eec4907b2febc92ad36328ad86edf074e4a4e2d8476a2db9a2001b9a6cadb
983906e1c4e9041ef5259d8d3168bf91bd009b385fee92eb9566b8ec5645e934
99ce92a575272b3ebd1f8ee0005388b792ff8139959c3cab7a6f2d6a54ebfeaa
a3cbe11384e7d7c8b3d65a7ef12d1ad010a5fd8ca33338162a7afc0eefe0ace8
a3edb3930e433b6ee76c26ed156d44196652363b4fa881a3e140b3e0b43d2a3d
a62e1c6204b43650e24e533767e5448bb082f64d1ba270dc85a924758051fa88
a77052b66fa091773eef65b2e12b15fc18c5d5f545f51f4d308e1d5df1fc9a33
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
ae32ade73c9953af693ca3f0c5709a215ba27738d1815834091a68222085d488
b3985e3779ce6d21045b715324bc4837fc966d0c762a479e5da9764b438e41d4
b436fafd50c4a34bb5478d817e964e3ee611849abbbe6557063140f9555f8931
b579cb06b725609666aeb9fec66152efd7e687c9ba13096c2ce7c1db44c82558
c1e3f148494df431f833926a1b42d57a4530db288a93cf6fd798035f190f7f56
d7e439482aaad79687cfe37ff195368f438fb8a0ce8b9d7de909bf20b2f92154
dcc5857de0eca9c19c46ecbd92d629a7c333cbdc7f0f3fe8280c7eb15ac0145a
e0e25c79be454504b1a69e6c701dd4c0d88511ca6a4275502cddd29b2e37f853
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e634d6f7cedddaff3630e4d1235df9dd2ae4e26153338afcc2b0abfe070c4eb3
e9411b4c73533eca5265a7da90e4e6fcb7352082368b11f0470d1f2a43ca4904
eada6d1c06b5d675e0c143a2fbef8bf83e3060e9ba20ceeb37ec9415ce9bdbaa
eb40a15715435f35f41cfa1072f99186f039e11c935d21722d426a513cfdbeb5
f0451a587442fca6a380afc042f676122b442146e9aa1feae9e49b0e1151a4d1
f6117f6757bc371c3235bf86ac2c5765800bbc7e6d56b1b303f9fa21a62c03d8
f6adb47c34f420ef114d5ecdb9b7daab2948c5e9c6d7e3441fee907e5a8fef3f
f90d19259478cca4381bea7e760845de9bcf2155ee96cd8b06049add894022d3

labs.guard.io Open in urlscan Pro 162.159.153.4 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

81 Requests

99 %HTTPS

73 %IPv6

9 Domains

13 Subdomains

10 IPs

3 Countries

3555 kBTransfer

6359 kBSize

10 Cookies

80 Outgoing links

Page URL History

Redirected requests

81 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

labs.guard.io Open in urlscan Pro
162.159.153.4 Public Scan

Screenshot
Live screenshot

Full Image

81
Requests

99 %
HTTPS

73 %
IPv6

9
Domains

13
Subdomains

10
IPs

3
Countries

3555 kB
Transfer

6359 kB
Size

10
Cookies

81 HTTP transactions
0 data transactions