resources.perimeterx.com Open in urlscan Pro
54.85.164.109 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=
Effective URL:
https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-...
Submission: On July 19 via api (July 19th 2022, 6:11:19 pm UTC) from US — Scanned from DE

Summary HTTP 184 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 43 IPs in 6 countries across 37 domains to perform 184 HTTP transactions. The main IP is 54.85.164.109, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is resources.perimeterx.com.
TLS certificate: Issued by Amazon on March 14th 2022. Valid for: a year.

This is the only time resources.perimeterx.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.17.72.206 104.17.72.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.85.164.109 54.85.164.109	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a0b:4d07:102::1 2a0b:4d07:102::1	44239 (PROINITY ...) (PROINITY PROINITY)
4	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
4	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
39	2a03:b0c0:3:d... 2a03:b0c0:3:d0::1793:d001	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
5	13.32.99.82 13.32.99.82	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:350... 2a02:26f0:3500:11::215:14d0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
10	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
4	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4 12	2600:9000:226... 2600:9000:2260:4a00:6:9280:1080:93a1	16509 (AMAZON-02) (AMAZON-02)
13	2606:4700::68... 2606:4700::6810:9440	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
2	2606:4700:440... 2606:4700:4400::6812:2437	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	54.220.8.206 54.220.8.206	16509 (AMAZON-02) (AMAZON-02)
4 4	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
5 5	37.252.172.37 37.252.172.37	29990 (ASN-APPNEX) (ASN-APPNEX)
4	2600:9000:225... 2600:9000:2251:8200:12:3734:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
7	35.186.220.184 35.186.220.184	15169 (GOOGLE) (GOOGLE)
10	54.82.195.36 54.82.195.36	14618 (AMAZON-AES) (AMAZON-AES)
3	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	104.16.93.80 104.16.93.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	18.66.92.112 18.66.92.112	16509 (AMAZON-02) (AMAZON-02)
2	34.149.125.36 34.149.125.36	15169 (GOOGLE) (GOOGLE)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	13.107.43.14 13.107.43.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	54.72.196.78 54.72.196.78	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
4	2a04:4e42:600... 2a04:4e42:600::604	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:400c:c0a::9a	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
10	13.226.156.190 13.226.156.190	16509 (AMAZON-02) (AMAZON-02)
2	13.32.99.30 13.32.99.30	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1	52.222.214.93 52.222.214.93	16509 (AMAZON-02) (AMAZON-02)
2	172.67.75.100 172.67.75.100	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.207.81.145 52.207.81.145	14618 (AMAZON-AES) (AMAZON-AES)
5	18.66.122.6 18.66.122.6	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:a852	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	18.66.248.86 18.66.248.86	16509 (AMAZON-02) (AMAZON-02)
184	43

1 104.17.72.206 (None, )

ASN13335 (CLOUDFLARENET, US)

mkto-sj130112.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.85.164.109 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-164-109.compute-1.amazonaws.com

resources.perimeterx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0b:4d07:102::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

overpass-30e2.kxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2a03:b0c0:3:d0::1793:d001 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

www.perimeterx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.32.99.82 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-82.fra60.r.cloudfront.net

cdn-app.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.cdn.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:11::215:14d0 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

client.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

001-vjx-104.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2600:9000:2260:4a00:6:9280:1080:93a1 (United States) 4 redirects

ASN16509 (AMAZON-02, US)

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::6812:2437 (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.220.8.206 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-220-8-206.eu-west-1.compute.amazonaws.com

cnv.event.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.153.60 (Secaucus, United States) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 37.252.172.37 (Frankfurt am Main, Germany) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2251:8200:12:3734:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 35.186.220.184 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 184.220.186.35.bc.googleusercontent.com

sapi2003.botchk.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 54.82.195.36 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-82-195-36.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.93.80 (None, )

ASN13335 (CLOUDFLARENET, US)

app-sj13.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.92.112 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-92-112.fra56.r.cloudfront.net

d33wubrfki0l68.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.149.125.36 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 36.125.149.34.bc.googleusercontent.com

b.px-cdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.107.43.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.72.196.78 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-196-78.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a04:4e42:600::604 (United States)

ASN54113 (FASTLY, US)

assets.perimeterx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0a::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 13.226.156.190 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-156-190.dus51.r.cloudfront.net

d10lpsik1i8c69.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.99.30 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-30.fra60.r.cloudfront.net

lftracker.leadfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.214.93 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-93.fra56.r.cloudfront.net

cdn.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.75.100 (United States)

ASN13335 (CLOUDFLARENET, US)

settings.luckyorange.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.207.81.145 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-207-81-145.compute-1.amazonaws.com

api9130.d41.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.66.122.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-6.fra60.r.cloudfront.net

tr.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a852 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.86 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-86.dus51.r.cloudfront.net

cdn-0.d41.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
44	perimeterx.com resources.perimeterx.com www.perimeterx.com — Cisco Umbrella Rank: 574202 assets.perimeterx.com	733 KB
14	adroll.com 4 redirects s.adroll.com — Cisco Umbrella Rank: 2518 d.adroll.com — Cisco Umbrella Rank: 1676	42 KB
13	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 509	244 KB
13	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 69 region1.google-analytics.com — Cisco Umbrella Rank: 2603	129 KB
12	cloudfront.net d33wubrfki0l68.cloudfront.net d10lpsik1i8c69.cloudfront.net	487 KB
12	pathfactory.com cdn-app.pathfactory.com — Cisco Umbrella Rank: 102986 jukebox.pathfactory.com — Cisco Umbrella Rank: 59730 cdn.pathfactory.com — Cisco Umbrella Rank: 154348	486 KB
7	botchk.net sapi2003.botchk.net — Cisco Umbrella Rank: 741111	4 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 485 www.linkedin.com — Cisco Umbrella Rank: 534 px4.ads.linkedin.com — Cisco Umbrella Rank: 5743	4 KB
5	lfeeder.com tr.lfeeder.com — Cisco Umbrella Rank: 14557	1 KB
5	adnxs.com 5 redirects secure.adnxs.com — Cisco Umbrella Rank: 436	4 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 96	491 B
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 164	219 KB
4	lookbookhq.com app.cdn.lookbookhq.com — Cisco Umbrella Rank: 70913	369 KB
4	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 18756	968 B
4	ml-attr.com 4 redirects s.ml-attr.com — Cisco Umbrella Rank: 15386	1 KB
4	youtube.com www.youtube.com — Cisco Umbrella Rank: 107	105 KB
4	licdn.com snap.licdn.com — Cisco Umbrella Rank: 914	13 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 101	317 KB
4	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3954	13 KB
3	d41.co api9130.d41.co cdn-0.d41.co — Cisco Umbrella Rank: 18236	76 KB
3	gstatic.com fonts.gstatic.com	86 KB
3	bidr.io 1 redirects cnv.event.prod.bidr.io — Cisco Umbrella Rank: 9373	2 KB
2	luckyorange.net settings.luckyorange.net — Cisco Umbrella Rank: 7869	3 KB
2	leadfeeder.com lftracker.leadfeeder.com — Cisco Umbrella Rank: 62386	21 KB
2	px-cdn.net b.px-cdn.net — Cisco Umbrella Rank: 14532	422 B
2	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8951	1 KB
2	mktoresp.com 001-vjx-104.mktoresp.com	636 B
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 819	77 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 81	2 KB
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 6139	2 KB
1	google.de www.google.de — Cisco Umbrella Rank: 4915	501 B
1	google.com www.google.com — Cisco Umbrella Rank: 17	501 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 138	448 B
1	marketo.com app-sj13.marketo.com — Cisco Umbrella Rank: 204563	69 KB
1	px-cloud.net client.px-cloud.net — Cisco Umbrella Rank: 8081	136 KB
1	kxcdn.com overpass-30e2.kxcdn.com — Cisco Umbrella Rank: 226419	842 B
1	mkto-sj130112.com mkto-sj130112.com	1 KB
184	37

	Domain	Requested by
39	www.perimeterx.com	resources.perimeterx.com www.perimeterx.com d33wubrfki0l68.cloudfront.net
13	cdn.cookielaw.org	www.googletagmanager.com client.px-cloud.net cdn.cookielaw.org
12	s.adroll.com	4 redirects www.googletagmanager.com resources.perimeterx.com client.px-cloud.net www.perimeterx.com s.adroll.com
10	d10lpsik1i8c69.cloudfront.net	client.px-cloud.net mkto-sj130112.com d10lpsik1i8c69.cloudfront.net resources.perimeterx.com
10	jukebox.pathfactory.com	cdn-app.pathfactory.com client.px-cloud.net
10	www.google-analytics.com	www.googletagmanager.com client.px-cloud.net www.perimeterx.com
7	sapi2003.botchk.net	client.px-cloud.net
5	tr.lfeeder.com	resources.perimeterx.com www.perimeterx.com
5	secure.adnxs.com	5 redirects
4	www.facebook.com	resources.perimeterx.com www.perimeterx.com
4	connect.facebook.net	client.px-cloud.net mkto-sj130112.com connect.facebook.net
4	assets.perimeterx.com	www.perimeterx.com
4	app.cdn.lookbookhq.com	www.perimeterx.com client.px-cloud.net mkto-sj130112.com
4	attr.ml-api.io	resources.perimeterx.com www.perimeterx.com
4	s.ml-attr.com	4 redirects
4	www.youtube.com	mkto-sj130112.com client.px-cloud.net www.youtube.com
4	snap.licdn.com	www.googletagmanager.com client.px-cloud.net
4	www.googletagmanager.com	resources.perimeterx.com www.googletagmanager.com www.perimeterx.com
4	munchkin.marketo.net	resources.perimeterx.com munchkin.marketo.net mkto-sj130112.com
3	fonts.gstatic.com	fonts.googleapis.com
3	px.ads.linkedin.com	3 redirects
3	region1.google-analytics.com	www.googletagmanager.com client.px-cloud.net
3	cnv.event.prod.bidr.io	1 redirects resources.perimeterx.com www.perimeterx.com
2	api9130.d41.co	www.googletagmanager.com cdn-0.d41.co
2	settings.luckyorange.net	client.px-cloud.net d10lpsik1i8c69.cloudfront.net
2	lftracker.leadfeeder.com	client.px-cloud.net mkto-sj130112.com
2	d.adroll.com	client.px-cloud.net s.adroll.com
2	px4.ads.linkedin.com	resources.perimeterx.com www.perimeterx.com
2	b.px-cdn.net	client.px-cloud.net
2	d33wubrfki0l68.cloudfront.net	www.perimeterx.com
2	tracking.g2crowd.com	mkto-sj130112.com
2	001-vjx-104.mktoresp.com	munchkin.marketo.net
2	maxcdn.bootstrapcdn.com	resources.perimeterx.com maxcdn.bootstrapcdn.com
2	fonts.googleapis.com	resources.perimeterx.com www.perimeterx.com
1	cdn-0.d41.co	www.googletagmanager.com
1	ws.zoominfo.com	mkto-sj130112.com
1	cdn.pathfactory.com	resources.perimeterx.com
1	www.google.de	resources.perimeterx.com
1	www.google.com	resources.perimeterx.com
1	stats.g.doubleclick.net	client.px-cloud.net
1	www.linkedin.com	1 redirects
1	app-sj13.marketo.com	www.perimeterx.com
1	client.px-cloud.net	resources.perimeterx.com
1	cdn-app.pathfactory.com	resources.perimeterx.com
1	overpass-30e2.kxcdn.com	resources.perimeterx.com
1	resources.perimeterx.com	mkto-sj130112.com
1	mkto-sj130112.com
184	47

This site contains links to these domains. Also see Links.

Domain
onetrust.com
www.perimeterx.com

Subject Issuer	Validity	Valid
mkto-sj130112.com Cloudflare Inc ECC CA-3	`2022-06-03` - `2023-06-02`	a year	crt.sh
resources.perimeterx.com Amazon	`2022-03-14` - `2023-04-12`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
*.kxcdn.com Thawte RSA CA 2018	`2021-08-28` - `2022-08-28`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2022-02-06` - `2023-02-07`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
beat.bot R3	`2022-06-04` - `2022-09-02`	3 months	crt.sh
*.pathfactory.com Amazon	`2022-07-11` - `2023-08-09`	a year	crt.sh
botchk.net R3	`2022-05-04` - `2022-08-02`	3 months	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-30` - `2022-11-30`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
s.adroll.com Amazon	`2022-07-03` - `2023-08-01`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
*.g2crowd.com Sectigo ECC Domain Validation Secure Server CA	`2021-08-30` - `2022-09-28`	a year	crt.sh
*.px-cloud.net Sectigo RSA Domain Validation Secure Server CA	`2021-09-01` - `2022-09-30`	a year	crt.sh
app-sj13.marketo.com Cloudflare Inc ECC CA-3	`2022-04-29` - `2023-04-29`	a year	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
perimeterx.net GeoTrust RSA CA 2018	`2021-08-18` - `2022-09-18`	a year	crt.sh
adroll.mgr.consensu.org Amazon	`2021-09-09` - `2022-10-08`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
assets.perimeterx.com GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-07-07` - `2023-08-08`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-04-28` - `2022-07-27`	3 months	crt.sh
*.leadfeeder.com Amazon	`2022-02-01` - `2023-03-02`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
*.d41.co DigiCert TLS RSA SHA256 2020 CA1	`2022-02-01` - `2023-03-04`	a year	crt.sh
*.event.prod.bidr.io Amazon	`2022-01-27` - `2023-02-25`	a year	crt.sh
*.lfeeder.com Amazon	`2022-07-09` - `2023-08-07`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2022-05-04` - `2023-05-04`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Frame ID: C80A3225CD74F306C21475E5DC9623F8
Requests: 74 HTTP requests in this frame

Frame: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Frame ID: 2FFF5B46873291FC52080CD528666414
Requests: 100 HTTP requests in this frame

Frame: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Frame ID: 7947F97D98BC1E6FB05428A7E8A0E157
Requests: 3 HTTP requests in this frame

Frame: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Frame ID: DD4B9623EA7D5E634D20BE777158F1EE
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 01EC783F67D374ACED39A23D486FDCBE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

An Analysis of the Natural Fresh Mall Magecart AttackBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNl... Page URL
https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 75%
Detected patterns

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:a|s)\.adroll\.com

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Marketo Forms (Widgets) Expand

Overall confidence: 100%
Detected patterns

marketo\.\w+/js/forms(?:[\d.]+)/js/forms([\d.]+)\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

PerimeterX (Security) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

184
Requests

92 %
HTTPS

51 %
IPv6

37
Domains

47
Subdomains

43
IPs

6
Countries

3641 kB
Transfer

10895 kB
Size

54
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

URL: https://www.perimeterx.com/legal/privacy/
Title: privacy policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE= Page URL
https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18

https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=[ORDER]&ord=663714877 HTTP 303
https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=%5BORDER%5D&ord=663714877&_bee_ppp=1

Request Chain 19

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dperimeterx.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035

Request Chain 60

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273021&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D48062%26time%3D1658254273021%26url%3Dhttps%253A%252F%252Fresources.perimeterx.com%252Fnews-naturalfresh-magecart-analysis%253Fmkt_tok%253DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%2526utm_campaign%253Dnewsletter-july-2022%2526utm_source%253Dmarketo%2526utm_medium%253Demail%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273021&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273021&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&liSync=true&e_ipv6=AQISKMqtGzxd_QAAAYIXqCw3JoPqifZQIz7YbUxq_uDfMpVBeT3FogXZ1F5Uk4h3kvZUpbZ4bn88

Request Chain 62

https://s.adroll.com/j/exp/YDMIA7YLU5BMFL5TTCRXA7/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 63

https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

Request Chain 112

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035

Request Chain 116

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273823&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273823&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&e_ipv6=AQLayGHwJjKGuQAAAYIXqC1k5pyFQYi4QQbxmZc2zMjhr97zVkm9U24k-KbFKx-7HsvqJetxb8jy

Request Chain 120

https://s.adroll.com/j/exp/YDMIA7YLU5BMFL5TTCRXA7/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 121

https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

Request Chain 164

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035

Request Chain 165

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035

184 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 302 MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=
mkto-sj130112.com/ 627 B
1 KB 278ms
220ms Document
text/html 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-zFovN/57TMLDlVnSpXiaPSUxV+9rsaxKWyH8swk9nL0=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-cache, no-store, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 72d56b0cab829bb0-FRA
content-security-policy: default-src 'self'; img-src 'self';script-src 'self' 'sha256-zFovN/57TMLDlVnSpXiaPSUxV+9rsaxKWyH8swk9nL0=';object-src 'none';form-action:'none';frame-src:'none'
content-type: text/html;charset=UTF-8
date: Tue, 19 Jul 2022 18:11:11 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: strict-origin
server: cloudflare
x-frame-options: SAMEORIGIN
x-request-id: c589ab86f2de9703

GET
H2 200 Primary Request news-naturalfresh-magecart-analysis Show response
resources.perimeterx.com/ 19 KB
7 KB 520ms
264ms Document
text/html 54.85.164.109
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.85.164.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-85-164-109.compute-1.amazonaws.com

Software

Resource Hash

21f0d38e2c999c64e16659f6b27d44963bb454d9aa0f5595e2dd30576c7c6606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://mkto-sj130112.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 19 Jul 2022 18:11:12 GMT
etag: W/"21f0d38e2c999c64e16659f6b27d4496"
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin Accept-Encoding
x-content-type-options: nosniff
x-request-id: fb5e0f74-dbbd-48ed-a3fc-9922bbd0fdda
x-runtime: 0.148000

GET
H2 200 css
fonts.googleapis.com/ 5 KB
1 KB 89ms
32ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700|Lato:400,700

Requested by

Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

390aca4ba708128182c4802df7c4a1d3a85566b96bf2542caa3b4ea1f1507c1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Jul 2022 18:08:35 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 19 Jul 2022 18:11:12 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Jul 2022 18:11:12 GMT

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 28 KB
7 KB 80ms
32ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617, 617
age: 12195174
cdn-cachedat: 2021-06-08 21:36:06
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 69640b569db2e73550edbfbb2fb62a79
cf-ray: 72d56b11c8f49bb8-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 overpass.css
overpass-30e2.kxcdn.com/ 6 KB
842 B 118ms
35ms Stylesheet
text/css 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://overpass-30e2.kxcdn.com/overpass.css
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: b25e835722ffbec8ab733d999dc194aa9ef7fcf00edc594e453f2823e0c65fb9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:12 GMT
content-encoding: br
last-modified: Fri, 30 Dec 2016 09:56:37 GMT
server: keycdn-engine
x-edge-location: defr
etag: W/"58662f55-180e"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-headers: *
expires: Tue, 26 Jul 2022 18:11:12 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 78ms
21ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:12 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 278 KB
86 KB 103ms
43ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

13e42cbf2390f23006b16f68d40daddb3a1e727e5dafaede2d60c2c8ddec51de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:12 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87973
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:11:12 GMT

GET
H2 200 / Show response
www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Frame 2FFF 98 KB
25 KB 237ms
162ms Document
text/html 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

ca2bc9c7cf7bc7dcaf47481abea6b29fcaeebc55b92b8df622f7feb4242c3ae7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 0
cache-control: public, max-age=0, must-revalidate
content-encoding: br
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-type: text/html; charset=UTF-8
date: Tue, 19 Jul 2022 18:11:12 GMT
etag: "524730e29f519c197fdc7f0ec436730e-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01G8BTG9Y99NRHMZWRC7PFQ3RE
x-xss-protection: 1; mode=block

GET
H2 200 tracks.js Show response
cdn-app.pathfactory.com/production/jukebox/current/ 2 MB
431 KB 88ms
27ms Script
text/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox/current/tracks.js?x=2
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b02b20ba6ecbfd77a7b5951a906f6b9e230a607e2bd7002ae7ea79fcd7fdc1a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 01:04:24 GMT
server: AmazonS3
age: 17751
etag: W/"6fda9e6587b709557a0a50e260685a14"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 6fc439c8bc0a64a7ab978ce699795274.cloudfront.net (CloudFront)
cache-control: max-age=43200
date: Tue, 19 Jul 2022 13:15:34 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: bnGXgnYppVTaje_m0TUwisIaSP43y6lCT7YPFDzGPYTzYBNQZD7U0w==

GET
H2 200 main.min.js Show response
client.px-cloud.net/PX2003/ 286 KB
136 KB 101ms
21ms Script
application/javascript 2a02:26f0:3500:11::215:14d0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://client.px-cloud.net/PX2003/main.min.js
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:11::215:14d0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 4446e54d7bd0f4dbad541c2fcf0778d5fad8278020999a1a9c1f47838310c67b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:12 GMT
content-encoding: gzip
etag: "476f6-9agS4ZAEG9RaCUwjDM22MN5S1C4"
active-cdn: Akamai
x-px-hash: MTAyNWZlNzQxNWRiOTg2YTViODJjNzVmODY4MzQ2YTg4YWY0N2MxODk0M2IxOTdmYTUzNDNhNjcxNDY0ZDk4YQ==
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
cache-control: max-age=900,stale-while-revalidate=86400,stale-if-error=3600
content-length: 138262

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ 11 KB
5 KB 21ms
21ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Thu, 27 Oct 2022 18:11:12 GMT

POST
H/1.1 200
OK visitWebPage
001-vjx-104.mktoresp.com/webevents/ 2 B
318 B 914ms
180ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://001-vjx-104.mktoresp.com/webevents/visitWebPage?_mchNc=1658254272463&_mchCn=&_mchId=001-VJX-104&_mchTk=_mch-perimeterx.com-1658254272462-57194&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&_mchHo=resources.perimeterx.com&_mchPo=&_mchRu=%2Fnews-naturalfresh-magecart-analysis&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Fmkto-sj130112.com%2F&_mchQp=utm_source%3Dmarketo__-__utm_medium%3Demail__-__utm_campaign%3Dnewsletter-july-2022__-__mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:13 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 862d4f6a-1ee5-4cdc-abf5-b75d05ba1944

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 213 KB
72 KB 33ms
32ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S5CWZF51H2&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0a7bae5a80d53dc5f231dfd255952b55c56a603c437e1948ea1f8bdb530bd4a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:12 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74052
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:11:12 GMT

GET
H2 200 optimize.js Show response
www.google-analytics.com/gtm/ 117 KB
45 KB 88ms
35ms Script
application/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=GTM-PCDTQ25

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a81767aaedfe6143328709d395308f125a628198f895c78d42780a274295e3a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:12 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45222
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:11:12 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 223ms
23ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=80180
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 52 KB
17 KB 235ms
32ms Script
text/javascript 2600:9000:2260:4a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2260:4a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9db9265f8119cc29e3011eb69fb5d9bfb6b2b715890351480ac0904059af7f02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: J7p8W1lQgNY91qwUxZU3x.y9IQrTVjMu
Content-Encoding: gzip
Etag: W/"d570d2e0cc47679b5bf3a6f9ff5b9e5b"
Age: 2254
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Via: 1.1 67b828898c2b34a7518c5b13dd7321c0.cloudfront.net (CloudFront)
Last-Modified: Thu, 30 Jun 2022 21:03:48 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 17:33:39 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: 0wfxTiHwODFYoqZoH90zIqVP1ZnVeT93cnW4YMNZ8_z1BiYYSX6TvA==

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 20 KB
7 KB 81ms
30ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 4m3LBpuQ5au3un+sbdTm6g==
age: 392
vary: Accept-Encoding
content-length: 6922
x-ms-lease-status: unlocked
last-modified: Thu, 14 Jul 2022 19:31:29 GMT
server: cloudflare
etag: 0x8DA65CF736BBFE4
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 32dfe822-301e-0115-48e4-975c2a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b13dc90bb62-FRA

GET
H2 200 iframe_api Show response
www.youtube.com/ 980 B
2 KB 234ms
42ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fe3cdb6342633b630a1636d3a83f1beb1aa5a9404078a93618f3235f4d609f6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Tue, 19 Jul 2022 18:11:12 GMT

GET
H2 200 4607.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 16 B
1 KB 330ms
141ms Script
text/javascript 2606:4700:4400::6812:2437
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/4607.js?p=https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&e=

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: c45abdf9-69cd-4f62-8d39-27948b26adde
x-runtime: 0.003033
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=604800
x-download-options: noopen
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray: 72d56b14bc3692ae-FRA

GET
H/1.1

200
OK

cnv
cnv.event.prod.bidr.io/log/
Redirect Chain

https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=[ORDER]&ord=663714877
https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=%5BORDER%5D&ord=663714877&_bee_ppp=1

43 B
793 B

46ms
45ms

Image
image/gif

54.220.8.206
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=%5BORDER%5D&ord=663714877&_bee_ppp=1

Requested by

Protocol

HTTP/1.1

Server

54.220.8.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-220-8-206.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 19 Jul 2022 18:11:12 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=%5BORDER%5D&ord=663714877&_bee_ppp=1
Date: Tue, 19 Jul 2022 18:11:12 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dperimeterx.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035

0
241 B

243ms
195ms

Image
application/json

2600:9000:2251:8200:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Server: 2600:9000:2251:8200:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
apigw-requestid: VhsGPjBdoAMEJLw=
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: 6eZUUR65X9Ya-oipsIv2JY3mEBY2kb0WigaysWvJUebg-H6--6CyiA==

Redirect headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:11:13 GMT
X-Proxy-Origin: 217.114.218.19; 217.114.218.19; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 476dd176-efcc-49d1-a677-2f0d41d4d426
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 collector Show response
sapi2003.botchk.net/api/v2/ 986 B
1 KB 174ms
45ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: bd1191c6d6c683d4982b98fcba8f3d01066c7fad2e4f604add5231a8e2066e9a

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:11:11 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 986

OPTIONS
H2 200 associate
jukebox.pathfactory.com/api/public/v1/page_views/ Frame 0
0 338ms
110ms Preflight 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/page_views/associate
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-195-36.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 19 Jul 2022 18:11:13 GMT

OPTIONS
H2 200 page_views
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 341ms
114ms Preflight 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/page_views
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-195-36.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 19 Jul 2022 18:11:13 GMT

POST
H2 204 associate Show response
jukebox.pathfactory.com/api/public/v1/page_views/ 0
740 B 349ms
130ms XHR
text/plain 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/page_views/associate

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/tracks.js?x=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-82-195-36.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.012562
date: Tue, 19 Jul 2022 18:11:13 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
x-content-type-options: nosniff
x-request-id: 1dd459d8-81c4-4ea8-a98b-c3368be701c4

POST
H2 200 page_views Show response
jukebox.pathfactory.com/api/public/v1/ 153 B
1022 B 457ms
240ms XHR
application/json 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/page_views

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/tracks.js?x=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-82-195-36.compute-1.amazonaws.com

Software

Resource Hash

5feeba24e0d742f2325b55fbb0bceebbec90fb3f3b7c3a48f26120b4dc2bcb12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-max-age: 7200
vary: Accept, Origin, Accept-Encoding
x-request-id: 50d3259b-8513-497e-8ecf-2399b9e34af9
x-runtime: 0.124165
referrer-policy: no-referrer-when-downgrade
etag: W/"5feeba24e0d742f2325b55fbb0bceebb"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true

POST
H2 204 collect
region1.google-analytics.com/g/ 0
344 B 112ms
31ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-S5CWZF51H2&gtm=2oe7i0&_p=1808954927&_z=ccd.v9B&cid=794911285.1658254273&ul=en-us&sr=1600x1200&_s=1&sid=1658254272&sct=1&seg=0&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&dr=https%3A%2F%2Fmkto-sj130112.com%2F&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5CWZF51H2&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:11:12 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://resources.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 forms2.min.js Show response
app-sj13.marketo.com/js/forms2/js/ Frame 2FFF 206 KB
69 KB 200ms
50ms Script
application/x-javascript 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj13.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17dc16f203a20131a9dfccce83ed74af83cb9da328011181ca745b7f3a883d08

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 14 Jun 2022 21:04:07 GMT
server: cloudflare
age: 6128
etag: "58130e-3391f-5e16ebec83fc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 72d56b167d79697f-FRA
vary: Accept-Encoding
expires: Tue, 19 Jul 2022 22:11:13 GMT

GET
H2 200 overlay.css
app.cdn.lookbookhq.com/libraries/overlay/ Frame 2FFF 569 B
922 B 58ms
37ms Stylesheet
text/css 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/libraries/overlay/overlay.css
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5156dff19f3da0b22f54fae9883fdc4a140ab79ec89aac752751e9fc643159bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
via: 1.1 6fc439c8bc0a64a7ab978ce699795274.cloudfront.net (CloudFront)
last-modified: Wed, 02 Feb 2022 02:43:20 GMT
server: AmazonS3
age: 48763
etag: "73f6afb49415dbca4824d9ac67763fea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
date: Tue, 19 Jul 2022 04:38:30 GMT
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
content-length: 569
x-amz-cf-id: frHupETC5yJHDBBBBdAg5UGM4ieDJmOlbnQFLgHUqk4yeKqoL_MSjQ==

GET
H2 200 overlay.js Show response
app.cdn.lookbookhq.com/libraries/overlay/ Frame 2FFF 5 KB
2 KB 58ms
38ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/libraries/overlay/overlay.js
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dd11c7626d5576d5cb2c3271bd2a20526c246da6c08c62248c8a944104edd9e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 01:54:41 GMT
server: AmazonS3
age: 58006
etag: W/"0dcf782aadc5db45cfd6d9ef79c1a377"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 6fc439c8bc0a64a7ab978ce699795274.cloudfront.net (CloudFront)
date: Tue, 19 Jul 2022 02:04:27 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: XAK-vR25P1ufx9ZNmeuwUJPwbpoRi04mWslqXEfa2shzfida6bAevg==

GET
H3 200 css
fonts.googleapis.com/ Frame 2FFF 14 KB
952 B 113ms
36ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Barlow:400,500,700|Barlow+Condensed:300,600|Open+Sans:400,500,700&display=swap

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfa7bb01d830f1d1ceb4c4d857e2c6f9de8f72c520f6ee031797d76af89989d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Jul 2022 18:10:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 19 Jul 2022 18:11:12 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Jul 2022 18:11:12 GMT

GET
H2 200 webpack-runtime-514465b51ac6845ee75f.js Show response
www.perimeterx.com/ Frame 2FFF 15 KB
4 KB 53ms
38ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/webpack-runtime-514465b51ac6845ee75f.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

a61d5737f270e877b7ee2e1ded35a5d6c07cb8e16e316c6a97a1d1dd9d76c1fd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAC8ERKY9KHH2S0FSEJR
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 785
vary: Accept-Encoding
content-length: 4260
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "46a1e2d0887e87d92e5c59a2c62e2405-ssl"
accept-ranges: bytes

GET
H2 200 styles-83801f3b4dd3459a4027.js Show response
www.perimeterx.com/ Frame 2FFF 118 B
266 B 44ms
29ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/styles-83801f3b4dd3459a4027.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e5ad1b24f290210e067ee5aeace152e7a510e2e457554bcada5e767292132747

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAC8ZH7HH1XAV0D9D3AG
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 785
etag: "e2e8d3c392c3fe79dd753e7dae194a51-ssl"
x-frame-options: DENY
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 118
x-xss-protection: 1; mode=block

GET
H2 200 framework-3bb7604d37b8059061f5.js Show response
www.perimeterx.com/ Frame 2FFF 131 KB
41 KB 51ms
36ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/framework-3bb7604d37b8059061f5.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

f92d6e79a7b51948eb161c71fefce09aa57c0bf009c8d326575950540304d49c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAC9YCV7T7EWK6WMGEPV
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 785
vary: Accept-Encoding
content-length: 41788
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "b16b1872f128e3eaf829f3ca941586c2-ssl"
accept-ranges: bytes

GET
H2 200 c9c6fe98-9161238368d370bda929.js Show response
www.perimeterx.com/ Frame 2FFF 92 KB
23 KB 53ms
38ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/c9c6fe98-9161238368d370bda929.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

4da5da2f204eed8829fd9e0ee84e21479ee5db9fb5e6656d05bbdff54b2ce68e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAC98A47RKTD8VQVJTRS
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 785
vary: Accept-Encoding
content-length: 23064
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "dd5342ec2edf24e1b612806db7d177ac-ssl"
accept-ranges: bytes

GET
H2 200 1bfc9850-e346f70a0d188b802bed.js Show response
www.perimeterx.com/ Frame 2FFF 5 KB
2 KB 53ms
39ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/1bfc9850-e346f70a0d188b802bed.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

f3d15fff8a4ea22a2137649a7935dc89776c66389936e50e4ba97895099459d6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAC96FYS7WSHEDNMNZQN
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 785
vary: Accept-Encoding
content-length: 2140
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "6122f8ba089db0bbf833a558e8f9b596-ssl"
accept-ranges: bytes

GET
H2 200 5e2a4920-20a4bced7ddf9a73ac28.js Show response
www.perimeterx.com/ Frame 2FFF 2 KB
637 B 51ms
37ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/5e2a4920-20a4bced7ddf9a73ac28.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

71a41da894b51c66bad0e307a8ee51aa86ebf458433676b9c9ea8eb32f695d02

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAC97176WPH5563P72D7
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 785
vary: Accept-Encoding
content-length: 545
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "e0b7567b94632b2f57e8a301e83b973d-ssl"
accept-ranges: bytes

GET
H2 200 95b64a6e-61f21e012229bde8e9f0.js Show response
www.perimeterx.com/ Frame 2FFF 855 B
945 B 49ms
35ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/95b64a6e-61f21e012229bde8e9f0.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

fdd4315639b20e32f08bc16b37cddf4514c250e34601d29979eb4a2c471304ff

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAC8WKXCD1CWB90NM5RN
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 785
etag: "422f0792968acafc3061ddc509f1d4fa-ssl"
x-frame-options: DENY
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 855
x-xss-protection: 1; mode=block

GET
H2 200 app-ee317304c744ef04cb69.js Show response
www.perimeterx.com/ Frame 2FFF 679 KB
211 KB 125ms
111ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/app-ee317304c744ef04cb69.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ce04db8da4adcd3c61f4538252f865491c78e321bbb499909daa536ea95da24

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAC8Y5PS50C2HFBT39RN
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 785
vary: Accept-Encoding
content-length: 215339
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "d2bd825026c51394b42210be7e50f6d8-ssl"
accept-ranges: bytes

GET
H2 200 6d317829-d3d402e5b3de0a374184.js Show response
www.perimeterx.com/ Frame 2FFF 7 KB
2 KB 212ms
199ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/6d317829-d3d402e5b3de0a374184.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

0cb9b072cf2c8c5cabf1fc0ac2b02873e32a1ce13427655ce817cc294eea8fc9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAC8VQ2D2DFHY3DCWAPE
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 2
vary: Accept-Encoding
content-length: 2055
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:12 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "de815af097279cc7781b0505522a33dc-ssl"
accept-ranges: bytes

GET
H2 200 5d29be3a39afb3d02c470836880ef3668828850c-96f6cdc519f233150bf2.js Show response
www.perimeterx.com/ Frame 2FFF 6 KB
3 KB 213ms
199ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/5d29be3a39afb3d02c470836880ef3668828850c-96f6cdc519f233150bf2.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

163c0afdbe5d2a296ee5a962b593854122fb42fb996c9cbbd388c5194aab0efe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGACA1X0XT0XATW162JSW
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 2
vary: Accept-Encoding
content-length: 2325
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:12 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "5ce87fb9ef7b2ce75c90db5b6cbe65c8-ssl"
accept-ranges: bytes

GET
H2 200 9815f04a81c9d7b5d54b3cfd1cb9f97e68eecb8a-4c69d8ab0a860387cfd2.js Show response
www.perimeterx.com/ Frame 2FFF 3 KB
1 KB 166ms
153ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/9815f04a81c9d7b5d54b3cfd1cb9f97e68eecb8a-4c69d8ab0a860387cfd2.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

abd979a2558bc92d17ef9c6c94d3d93e064cc2f029b85ddb8281eb3372f7253e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGACZ2TE6YSSP257PNX09
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 785
vary: Accept-Encoding
content-length: 1082
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "49f9d82645b1dc58226764f91eecd5c3-ssl"
accept-ranges: bytes

GET
H2 200 component---src-layouts-templates-blog-blog-post-js-4cb3b9f77e1259b40c6d.js Show response
www.perimeterx.com/ Frame 2FFF 21 KB
6 KB 261ms
249ms Script
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/component---src-layouts-templates-blog-blog-post-js-4cb3b9f77e1259b40c6d.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

d9df926b2a2ec4e88bbff3a55119b4fc5f2a9fd2d0fee71a12d8e67e03779b95

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGACZQ7050Q26MZRCKSAC
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 2
vary: Accept-Encoding
content-length: 6376
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:12 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "03232890594582ba7de5d9382bce244e-ssl"
accept-ranges: bytes

GET
H2 200 page-data.json
www.perimeterx.com/page-data/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Frame 2FFF 14 KB
6 KB 262ms
250ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/page-data.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

eb8f35e2eb63ca25c5339c27b29feddac2eb36cb9709cf83dab3030a71d5d836

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGACYSAQZ3T1332ZAM29V
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 2
vary: Accept-Encoding
content-length: 5576
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:12 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "2b1c0a5dce373de46b63a1a3db1ededd-ssl-df"
accept-ranges: bytes

GET
H2 200 105486388.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 446 B
548 B 164ms
156ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/105486388.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

9643ad4251cb0b5eac75b7141f9f2109fb2997b3ccfcbbab7ad11c8619adc0b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGACYRXTK2RY8Z2YMMA42
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 785
etag: "5dcb9ff19b2bd023415e3fdbc52f37a5-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 446
x-xss-protection: 1; mode=block

GET
H2 200 1081851012.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 339 B
453 B 258ms
250ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/1081851012.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

7ed25b46fbeee4d58ba491483c894338542894bfb0ef81839514edf7a2657e58

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGACY8D3H0PJ61WZTBAD7
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 1
etag: "f30ae546842bfcede087b4ac2c37873d-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:11:13 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 339
x-xss-protection: 1; mode=block

GET
H2 200 1351792449.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 300 B
388 B 183ms
175ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/1351792449.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

04fac4a0b1ae3f61cbddf6c63d60ad3b419dba7cfd817352c7dc1d2a00e8e48e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAD065PVY4C2KSY7BGBD
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 785
etag: "659cf9327214e3fbc1b61f2549de36c4-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 300
x-xss-protection: 1; mode=block

GET
H2 200 1423242311.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 184 B
273 B 184ms
176ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/1423242311.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

7777858e85646ef5fb3a61d3862af526216ae6f199db4bf1c6ad6b2fcde3bf47

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAD08B0FBJJ4F2V5905J
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 785
etag: "94a829a46c33a235386f476dc1a86ffc-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 184
x-xss-protection: 1; mode=block

GET
H2 200 2363503153.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 28 KB
5 KB 258ms
251ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/2363503153.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

a48260f238dfb9e6f4530e94e235fc5e97450d0933789322c532a64ee2701ace

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAD0ARHAM76HJZRTZ1HT
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
server: Netlify
age: 2
x-frame-options: DENY
etag: "09510e8be2e6f208c6dae41942439ed4-ssl-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:11:12 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
x-xss-protection: 1; mode=block

GET
H2 200 2641933513.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 10 KB
2 KB 184ms
177ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/2641933513.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

0603195f65053eabba0100568898b6d2f29a23dbe3c742391588f9cc5853028a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGACZ3VF95WAK6E159ND3
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 785
vary: Accept-Encoding
content-length: 1454
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "82faff9c774924b32c3c15cccfe85c71-ssl"
accept-ranges: bytes

GET
H2 200 3302762179.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 502 B
675 B 229ms
222ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3302762179.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

42238934ecd53313e8dba8fc5ca2222496d084633c81171a5c70de5d849112af

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAD1VCFWMAPGJV5ZE7PX
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 785
etag: "53c5e1b6d139b8f8705d4bea0586f7a0-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 502
x-xss-protection: 1; mode=block

GET
H2 200 3462628496.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 769 B
890 B 230ms
223ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3462628496.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

dff1c95df1871fb00f4072de4333c7e4643c659dd8e8adbc746729eca62a98fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGACZ0E1WGCQGV385ZD71
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 785
etag: "5f673e298628b6aa8c6517044ffd13aa-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 769
x-xss-protection: 1; mode=block

GET
H2 200 3662110850.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 524 B
626 B 260ms
253ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3662110850.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

28948159b803f5ff7f733581720bbae185968ee1f4f86dd3f2468902103d37fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGACZH3AEYFSVPRXYWM2H
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 2
etag: "98041bd35c1bcc47320dc3c1e9c0dd49-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:11:12 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 524
x-xss-protection: 1; mode=block

GET
H2 200 3700775727.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 165 KB
35 KB 266ms
259ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3700775727.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

98d30c45ea79d9eae8bdcdce751eb747cefcc4a331df431ba7702ccd6cf44c9f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAD07G0BBAPKBZ3H1KP5
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
server: Netlify
age: 2
x-frame-options: DENY
etag: "990e16b187a07900ab85daa87841c02e-ssl-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:11:12 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
x-xss-protection: 1; mode=block

GET
H2 200 3826888336.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 301 B
389 B 245ms
238ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3826888336.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

dbc2a7f895d05be1b17ed8eb1eb609589ff3b3f9b3e2ee97f9a9e530f9026b75

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAD07ZP33NR4H1HB9Y0J
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 785
etag: "cfeea2242f506b3b27a1a34666deb095-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 301
x-xss-protection: 1; mode=block

GET
H2 200 56453587.json
www.perimeterx.com/page-data/sq/d/ Frame 2FFF 48 KB
11 KB 245ms
239ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/56453587.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

dc96c98b2419e72c35072ccb7d9b33b0aef45c2116eafc9c362b134db8c9b293

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAD0PQW9VTW0W8HWSB3S
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 785
vary: Accept-Encoding
content-length: 11051
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "c9f6a3c81dc4ce6ff33c406ca06ba9fc-ssl"
accept-ranges: bytes

GET
H2 200 app-data.json
www.perimeterx.com/page-data/ Frame 2FFF 50 B
137 B 246ms
239ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/app-data.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

f051f186c88f8c27c42012b723552f3dda9ac61b295a0c2be0a58d15edd3bf68

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGAD0W228552X6EYVAGMM
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 785
etag: "60f71c110a7379ea5aa020054de2e4f8-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 17:58:07 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 50
x-xss-protection: 1; mode=block

GET
H2 200 5c0649612297aae80121dbf87e1deedd440464f8.js Show response
d33wubrfki0l68.cloudfront.net/bundles/ Frame 2FFF 958 KB
289 KB 91ms
27ms Script
application/javascript 18.66.92.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.92.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-92-112.fra56.r.cloudfront.net
Software: Netlify /
Resource Hash: 702396a93de43dacac67982c59314f5ae772e59e52a973027a31097e2143993b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G7Z8W504SJS3H8Y5MBVFD8T2
date: Thu, 14 Jul 2022 21:12:13 GMT
content-encoding: gzip
server: Netlify
age: 421140
etag: f335f77f37e1c390dde22f109c4e8897de1259b6-df
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31556926
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: GIMBz94u5SkbYXtyJveLXlCjXFdzsz0Yn0Do9wdbwjLXgKTYXWltdg==
via: 1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)

POST
H2 200 p Show response
b.px-cdn.net/api/v1/PX2003/d/ 149 B
403 B 104ms
36ms XHR
application/json 34.149.125.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://b.px-cdn.net/api/v1/PX2003/d/p
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.125.36 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 36.125.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 6cf92da0046d45140cd9694ebc53282fe8f60e9626d76f38cb4bd2038ea672be

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: multipart/form-data; boundary=----------------cb1z0yirodm2qqv1

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
via: 1.1 google
access-control-allow-headers: authorization
access-control-allow-methods: HEAD,GET,POST,OPTIONS
content-type: application/json
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 149

GET
H2 200 740a51be-bd50-4765-b76c-0ee7167b128c.json Show response
cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/ 3 KB
2 KB 91ms
32ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/740a51be-bd50-4765-b76c-0ee7167b128c.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20f73bc7302a48f92cc74f62598a5ad67a447f9e6c591fd653f1c89af4a5213c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: SLzrUuc5KrvzHsemRtbwmg==
age: 532
vary: Accept-Encoding
content-length: 1275
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:48 GMT
server: cloudflare
etag: 0x8D9E1BE63DB27A6
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c26ebfc1-001e-0170-7296-59ed77000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b167bb590fa-FRA
expires: Tue, 19 Jul 2022 22:11:13 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 78ms
29ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 4153
date: Tue, 19 Jul 2022 17:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 19 Jul 2022 19:02:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273021&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imw...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D48062%26time%3D1658254273021%26url%3Dhttps%253A%252F%252Fresources.perimeterx.com...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273021&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imw...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273021&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8im...

0
266 B

256ms
158ms

Image
application/javascript

13.107.43.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273021&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&liSync=true&e_ipv6=AQISKMqtGzxd_QAAAYIXqCw3JoPqifZQIz7YbUxq_uDfMpVBeT3FogXZ1F5Uk4h3kvZUpbZ4bn88
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Server: 13.107.43.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 77ED1FC04B1E48C2B2A72C8BCA8D5496 Ref B: VIEEDGE2015 Ref C: 2022-07-19T18:11:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXkLGjyEWsMGwQkPF3wTQ==
x-li-fabric: prod-lva1

Redirect headers

date: Tue, 19 Jul 2022 18:11:13 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: CA62A66DAC2540CE9EA9F2682F564BF6 Ref B: FRAEDGE1214 Ref C: 2022-07-19T18:11:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273021&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&liSync=true&e_ipv6=AQISKMqtGzxd_QAAAYIXqCw3JoPqifZQIz7YbUxq_uDfMpVBeT3FogXZ1F5Uk4h3kvZUpbZ4bn88
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXkLGjsSZwnllJzeeDYyg==

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/9504bca9/www-widgetapi.vflset/ 159 KB
51 KB 80ms
31ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9504bca9/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0da1fc9c1b23d76d5b0f9d3154f4141b30a6926b68523c37ec483dd0200945a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 17:18:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3167
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52491
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 00:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 19 Jul 2023 17:18:26 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/YDMIA7YLU5BMFL5TTCRXA7/index.js
https://s.adroll.com/j/exp/index.js

28 B
785 B

81ms
39ms

Script
application/javascript

2600:9000:2260:4a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: HTTP/1.1
Server: 2600:9000:2260:4a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: BTP2rshxaRFWPNdrItPYEau9DI6Y8oce
Via: 1.1 0570c32dd309ece735b20cdea238c10e.cloudfront.net (CloudFront)
Etag: "5816cced8568d223aa09d889f300692b"
Age: 34266
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 28
Last-Modified: Wed, 06 Jul 2022 18:15:57 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 08:40:11 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: 5E2V6aorWpiUL6F4g1fN-GJCqChCu6AZubOGJ9ARCszWCqC8zqhwSQ==

Redirect headers

Date: Tue, 19 Jul 2022 09:24:04 GMT
Via: 1.1 67b828898c2b34a7518c5b13dd7321c0.cloudfront.net (CloudFront)
Age: 31628
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: FLpiBjKe75yVmkKDw8e0HjR-hnO-7oDoviWEsYBwxY_1gOITHD28-w==

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/
Redirect Chain

https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
756 B

47ms
39ms

Script
application/javascript

2600:9000:2260:4a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: HTTP/1.1
Server: 2600:9000:2260:4a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via: 1.1 67b828898c2b34a7518c5b13dd7321c0.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 35392
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 0
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 08:21:28 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: BhxaBFWLFEMw7HmDppPJfcjyw1f1jpEMPmSua7LK07KYwysZ6IIJ7Q==

Redirect headers

Date: Tue, 19 Jul 2022 14:02:57 GMT
Via: 1.1 67b828898c2b34a7518c5b13dd7321c0.cloudfront.net (CloudFront)
Age: 14895
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: XBS9PaPcACids7Y4r6KnbGj9VrKEZ8PQR5B9KAIB4VmzjeRGlDCfQQ==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/ 0
809 B 115ms
38ms Script
text/javascript 2600:9000:2260:4a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/index.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2260:4a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: tzVexVo_CX.1u9K4aI1PdAmzfG6_5fBT
Via: 1.1 07cba85f6c453dcdb0a66cd9934f4172.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 3053
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 0
Last-Modified: Sun, 17 Jul 2022 01:31:13 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 18:10:26 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: vZJ2OPybvPiB3yXq76O5N83qscR9znbEdFlAw-RRFxlSjZEjX9-Gkw==

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.14.0/ 369 KB
82 KB 34ms
33ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7c129ee5de51a2692632d98e0e18cbc092fb758635921e4ecc404293495fafa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: bk+c/8JAdlTEAluR1Sm6dw==
age: 7642
vary: Accept-Encoding
content-length: 83472
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:15 GMT
server: cloudflare
etag: 0x8D8D8E82BC311EE
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 5feb9f59-301e-0115-7b42-ca5c2a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b16a97dbb62-FRA

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 2FFF 278 KB
86 KB 48ms
47ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6c47fb7fabe2a4049645853b9bd231ea9c60fbc30f72fe3e532414a712ca8b54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87955
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:11:13 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 29ms
28ms XHR
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1808954927&t=pageview&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAAC~&jid=1654010121&gjid=685977154&cid=794911285.1658254273&tid=UA-57261032-1&_gid=1810744845.1658254273&_r=1&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&cd10=null&cd11=null&cd12=null&z=1230143161

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:11:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://resources.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 YDMIA7YLU5BMFL5TTCRXA7 Show response
d.adroll.com/consent/check/ 462 B
555 B 149ms
46ms Script
application/javascript 54.72.196.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/YDMIA7YLU5BMFL5TTCRXA7?arrfrr=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&_s=11e1bb52e7d70688126c482426bbf38f&_b=2
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.196.78 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-196-78.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 5325b3a490261a2328311929382f65726b725a767a39332a1b228367528bb7c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
server: nginx/1.20.0
content-length: 462
content-type: application/javascript

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/7db516e1-b839-4652-9f03-4ca7c9545199/ 75 KB
17 KB 28ms
28ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/7db516e1-b839-4652-9f03-4ca7c9545199/en.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec3783a450dbbff3e5c15673dc8ff4348cb71b818c43c18cb8e19bbe236c45fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: +IDd5yKFHYCANhs1gb1cEw==
age: 220
vary: Accept-Encoding
content-length: 16729
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:49 GMT
server: cloudflare
etag: 0x8D9E1BE646C7C71
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 8c694aba-101e-0146-4c96-594025000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b17ad5d90fa-FRA
expires: Tue, 19 Jul 2022 22:11:13 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v29/ Frame 2FFF 44 KB
44 KB 85ms
27ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow:400,500,700|Barlow+Condensed:300,600|Open+Sans:400,500,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 23:10:25 GMT
x-content-type-options: nosniff
age: 68448
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44800
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 18 Jul 2023 23:10:25 GMT

GET
H2 200 7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ Frame 2FFF 20 KB
21 KB 110ms
53ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow:400,500,700|Barlow+Condensed:300,600|Open+Sans:400,500,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 12 Jul 2022 22:25:48 GMT
x-content-type-options: nosniff
age: 589525
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20960
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:18:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Jul 2023 22:25:48 GMT

GET
H2 200 blog-2557x1441-magecart-mallrats_ntdyhn.png
assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_820//v1651174863/tech-blog/2022/mallrats-magecart/ Frame 2FFF 22 KB
23 KB 94ms
25ms Image
image/webp 2a04:4e42:600::604
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_820//v1651174863/tech-blog/2022/mallrats-magecart/blog-2557x1441-magecart-mallrats_ntdyhn.png

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::604 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

f3a589d619416bd674e0fdbcc22738e611b488dde2167be30ec00886ec475ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
x-content-type-options: nosniff
content-disposition: inline; filename="blog-2557x1441-magecart-mallrats_ntdyhn.webp"
server-timing: fastly;dur=3;cpu=1;start=2022-07-19T18:11:13.342Z;desc=hit,rtt;dur=20
vary: DPR
content-length: 22970
last-modified: Fri, 29 Apr 2022 14:32:29 GMT
server: Cloudinary
etag: "4d974f5acf70936822e36d8f65b1254f"
strict-transport-security: max-age=604800
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control: private, no-transform, immutable, max-age=31557600
content-dpr: 1
accept-ranges: bytes
timing-allow-origin: *

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
448 B 94ms
31ms XHR
text/plain 2a00:1450:400c:c0a::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-57261032-1&cid=794911285.1658254273&jid=1654010121&gjid=685977154&_gid=1810744845.1658254273&_u=YADAAEAAQAAAAC~&z=495755440

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0a::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 19 Jul 2022 18:11:13 GMT
content-type: text/plain
access-control-allow-origin: https://resources.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 link-arrow.svg
d33wubrfki0l68.cloudfront.net/25989c27cb9af33a5d7c4724e2e4a792eae54f44/92274/icons/ Frame 2FFF 672 B
1 KB 24ms
22ms Image
image/svg+xml 18.66.92.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d33wubrfki0l68.cloudfront.net/25989c27cb9af33a5d7c4724e2e4a792eae54f44/92274/icons/link-arrow.svg
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.92.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-92-112.fra56.r.cloudfront.net
Software: Netlify /
Resource Hash: eb5587a924cd997ae5ab4896d812257c47dae81e2b9b7a0a049b78cf32793968

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01FV0NVQXDB67HDMP5K9QBDRD6
date: Thu, 03 Feb 2022 20:54:22 GMT
via: 1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)
server: Netlify
age: 14332612
etag: 59d8b67ba0445b4d74ac97fd4c4278d1c3fbac16
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31556926
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 672
x-amz-cf-id: dSIl62IUvESpzBmPUmRJpgZx6jyrVFZ_VR0-SKFhFgpd-PrvcbG59g==

GET
H2 200 campfire_fkupmf.png
assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1657301254/tech-blog/2022/boosting-up-json-performance/ Frame 2FFF 20 KB
20 KB 77ms
25ms Image
image/webp 2a04:4e42:600::604
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1657301254/tech-blog/2022/boosting-up-json-performance/campfire_fkupmf.png

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::604 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

71cb5ad3dbda534886cdfb1980a588e3914a71a87e7e517df63c1abac8227772

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
x-content-type-options: nosniff
content-disposition: inline; filename="campfire_fkupmf.webp"
server-timing: fastly;dur=2;cpu=1;start=2022-07-19T18:11:13.342Z;desc=hit,rtt;dur=20
vary: DPR,Width
content-length: 20106
last-modified: Fri, 08 Jul 2022 18:30:16 GMT
server: Cloudinary
etag: "95b0f7445b106a41d95160d32e73d540"
strict-transport-security: max-age=604800
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control: private, no-transform, immutable, max-age=31557600
content-dpr: 1
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 blog-2557x1441-deobfuscation_yrwwvq.png
assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1657055704/tech-blog/2022/skimmer-deobfuscation/ Frame 2FFF 12 KB
12 KB 77ms
26ms Image
image/webp 2a04:4e42:600::604
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1657055704/tech-blog/2022/skimmer-deobfuscation/blog-2557x1441-deobfuscation_yrwwvq.png

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::604 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

74f060fcb905d2e08f7adfba7ced8546345547ef52be4edd16b2010a1e7aada3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
x-content-type-options: nosniff
content-disposition: inline; filename="blog-2557x1441-deobfuscation_yrwwvq.webp"
server-timing: fastly;dur=2;cpu=1;start=2022-07-19T18:11:13.342Z;desc=hit,rtt;dur=20
vary: DPR,Width
content-length: 12428
last-modified: Wed, 06 Jul 2022 17:43:55 GMT
server: Cloudinary
etag: "41e6e401661379742f5bb83debe72e33"
strict-transport-security: max-age=604800
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control: private, no-transform, immutable, max-age=31557600
content-dpr: 1
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 blog-2557x1441-anti-virtual-machine-skimming_r1nija.png
assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1655921228/tech-blog/2022/anti-vm/ Frame 2FFF 13 KB
13 KB 77ms
26ms Image
image/webp 2a04:4e42:600::604
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1655921228/tech-blog/2022/anti-vm/blog-2557x1441-anti-virtual-machine-skimming_r1nija.png

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::604 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

e0ccd9072d23576c5e88acb4159d67dc4ce03d298e32b2fc51b91bc71ba5d56d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
x-content-type-options: nosniff
content-disposition: inline; filename="blog-2557x1441-anti-virtual-machine-skimming_r1nija.webp"
server-timing: fastly;dur=2;cpu=1;start=2022-07-19T18:11:13.342Z;desc=hit,rtt;dur=20
vary: DPR,Width
content-length: 13002
last-modified: Wed, 22 Jun 2022 22:48:26 GMT
server: Cloudinary
etag: "6c07846290da0a7db3b1ff025e58b8bf"
strict-transport-security: max-age=604800
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control: private, no-transform, immutable, max-age=31557600
content-dpr: 1
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v12/ Frame 2FFF 21 KB
21 KB 64ms
63ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3t-4s51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow:400,500,700|Barlow+Condensed:300,600|Open+Sans:400,500,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 12 Jul 2022 22:25:37 GMT
x-content-type-options: nosniff
age: 589536
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21724
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:29:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Jul 2023 22:25:37 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 78ms
23ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26001
x-xss-protection: 0
pragma: public
x-fb-debug: YAXTWPA4daOLaMNW840YAioqNX+Rg+HX4tRlAzwywGFyUgzUucTLDLMQFpj6JiKJRKD2ci5hy6dwsWhkjR4RGw==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:13 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 jukebox.js Show response
app.cdn.lookbookhq.com/production/jukebox/current/ 683 KB
183 KB 27ms
26ms Script
text/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 93f2e0ec5bdac100d5c45192320aeae54aefd4e34064773d281ccad99ca2777a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 01:04:24 GMT
server: AmazonS3
age: 30154
etag: W/"b1d1c4c410ccb107d04dafa6f2d7f492"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 6fc439c8bc0a64a7ab978ce699795274.cloudfront.net (CloudFront)
cache-control: max-age=43200
date: Tue, 19 Jul 2022 09:48:40 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: 8ViUh1PpzKhuP8qLOhHsUFxihoU6bwUwmfkOdXUn7twfkXW3rxu_Jw==

GET
H2 200 w.js Show response
d10lpsik1i8c69.cloudfront.net/ 5 KB
3 KB 87ms
24ms Script
application/javascript 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2ef6b24ec78bb3ac4bdfa91d2abf4d9f2d4b543ad54c411d50e4307fc8677110

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 17:57:21 GMT
content-encoding: gzip
last-modified: Tue, 01 Mar 2022 22:59:53 GMT
server: AmazonS3
age: 837
etag: W/"eb0a40c00c97d9640177205882172295"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 3395b043e03ecb4acfd925a6e5a26e92.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: SiC7Nvc0Th0ERNoBlQw1LS8FfkKZ1vfx9UZaZvYQc9kn353OKjmTrw==

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.14.0/assets/ 12 KB
3 KB 36ms
35ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/assets/otFlat.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

868f2732413f5fcb021d726343ac249b6ca630db5fbd578f6525f279dda5c22b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: BkZngIV1hzEthgbkouRUbA==
age: 219
vary: Accept-Encoding
content-length: 2832
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:04 GMT
server: cloudflare
etag: 0x8D8D8E825563082
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 90491bdc-701e-00da-2c96-597dcd000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b188e9190fa-FRA

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/6.14.0/assets/v2/ 47 KB
11 KB 36ms
35ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/assets/v2/otPcCenter.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5de3651c0aa89e6497da505565c8944039fd6480aa161b1f270d1f5953c9d5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 8jNYupXcL2bcdab+1R7CAg==
age: 220
vary: Accept-Encoding
content-length: 11511
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:07 GMT
server: cloudflare
etag: 0x8D8D8E827001198
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: a0508b34-801e-0065-2596-5969bb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b188e9390fa-FRA

GET
H2 200 lftracker_v1_9mDnrdyX0ng1KXMv.js Show response
lftracker.leadfeeder.com/ 29 KB
11 KB 82ms
23ms Script
application/javascript 13.32.99.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lftracker.leadfeeder.com/lftracker_v1_9mDnrdyX0ng1KXMv.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-30.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 139fc90823b96a757bba2c141df7fa3811af648b70cd294723a3dbb47cb13b1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: _vGDpzyT8SqbIqKQjJGReZGviOfU8A69
content-encoding: gzip
last-modified: Mon, 27 Jun 2022 07:03:30 GMT
server: AmazonS3
age: 3472
etag: W/"c6baef4235444eeb7c09f78f14e761e2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 2a44338adc8233e5b25aca28287a69c8.cloudfront.net (CloudFront)
cache-control: max-age=3600
date: Tue, 19 Jul 2022 17:23:10 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: Cj37HgcU4n4lTF-0Jxm9qrk0H0Sfl4imjFjyqeXe2PVUn2plNDI--w==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 112ms
60ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-57261032-1&cid=794911285.1658254273&jid=1654010121&_u=YADAAEAAQAAAAC~&z=37471599

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:11:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 120ms
68ms Image
image/gif 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-57261032-1&cid=794911285.1658254273&jid=1654010121&_u=YADAAEAAQAAAAC~&z=37471599

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:11:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ Frame 2FFF 8 KB
3 KB 23ms
23ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:13 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=80179
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ Frame 2FFF 1 KB
1 KB 23ms
22ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:13 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ Frame 2FFF 20 KB
7 KB 28ms
28ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 4m3LBpuQ5au3un+sbdTm6g==
age: 393
vary: Accept-Encoding
content-length: 6922
x-ms-lease-status: unlocked
last-modified: Thu, 14 Jul 2022 19:31:29 GMT
server: cloudflare
etag: 0x8DA65CF736BBFE4
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 32dfe822-301e-0115-48e4-975c2a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b19ae49bb62-FRA

GET
H3 200 iframe_api Show response
www.youtube.com/ Frame 2FFF 980 B
515 B 38ms
38ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fe3cdb6342633b630a1636d3a83f1beb1aa5a9404078a93618f3235f4d609f6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Tue, 19 Jul 2022 18:11:13 GMT

GET
H2 200 4607.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ Frame 2FFF 16 B
236 B 146ms
146ms Script
text/javascript 2606:4700:4400::6812:2437
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/4607.js?p=https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/&e=

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: 209e9c1f-c464-42cf-85ea-3ef0a29bdb3c
x-runtime: 0.003804
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=604800
x-download-options: noopen
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray: 72d56b19b9c892ae-FRA

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ Frame 2FFF 52 KB
17 KB 34ms
33ms Script
text/javascript 2600:9000:2260:4a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2260:4a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9db9265f8119cc29e3011eb69fb5d9bfb6b2b715890351480ac0904059af7f02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: J7p8W1lQgNY91qwUxZU3x.y9IQrTVjMu
Content-Encoding: gzip
Etag: W/"d570d2e0cc47679b5bf3a6f9ff5b9e5b"
Age: 2255
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Via: 1.1 0570c32dd309ece735b20cdea238c10e.cloudfront.net (CloudFront)
Last-Modified: Thu, 30 Jun 2022 21:03:48 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 17:33:41 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: p0-J9ZOXDnAko-KhE1t4vLTMD6kU1QfJlUzQ5cwbmVurS7uTXkC4Lw==

GET
H3 200 368880343933228 Show response
connect.facebook.net/signals/config/ 291 KB
84 KB 47ms
23ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/368880343933228?v=2.9.65&r=stable

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

28e696f1e4297a65c928a3c82a163d9eacba8bea8725beea0b8aa2470dc88248

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85605
x-xss-protection: 0
pragma: public
x-fb-debug: 28bi4pEHCdmTl7E99Bk630VkkqRt3tnlNUrDueNXHxvdQ4mvq5nlEQKGWp7EM9ti255bO9YzDR3EKj+t91Sz3w==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:13 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

OPTIONS
H2 200 create_event
jukebox.pathfactory.com/api/public/v1/page_views/ Frame 0
0 111ms
111ms Preflight 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/page_views/create_event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-195-36.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 19 Jul 2022 18:11:13 GMT

OPTIONS
H2 200 create_event
jukebox.pathfactory.com/api/public/v1/page_views/ Frame 0
0 111ms
110ms Preflight 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/page_views/create_event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-195-36.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 19 Jul 2022 18:11:13 GMT

POST
H2 204 create_event Show response
jukebox.pathfactory.com/api/public/v1/page_views/ 0
738 B 129ms
129ms XHR
text/plain 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/page_views/create_event

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-82-195-36.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.014132
date: Tue, 19 Jul 2022 18:11:13 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
x-content-type-options: nosniff
x-request-id: fe7b1535-16db-4730-bb13-ee16c5b2674e

POST
H2 204 create_event Show response
jukebox.pathfactory.com/api/public/v1/page_views/ 0
737 B 128ms
128ms XHR
text/plain 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/page_views/create_event

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-82-195-36.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.014517
date: Tue, 19 Jul 2022 18:11:13 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
x-content-type-options: nosniff
x-request-id: 847fb7c8-6852-4add-9c8b-23572035604f

GET
H2 200 8cf9b171-c565-4071-9447-9567cebc44e4.png
cdn.pathfactory.com/assets/10557/thumbnails/371592/ 51 KB
51 KB 475ms
418ms Image
image/png 52.222.214.93
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.pathfactory.com/assets/10557/thumbnails/371592/8cf9b171-c565-4071-9447-9567cebc44e4.png
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-93.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 91892af76d8bc88bb779fb1b99ae8d9a9a84d0ffa2b27c2ebf8c35b4ab3a0c83

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 19 Jul 2022 18:11:15 GMT
via: 1.1 bfad099b4e1fa2ec7d21876e0293dc20.cloudfront.net (CloudFront)
last-modified: Mon, 09 Aug 2021 14:48:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
etag: "d42ce3a856a78f0e34085bba7bb30f1a"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: image/png
cache-control: max-age=60, must-revalidate
accept-ranges: bytes
content-length: 52106
x-amz-cf-id: YU_dOFuGlHaSMWKp-xFpDidixYvHAu8PusZzTT1fZuhYmGFsGH3XIA==

GET
H2 200 / Show response
settings.luckyorange.net/ 3 KB
2 KB 200ms
148ms Fetch
application/json 172.67.75.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://settings.luckyorange.net/?u=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&s=84276

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.75.100 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3536a18dd1ff568df8432d6dc496721bbf34707337fc8502e42b6f37dc1128df

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://resources.perimeterx.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cjTHX055aBrGO7Om0ijqzsPxlixKU79rK0crRsQHVoDInXjBdOe2i%2F%2F%2FALlvSKg02FGl5nn1sISAeqzbWrxUluns7%2BtlPjZsrLPGYytJXQfQi7vazZvtGYSicAeihhRhhH%2FPMKifFDWibg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 72d56b1a9e256927-FRA
access-control-allow-headers: Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,Keep-Alive,X-Requested-With,If-Modified-Since

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/ 69 KB
70 KB 53ms
28ms Font
font/woff2 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/fontawesome-webfont.woff2?v=4.6.1

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Origin: https://resources.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 756
age: 57565
cdn-proxyver: 1.02
cdn-cachedat: 06/09/2022 01:10:16
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 70728
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
etag: "926c93d201fe51c8f351e858468980c3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff2
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 6a524c4fee4af879369f6dea54294667
accept-ranges: bytes
cf-ray: 72d56b1a8cd75c0e-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 23ms
23ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:13 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=80179
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H2 200 page-data.json
www.perimeterx.com/page-data/tech-blog/ Frame 2FFF 0
1 KB 143ms
143ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGB5Y2WV0N5PWGKCHVRM3
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 1385
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:13 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "2be118ba3742a3c31d1549725a303aa7-ssl"
accept-ranges: bytes

GET
H2 200 page-data.json
www.perimeterx.com/page-data/tech-blog/ben-baryo/ Frame 2FFF 0
2 KB 148ms
147ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/ben-baryo/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGB5YAHYPMWFAGAMEXC37
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 2044
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:13 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "ee9c3749812a78d8fe99e3bbcb975600-ssl"
accept-ranges: bytes

OPTIONS
H2 200 init
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 114ms
113ms Preflight 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/init?image=&title=&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&clientId=LB-FE20E0D4-10557
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-195-36.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 19 Jul 2022 18:11:13 GMT

GET
H2 204 init Show response
jukebox.pathfactory.com/api/public/v1/ 0
738 B 133ms
132ms XHR
text/plain 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/init?image=&title=&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&clientId=LB-FE20E0D4-10557

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-82-195-36.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.017973
date: Tue, 19 Jul 2022 18:11:13 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
x-content-type-options: nosniff
x-request-id: 4dd2a609-db75-4cde-a588-e11987f93b7c

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 2FFF 213 KB
72 KB 43ms
42ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S5CWZF51H2&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

911e4703fc8a4e7e2e0f71c24c39599e85bcf6b7448d3ae3e5a7e5b3ce29b17b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73995
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:11:13 GMT

GET
H3 200 optimize.js Show response
www.google-analytics.com/gtm/ Frame 2FFF 117 KB
44 KB 35ms
34ms Script
application/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=GTM-PCDTQ25

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ff5dc6f952726bb9ae5490f01442459968d6add9c1201b497d840c6e9f1528ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45245
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:11:13 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ Frame 2FFF 8 KB
3 KB 23ms
23ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:13 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=80179
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H/1.1 204
No Content / Show response
api9130.d41.co/sync/ Frame 2FFF 0
510 B 493ms
119ms Script
text/plain 52.207.81.145
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api9130.d41.co/sync/

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.207.81.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-207-81-145.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:11:14 GMT
Referrer-Policy: no-referrer-when-downgrade
Expect-CT: max-age=30, report-uri="https://a54b4ab95d40a8b116fae47033b75682.report-uri.com/r/d/ct/reportOnly"
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
access-control-allow-origin: https://www.perimeterx.com
Cache-control: no-store
access-control-allow-credentials: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK cnv
cnv.event.prod.bidr.io/log/ Frame 2FFF 43 B
430 B 46ms
46ms Image
image/gif 54.220.8.206
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=[ORDER]&ord=1568848706

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.220.8.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-220-8-206.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 19 Jul 2022 18:11:13 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
attr.ml-api.io/ Frame 2FFF
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035

0
243 B

379ms
379ms

Image
application/json

2600:9000:2251:8200:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Server: 2600:9000:2251:8200:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:14 GMT
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
apigw-requestid: VhsGZh-_IAMEJCg=
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: UDYhI5xNLT2VEBzBtCda3xxJqhe-f_FcPFZpaYv_7gh-Mc4dHYPzXw==

Redirect headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:11:13 GMT
X-Proxy-Origin: 217.114.218.19; 217.114.218.19; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 23005b87-f1f3-4108-8557-9f116345f6f2
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 441 B
459 B 96ms
49ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 3aad26234b8109cc4b18062eb16da66946040119cbfd006637836390ec64f87f

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

GET
H2 200 /
tr.lfeeder.com/ 43 B
293 B 134ms
48ms Image
image/gif 18.66.122.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTU3MjYxMDMyLTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiNzk0OTExMjg1LjE2NTgyNTQyNzMiXSwiY29udGV4dCI6eyJsaWJyYXJ5Ijp7Im5hbWUiOiJsZnRyYWNrZXIiLCJ2ZXJzaW9uIjoiMi41MC4xIn0sInBhZ2VVcmwiOiJodHRwczovL3Jlc291cmNlcy5wZXJpbWV0ZXJ4LmNvbS9uZXdzLW5hdHVyYWxmcmVzaC1tYWdlY2FydC1hbmFseXNpcz91dG1fc291cmNlPW1hcmtldG8mdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249bmV3c2xldHRlci1qdWx5LTIwMjImbWt0X3Rvaz1NREF4TFZaS1dDMHhNRFFBQUFHRnRwZkk4aW13Zk9teFhvbEJXREZxWkFvSXZzcEtEdEhiU0N3ajl3aEw5VlNEZmtqZE9UN3FKb3p5QTA1TWFOTmw3VVdmRThXME05bnMwSU1NWHdBN29ydkJLdmlWY0JzNmJsajNSeU5sS0tFIiwicGFnZVRpdGxlIjoiQW4gQW5hbHlzaXMgb2YgdGhlIE5hdHVyYWwgRnJlc2ggTWFsbCBNYWdlY2FydCBBdHRhY2siLCJyZWZlcnJlciI6Imh0dHBzOi8vbWt0by1zajEzMDExMi5jb20vIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiYjkyZGZhODc5OGZhZWNiZiIsInNjcmlwdElkIjoiOW1EbnJkeVgwbmcxS1hNdiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuMmI3MmRhZmNlYjZiZDI3Yi4xNjU4MjU0MjczODE5IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0=
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-6.fra60.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
via: 1.1 8ac93eaf91328abbc6951d3fbab21e80.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA60-P2
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: DNr0lZdYC6e4WrGyQKrAxawynI71XWTedh_42D17jfJPsPSlT3irHA==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ Frame 2FFF 11 KB
5 KB 22ms
22ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:13 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Thu, 27 Oct 2022 18:11:13 GMT

GET
H2

200

collect
px4.ads.linkedin.com/ Frame 2FFF
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273823&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imw...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273823&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8im...

0
142 B

150ms
149ms

Image
application/javascript

13.107.43.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273823&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&e_ipv6=AQLayGHwJjKGuQAAAYIXqC1k5pyFQYi4QQbxmZc2zMjhr97zVkm9U24k-KbFKx-7HsvqJetxb8jy
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Server: 13.107.43.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 805FE1B2B871471B925EC46A60266E41 Ref B: VIEEDGE2015 Ref C: 2022-07-19T18:11:14Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXkLGjzw0JnCnQd19Iqhg==
x-li-fabric: prod-lva1

Redirect headers

date: Tue, 19 Jul 2022 18:11:13 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: AA94A8BD29FD49578E825736C9F56939 Ref B: FRAEDGE1214 Ref C: 2022-07-19T18:11:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254273823&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&e_ipv6=AQLayGHwJjKGuQAAAYIXqC1k5pyFQYi4QQbxmZc2zMjhr97zVkm9U24k-KbFKx-7HsvqJetxb8jy
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXkLGjxF8dbts9Ek67fhA==

GET
H2 200 740a51be-bd50-4765-b76c-0ee7167b128c.json Show response
cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/ Frame 2FFF 3 KB
1 KB 29ms
29ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/740a51be-bd50-4765-b76c-0ee7167b128c.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20f73bc7302a48f92cc74f62598a5ad67a447f9e6c591fd653f1c89af4a5213c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: SLzrUuc5KrvzHsemRtbwmg==
age: 6224
vary: Accept-Encoding
content-length: 1275
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:48 GMT
server: cloudflare
etag: 0x8D9E1BE63DB27A6
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 7a8abd34-101e-00e8-4160-2d251d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b1b7acd90fa-FRA
expires: Tue, 19 Jul 2022 22:11:13 GMT

GET
H2 200 k1S0pNhzdwg3y5l6uOk0 Show response
ws.zoominfo.com/pixel/ Frame 2FFF 3 KB
2 KB 236ms
182ms Script
text/javascript 2606:4700::6810:a852
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/k1S0pNhzdwg3y5l6uOk0

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

76610a5fb9f64f4575e8e70dfdee68be6672f3d7f326530526f7889ab3175141

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 72d56b1bd90f5b2c-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type
via: 1.1 google

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/9504bca9/www-widgetapi.vflset/ Frame 2FFF 159 KB
51 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9504bca9/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0da1fc9c1b23d76d5b0f9d3154f4141b30a6926b68523c37ec483dd0200945a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 17:18:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3167
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52491
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 00:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 19 Jul 2023 17:18:26 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/ Frame 2FFF
Redirect Chain

https://s.adroll.com/j/exp/YDMIA7YLU5BMFL5TTCRXA7/index.js
https://s.adroll.com/j/exp/index.js

28 B
785 B

49ms
48ms

Script
application/javascript

2600:9000:2260:4a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: HTTP/1.1
Server: 2600:9000:2260:4a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: ARc7DnguDTvPdHjwLfVxPM5gMAw12mfP
Via: 1.1 67b828898c2b34a7518c5b13dd7321c0.cloudfront.net (CloudFront)
Etag: "5816cced8568d223aa09d889f300692b"
Age: 34266
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 28
Last-Modified: Wed, 15 Jun 2022 19:48:17 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 08:40:33 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: IbgeM4PX5W31PYwMr4TW6mXKeuI-_Zc_fRxERKJ8-Ag7KiXStum5Rg==

Redirect headers

Date: Tue, 19 Jul 2022 09:24:04 GMT
Via: 1.1 0570c32dd309ece735b20cdea238c10e.cloudfront.net (CloudFront)
Age: 31628
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: NfKKWy9pFb8j48NQlPOpDPDfBf_wywOCdudmePwea0kzHoFw8TNjEw==

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/ Frame 2FFF
Redirect Chain

https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
756 B

47ms
46ms

Script
application/javascript

2600:9000:2260:4a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: HTTP/1.1
Server: 2600:9000:2260:4a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via: 1.1 07cba85f6c453dcdb0a66cd9934f4172.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 35392
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 0
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 08:21:26 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: AwHTcLH9FJuvi5AAzJ90VftEogOw7Cx120wgRDTVGiraQhfmuuANZg==

Redirect headers

Date: Tue, 19 Jul 2022 14:02:57 GMT
Via: 1.1 67b828898c2b34a7518c5b13dd7321c0.cloudfront.net (CloudFront)
Age: 14895
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: CVSI-IOb0jfZI8gc9-kEwIKx5mOj62vy_WtiWL1m2UPkw7zEjxnJZA==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/ Frame 2FFF 0
809 B 33ms
32ms Script
text/javascript 2600:9000:2260:4a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2260:4a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: tzVexVo_CX.1u9K4aI1PdAmzfG6_5fBT
Via: 1.1 07cba85f6c453dcdb0a66cd9934f4172.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 3053
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 0
Last-Modified: Sun, 17 Jul 2022 01:31:13 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 18:10:26 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: TXL50-P3
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: hA7ju5nGGSgB14Hvzt6TEm4T51zdM_CvrUkXywIaYJrL9o4aTR8YpQ==

GET
H2 200 /
tr.lfeeder.com/ 43 B
292 B 89ms
54ms Image
image/gif 18.66.122.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTU3MjYxMDMyLTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiNzk0OTExMjg1LjE2NTgyNTQyNzMiXSwiY29udGV4dCI6eyJsaWJyYXJ5Ijp7Im5hbWUiOiJsZnRyYWNrZXIiLCJ2ZXJzaW9uIjoiMi41MC4xIn0sInBhZ2VVcmwiOiJodHRwczovL3Jlc291cmNlcy5wZXJpbWV0ZXJ4LmNvbS9uZXdzLW5hdHVyYWxmcmVzaC1tYWdlY2FydC1hbmFseXNpcz91dG1fc291cmNlPW1hcmtldG8mdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249bmV3c2xldHRlci1qdWx5LTIwMjImbWt0X3Rvaz1NREF4TFZaS1dDMHhNRFFBQUFHRnRwZkk4aW13Zk9teFhvbEJXREZxWkFvSXZzcEtEdEhiU0N3ajl3aEw5VlNEZmtqZE9UN3FKb3p5QTA1TWFOTmw3VVdmRThXME05bnMwSU1NWHdBN29ydkJLdmlWY0JzNmJsajNSeU5sS0tFIiwicGFnZVRpdGxlIjoiQW4gQW5hbHlzaXMgb2YgdGhlIE5hdHVyYWwgRnJlc2ggTWFsbCBNYWdlY2FydCBBdHRhY2siLCJyZWZlcnJlciI6Imh0dHBzOi8vbWt0by1zajEzMDExMi5jb20vIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiNmY3MDc1YmZjNjc3NmJhYiIsInNjcmlwdElkIjoiOW1EbnJkeVgwbmcxS1hNdiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuMmI3MmRhZmNlYjZiZDI3Yi4xNjU4MjU0MjczODE5IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0=
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-6.fra60.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
via: 1.1 8ac93eaf91328abbc6951d3fbab21e80.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA60-P2
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: vcU-Ll5UtflJKeQeg7e6KdrMfw_6gO1SO-m5z8_L4CzVODdq1a8nig==

GET
H2 200 740a51be-bd50-4765-b76c-0ee7167b128c.json Show response
cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/ Frame 2FFF 3 KB
1 KB 52ms
48ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/740a51be-bd50-4765-b76c-0ee7167b128c.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20f73bc7302a48f92cc74f62598a5ad67a447f9e6c591fd653f1c89af4a5213c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: SLzrUuc5KrvzHsemRtbwmg==
age: 6224
vary: Accept-Encoding
content-length: 1275
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:48 GMT
server: cloudflare
etag: 0x8D9E1BE63DB27A6
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 7a8abd34-101e-00e8-4160-2d251d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b1bdb6d90fa-FRA
expires: Tue, 19 Jul 2022 22:11:13 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 86ms
15ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=368880343933228&ev=PageView&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&rl=https%3A%2F%2Fmkto-sj130112.com%2F&if=false&ts=1658254273892&sw=1600&sh=1200&v=2.9.65&r=stable&ec=0&o=30&fbp=fb.1.1658254273891.1881879609&it=1658254273563&coo=false&exp=u0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Tue, 19 Jul 2022 18:11:13 GMT

GET
H2 200 px-tech-blog.svg
www.perimeterx.com/logos/ Frame 2FFF 26 KB
9 KB 152ms
151ms Image
image/svg+xml 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.perimeterx.com/logos/px-tech-blog.svg

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

c4191bdf74ac201d8071060b64d19ec9d284ee7512d5a08ecef16d99b787b9d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBBZB70X3N60780T6M48
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 2
vary: Accept-Encoding
content-length: 9363
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:13 GMT
strict-transport-security: max-age=31536000
content-type: image/svg+xml
cache-control: public, max-age=0, must-revalidate
etag: "d0e65f22b30f953aa748974953adbe60-ssl"
accept-ranges: bytes

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 2FFF 98 KB
25 KB 24ms
23ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26001
x-xss-protection: 0
pragma: public
x-fb-debug: YAXTWPA4daOLaMNW840YAioqNX+Rg+HX4tRlAzwywGFyUgzUucTLDLMQFpj6JiKJRKD2ci5hy6dwsWhkjR4RGw==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:13 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 jukebox.js Show response
app.cdn.lookbookhq.com/production/jukebox/current/ Frame 2FFF 683 KB
183 KB 24ms
24ms Script
text/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by: Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 93f2e0ec5bdac100d5c45192320aeae54aefd4e34064773d281ccad99ca2777a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 01:04:24 GMT
server: AmazonS3
age: 30154
etag: W/"b1d1c4c410ccb107d04dafa6f2d7f492"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 6fc439c8bc0a64a7ab978ce699795274.cloudfront.net (CloudFront)
cache-control: max-age=43200
date: Tue, 19 Jul 2022 09:48:40 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: bAPjir9d0qPfXbhBk299BmXOu8yNPYpF1-q7RUSLjmAAWSIrJ1eAWw==

GET
H2 200 w.js Show response
d10lpsik1i8c69.cloudfront.net/ Frame 2FFF 5 KB
3 KB 26ms
25ms Script
application/javascript 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Requested by: Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2ef6b24ec78bb3ac4bdfa91d2abf4d9f2d4b543ad54c411d50e4307fc8677110

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 17:57:21 GMT
content-encoding: gzip
last-modified: Tue, 01 Mar 2022 22:59:53 GMT
server: AmazonS3
age: 837
etag: W/"eb0a40c00c97d9640177205882172295"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 3395b043e03ecb4acfd925a6e5a26e92.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: Ultw7WNkWftbfQyPZSlKLroXNNmRW8ZnVziJkNQjryC6jD2rGQYppQ==

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.14.0/ Frame 2FFF 369 KB
82 KB 29ms
28ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7c129ee5de51a2692632d98e0e18cbc092fb758635921e4ecc404293495fafa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: bk+c/8JAdlTEAluR1Sm6dw==
age: 7642
vary: Accept-Encoding
content-length: 83472
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:15 GMT
server: cloudflare
etag: 0x8D8D8E82BC311EE
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 5feb9f59-301e-0115-7b42-ca5c2a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b1c2aa0bb62-FRA

GET
H2 200 page-data.json Show response
www.perimeterx.com/page-data/tech-blog/ Frame 2FFF 3 KB
1 KB 24ms
24ms XHR
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

7724bf5c171c673ab3f574e6e6c3921668326904a0aa564d519c0e33e4d5b2f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBCZBBHXPCKDP68Y6QQP
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 1385
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:13 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "2be118ba3742a3c31d1549725a303aa7-ssl"
accept-ranges: bytes

GET
H2 200 page-data.json Show response
www.perimeterx.com/page-data/tech-blog/ben-baryo/ Frame 2FFF 6 KB
2 KB 25ms
24ms XHR
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/ben-baryo/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

0088c55fcbe4ccb2df59204288cece3aedac3efce32493bea627d68466148e2b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBDEVV2AN6BNMQJBH54J
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 2044
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:13 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "ee9c3749812a78d8fe99e3bbcb975600-ssl"
accept-ranges: bytes

GET
H2 200 page-data.json
www.perimeterx.com/page-data/about/careers/ Frame 2FFF 0
3 KB 154ms
144ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/about/careers/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBDTTN967Q7T3K71WTC0
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 1
vary: Accept-Encoding
content-length: 2986
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:14 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "ed3082f91f15dff29f043d6f338fe620-ssl"
accept-ranges: bytes

GET
H2 200 page-data.json
www.perimeterx.com/page-data/index/ Frame 2FFF 0
4 KB 33ms
24ms Other
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/index/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBDTAPNVA4TDGACEGSPQ
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 15
vary: Accept-Encoding
content-length: 4037
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:10:58 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "96a5816c2bd86b34e3406cf142521d91-ssl"
accept-ranges: bytes

GET
H2 200 clickstream.js Show response
d10lpsik1i8c69.cloudfront.net/js/ Frame 7947 287 KB
93 KB 76ms
25ms Script
application/javascript 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92f65d433b40a4c4719b742357563d08b1c16d6396571933da9f02f9ef7424d8

Request headers

Referer
Origin: https://resources.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:07:50 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 205
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
etag: W/"16e967413dfa0346be281513c77581b9"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 bfd667b9fb826986b85315f856bf5884.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: vhDSWbKGBYrDSahTjjOQeTob-DP3j7jhDOba5BZWcPxArxFBaABa2A==

GET
H2 200 lftracker_v1_9mDnrdyX0ng1KXMv.js Show response
lftracker.leadfeeder.com/ Frame 2FFF 29 KB
11 KB 25ms
23ms Script
application/javascript 13.32.99.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lftracker.leadfeeder.com/lftracker_v1_9mDnrdyX0ng1KXMv.js
Requested by: Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-30.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 139fc90823b96a757bba2c141df7fa3811af648b70cd294723a3dbb47cb13b1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: _vGDpzyT8SqbIqKQjJGReZGviOfU8A69
content-encoding: gzip
last-modified: Mon, 27 Jun 2022 07:03:30 GMT
server: AmazonS3
age: 3472
etag: W/"c6baef4235444eeb7c09f78f14e761e2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 2a44338adc8233e5b25aca28287a69c8.cloudfront.net (CloudFront)
cache-control: max-age=3600
date: Tue, 19 Jul 2022 17:23:10 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: reSB74yUNIlIOhszfrZmU7ZwBIr1sSF7U8pYvp5Nxy5xLVEdCxiBsg==

GET
H2 200 YDMIA7YLU5BMFL5TTCRXA7 Show response
d.adroll.com/consent/check/ Frame 2FFF 462 B
554 B 45ms
45ms Script
application/javascript 54.72.196.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/YDMIA7YLU5BMFL5TTCRXA7?arrfrr=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&_s=1091371113de555fc4b7872413836551&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.196.78 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-196-78.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 5325b3a490261a2328311929382f65726b725a767a39332a1b228367528bb7c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:14 GMT
server: nginx/1.20.0
content-length: 462
content-type: application/javascript

POST
H/1.1 200
OK visitWebPage
001-vjx-104.mktoresp.com/webevents/ Frame 2FFF 2 B
318 B 164ms
164ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://001-vjx-104.mktoresp.com/webevents/visitWebPage?_mchNc=1658254274034&_mchCn=&_mchId=001-VJX-104&_mchTk=_mch-perimeterx.com-1658254272462-57194&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&_mchHo=www.perimeterx.com&_mchPo=&_mchRu=%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:11:14 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 97feed7f-fd74-42b8-adb6-2949e184c61b

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame 2FFF 49 KB
20 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 4154
date: Tue, 19 Jul 2022 17:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 19 Jul 2022 19:02:00 GMT

GET
H2 200 component---src-layouts-templates-blog-tech-blog-js-668db3f9b71a3966ff38.js
www.perimeterx.com/ Frame 2FFF 0
3 KB 233ms
232ms Other
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/component---src-layouts-templates-blog-tech-blog-js-668db3f9b71a3966ff38.js

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBJ0C3YEWXHG98R2MTAM
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 2762
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:14 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "0413d3bf327423b73de857becf225857-ssl"
accept-ranges: bytes

GET
H2 200 component---src-layouts-templates-blog-tech-blog-authors-js-9ed68fb2884673daafca.js
www.perimeterx.com/ Frame 2FFF 0
2 KB 142ms
141ms Other
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/component---src-layouts-templates-blog-tech-blog-authors-js-9ed68fb2884673daafca.js

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBJ0GDKC9P9H1DRX4ANN
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 1938
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:14 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "2473458106d595cfeb7d48d0cb7ed498-ssl"
accept-ranges: bytes

GET
H2 200 page-data.json Show response
www.perimeterx.com/page-data/index/ Frame 2FFF 23 KB
4 KB 25ms
24ms XHR
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/index/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

6c161eaf631baf5bbdb7c35308da9ddac4d378263f6dd4423f3e3a2c86528fda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBJ7CKYCC34XJYG3GPC4
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 16
vary: Accept-Encoding
content-length: 4037
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:10:58 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "96a5816c2bd86b34e3406cf142521d91-ssl"
accept-ranges: bytes

GET
H3 200 368880343933228 Show response
connect.facebook.net/signals/config/ Frame 2FFF 291 KB
84 KB 22ms
22ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/368880343933228?v=2.9.65&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

28e696f1e4297a65c928a3c82a163d9eacba8bea8725beea0b8aa2470dc88248

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85605
x-xss-protection: 0
pragma: public
x-fb-debug: 28bi4pEHCdmTl7E99Bk630VkkqRt3tnlNUrDueNXHxvdQ4mvq5nlEQKGWp7EM9ti255bO9YzDR3EKj+t91Sz3w==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:14 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
settings.luckyorange.net/ Frame 2FFF 3 KB
1 KB 149ms
148ms Fetch
application/json 172.67.75.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://settings.luckyorange.net/?u=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&s=84276

Requested by

Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/w.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.75.100 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50d3acdc6b34002e97f3763ee2072590dc43cf8f54064437085211783a5aff99

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:14 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.perimeterx.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0oxRCElLUUhaJhjXvDeIywZ%2BxxWXr7WChi%2BG7i0cRZ28VyKxsvHrCGLQTSwzuxarDUY6DDIHgTfIWSUffAPKfxfIvHkFfzUAesop8P8ZiWyfOkqUFfhkMJesr7PzbCAXINCby9%2BjoqE4Ww%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 72d56b1d59ea6927-FRA
access-control-allow-headers: Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,Keep-Alive,X-Requested-With,If-Modified-Since

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/7db516e1-b839-4652-9f03-4ca7c9545199/ Frame 2FFF 75 KB
16 KB 34ms
33ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/7db516e1-b839-4652-9f03-4ca7c9545199/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec3783a450dbbff3e5c15673dc8ff4348cb71b818c43c18cb8e19bbe236c45fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: +IDd5yKFHYCANhs1gb1cEw==
age: 6225
vary: Accept-Encoding
content-length: 16729
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:49 GMT
server: cloudflare
etag: 0x8D9E1BE646C7C71
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 48776c1f-001e-0091-2c48-574c57000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b1d7d7e90fa-FRA
expires: Tue, 19 Jul 2022 22:11:14 GMT

GET
H3 200 collect
www.google-analytics.com/ Frame 2FFF 35 B
55 B 22ms
21ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=875759618&t=pageview&_s=1&dl=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&dr=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&ul=en-us&de=UTF-8&dt=MallRats%3A%20An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack%20%7C%20PerimeterX&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABQ~&jid=&gjid=&cid=794911285.1658254273&tid=UA-57261032-1&_gid=1810744845.1658254273&gtm=2wg7i0NQ65KGZ&cd5=tech%20blog&cd6=2022&cd7=ben%20baryo&cd8=www.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&cd10=code%20defender&cd11=e-commerce&cd12=digital%20skimming%2Cpii%20harvesting&z=1952105158

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 13:15:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 17743
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 page-data.json Show response
www.perimeterx.com/page-data/about/careers/ Frame 2FFF 14 KB
3 KB 25ms
25ms XHR
application/json 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/about/careers/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

61eef10fb6867c58353af2e0686c6eeb1456520f33a4fcc7dcf18755c848a15b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBKQ08GTWH462GYYYBXJ
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 1
vary: Accept-Encoding
content-length: 2986
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:11:14 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "ed3082f91f15dff29f043d6f338fe620-ssl"
accept-ranges: bytes

GET
H2 200 /
tr.lfeeder.com/ Frame 2FFF 43 B
293 B 40ms
40ms Image
image/gif 18.66.122.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTU3MjYxMDMyLTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiNzk0OTExMjg1LjE2NTgyNTQyNzMiXSwiY29udGV4dCI6eyJsaWJyYXJ5Ijp7Im5hbWUiOiJsZnRyYWNrZXIiLCJ2ZXJzaW9uIjoiMi41MC4xIn0sInBhZ2VVcmwiOiJodHRwczovL3d3dy5wZXJpbWV0ZXJ4LmNvbS90ZWNoLWJsb2cvMjAyMi9tYWxscmF0cy1hbi1hbmFseXNpcy1vZi10aGUtbmF0dXJhbC1mcmVzaC1tYWxsLW1hZ2VjYXJ0LWF0dGFjay8iLCJwYWdlVGl0bGUiOiJNYWxsUmF0czogQW4gQW5hbHlzaXMgb2YgdGhlIE5hdHVyYWwgRnJlc2ggTWFsbCBNYWdlY2FydCBBdHRhY2sgfCBQZXJpbWV0ZXJYIiwicmVmZXJyZXIiOiJodHRwczovL3Jlc291cmNlcy5wZXJpbWV0ZXJ4LmNvbS9uZXdzLW5hdHVyYWxmcmVzaC1tYWdlY2FydC1hbmFseXNpcz91dG1fc291cmNlPW1hcmtldG8mdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249bmV3c2xldHRlci1qdWx5LTIwMjImbWt0X3Rvaz1NREF4TFZaS1dDMHhNRFFBQUFHRnRwZkk4aW13Zk9teFhvbEJXREZxWkFvSXZzcEtEdEhiU0N3ajl3aEw5VlNEZmtqZE9UN3FKb3p5QTA1TWFOTmw3VVdmRThXME05bnMwSU1NWHdBN29ydkJLdmlWY0JzNmJsajNSeU5sS0tFIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiZjhlYjdjZmNjZDM3MzhjYyIsInNjcmlwdElkIjoiOW1EbnJkeVgwbmcxS1hNdiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuMmI3MmRhZmNlYjZiZDI3Yi4xNjU4MjU0MjczODE5IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0=
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-6.fra60.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:14 GMT
via: 1.1 8ac93eaf91328abbc6951d3fbab21e80.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA60-P2
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: XBvvtIDLt9iPaFslLSjusne4T44aJLcZr1eXp4BLToHW6eOvb6HDUw==

GET
H2 200 /
tr.lfeeder.com/ Frame 2FFF 43 B
293 B 71ms
71ms Image
image/gif 18.66.122.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTU3MjYxMDMyLTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiNzk0OTExMjg1LjE2NTgyNTQyNzMiXSwiY29udGV4dCI6eyJsaWJyYXJ5Ijp7Im5hbWUiOiJsZnRyYWNrZXIiLCJ2ZXJzaW9uIjoiMi41MC4xIn0sInBhZ2VVcmwiOiJodHRwczovL3d3dy5wZXJpbWV0ZXJ4LmNvbS90ZWNoLWJsb2cvMjAyMi9tYWxscmF0cy1hbi1hbmFseXNpcy1vZi10aGUtbmF0dXJhbC1mcmVzaC1tYWxsLW1hZ2VjYXJ0LWF0dGFjay8iLCJwYWdlVGl0bGUiOiJNYWxsUmF0czogQW4gQW5hbHlzaXMgb2YgdGhlIE5hdHVyYWwgRnJlc2ggTWFsbCBNYWdlY2FydCBBdHRhY2sgfCBQZXJpbWV0ZXJYIiwicmVmZXJyZXIiOiJodHRwczovL3Jlc291cmNlcy5wZXJpbWV0ZXJ4LmNvbS9uZXdzLW5hdHVyYWxmcmVzaC1tYWdlY2FydC1hbmFseXNpcz91dG1fc291cmNlPW1hcmtldG8mdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249bmV3c2xldHRlci1qdWx5LTIwMjImbWt0X3Rvaz1NREF4TFZaS1dDMHhNRFFBQUFHRnRwZkk4aW13Zk9teFhvbEJXREZxWkFvSXZzcEtEdEhiU0N3ajl3aEw5VlNEZmtqZE9UN3FKb3p5QTA1TWFOTmw3VVdmRThXME05bnMwSU1NWHdBN29ydkJLdmlWY0JzNmJsajNSeU5sS0tFIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiNmRjYzMxNzQwYWRlMDRhZSIsInNjcmlwdElkIjoiOW1EbnJkeVgwbmcxS1hNdiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuMmI3MmRhZmNlYjZiZDI3Yi4xNjU4MjU0MjczODE5IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0=
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-6.fra60.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:14 GMT
via: 1.1 8ac93eaf91328abbc6951d3fbab21e80.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA60-P2
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: mGnu5nwji9nlCiqETZeVwtJPbAiGA1t4XKNDIe80cPEpHEuxsRqJSw==

GET
H2 200 component---src-layouts-templates-sectioned-page-index-js-626d166ad4fea1c10327.js
www.perimeterx.com/ Frame 2FFF 0
241 KB 26ms
26ms Other
application/javascript 2a03:b0c0:3:d0::1793:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/component---src-layouts-templates-sectioned-page-index-js-626d166ad4fea1c10327.js

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::1793:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTGBNNTR04REKWDFDFX1BE
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 16
vary: Accept-Encoding
content-length: 246497
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:10:58 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "1aa7352fcdbaae9126f9582f4499bd37-ssl"
accept-ranges: bytes

GET
H3 200 /
www.facebook.com/tr/ Frame 2FFF 44 B
91 B 50ms
23ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=368880343933228&ev=PageView&dl=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&rl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&if=true&ts=1658254274277&sw=1600&sh=1200&v=2.9.65&r=stable&ec=0&o=30&fbp=fb.1.1658254273891.1881879609&it=1658254274115&coo=false&exp=u0&rqm=GET

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:14 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Tue, 19 Jul 2022 18:11:14 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.14.0/assets/ Frame 2FFF 12 KB
3 KB 39ms
38ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

868f2732413f5fcb021d726343ac249b6ca630db5fbd578f6525f279dda5c22b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: BkZngIV1hzEthgbkouRUbA==
age: 6225
vary: Accept-Encoding
content-length: 2832
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:04 GMT
server: cloudflare
etag: 0x8D8D8E825563082
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: fda93ca7-c01e-0026-14aa-2d4352000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b1e6ea990fa-FRA

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/6.14.0/assets/v2/ Frame 2FFF 47 KB
11 KB 47ms
47ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5de3651c0aa89e6497da505565c8944039fd6480aa161b1f270d1f5953c9d5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:11:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 8jNYupXcL2bcdab+1R7CAg==
age: 6225
vary: Accept-Encoding
content-length: 11511
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:07 GMT
server: cloudflare
etag: 0x8D8D8E827001198
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 466227d2-901e-007a-05aa-2db2ab000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56b1e6eae90fa-FRA

GET
H2 200 clickstream.js Show response
d10lpsik1i8c69.cloudfront.net/js/ Frame DD4B 287 KB
92 KB 25ms
25ms Script
application/javascript 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Requested by: Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92f65d433b40a4c4719b742357563d08b1c16d6396571933da9f02f9ef7424d8

Request headers

Referer
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 27 May 2022 01:51:45 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 4637970
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
etag: W/"16e967413dfa0346be281513c77581b9"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 bfd667b9fb826986b85315f856bf5884.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: 0DUqIprdq84iq27wmTilpoUoDBfUsklJiZf_iKMr1t-S34PtFENMzA==

GET
H/1.1 200
OK dnb_coretag_v5.min.js Show response
cdn-0.d41.co/tags/ Frame 2FFF 74 KB
75 KB 93ms
28ms Script
application/javascript 18.66.248.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-0.d41.co/tags/dnb_coretag_v5.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-86.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6cc0b251ec54fdd5cd55d98cbe7a7af00bd34f9cfd71fd01ca08c83121c89720

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:06:31 GMT
Via: 1.1 1f16598f51b4c33e5f56e49ea72a6154.cloudfront.net (CloudFront)
Last-Modified: Thu, 18 Nov 2021 14:57:39 GMT
Server: AmazonS3
Age: 284
ETag: "13bc1e6c74c25b3098a3b54b58b70b3c"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
X-Amz-Cf-Pop: DUS51-P1
Accept-Ranges: bytes
Content-Length: 76038
X-Amz-Cf-Id: 6-HwL9ql7sUzmf_ajxv3_v-wVByfpxW5_EtxxPle_PZ3LWT0KtFrEA==

GET
DATA 200
OK truncated
/ Frame 2FFF 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 23ms
23ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=368880343933228&ev=Microdata&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&rl=https%3A%2F%2Fmkto-sj130112.com%2F&if=false&ts=1658254274429&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack%22%2C%22meta%3Adescription%22%3A%22A%20breakdown%20of%20the%20attack%20techniques%20used%20in%20the%20campaign%20and%20its%20predecessors.%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack%22%2C%22og%3Adescription%22%3A%22A%20breakdown%20of%20the%20attack%20techniques%20used%20in%20the%20campaign%20and%20its%20predecessors.%22%2C%22og%3Asite_name%22%3A%22PerimeterX%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fcdn.pathfactory.com%2Fassets%2F10557%2Fcontents%2F419524%2Fthumbnails%2F600x%2Fblog-2557x1441-magecart-mallrats_ntdyhn.png%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.65&r=stable&ec=1&o=30&fbp=fb.1.1658254273891.1881879609&it=1658254273563&coo=false&es=automatic&tm=3&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:14 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Tue, 19 Jul 2022 18:11:14 GMT

GET
H2 200 /
tr.lfeeder.com/ Frame 2FFF 43 B
294 B 49ms
49ms Image
image/gif 18.66.122.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTU3MjYxMDMyLTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiNzk0OTExMjg1LjE2NTgyNTQyNzMiXSwiY29udGV4dCI6eyJsaWJyYXJ5Ijp7Im5hbWUiOiJsZnRyYWNrZXIiLCJ2ZXJzaW9uIjoiMi41MC4xIn0sInBhZ2VVcmwiOiJodHRwczovL3d3dy5wZXJpbWV0ZXJ4LmNvbS90ZWNoLWJsb2cvMjAyMi9tYWxscmF0cy1hbi1hbmFseXNpcy1vZi10aGUtbmF0dXJhbC1mcmVzaC1tYWxsLW1hZ2VjYXJ0LWF0dGFjay8iLCJwYWdlVGl0bGUiOiJNYWxsUmF0czogQW4gQW5hbHlzaXMgb2YgdGhlIE5hdHVyYWwgRnJlc2ggTWFsbCBNYWdlY2FydCBBdHRhY2sgfCBQZXJpbWV0ZXJYIiwicmVmZXJyZXIiOiJodHRwczovL3Jlc291cmNlcy5wZXJpbWV0ZXJ4LmNvbS9uZXdzLW5hdHVyYWxmcmVzaC1tYWdlY2FydC1hbmFseXNpcz91dG1fc291cmNlPW1hcmtldG8mdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249bmV3c2xldHRlci1qdWx5LTIwMjImbWt0X3Rvaz1NREF4TFZaS1dDMHhNRFFBQUFHRnRwZkk4aW13Zk9teFhvbEJXREZxWkFvSXZzcEtEdEhiU0N3ajl3aEw5VlNEZmtqZE9UN3FKb3p5QTA1TWFOTmw3VVdmRThXME05bnMwSU1NWHdBN29ydkJLdmlWY0JzNmJsajNSeU5sS0tFIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiYjIxOTczNTFhZWFjYjZiMyIsInNjcmlwdElkIjoiOW1EbnJkeVgwbmcxS1hNdiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuMmI3MmRhZmNlYjZiZDI3Yi4xNjU4MjU0MjczODE5IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0=
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-6.fra60.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:14 GMT
via: 1.1 8ac93eaf91328abbc6951d3fbab21e80.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA60-P2
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: j61GkLV7MXhpfSuQ1RbZ-E33K3fiztr6XTFcQnyXE6EnCkItBXxARw==

GET
H/1.1 200
OK api Show response
api9130.d41.co/ Frame 2FFF 55 B
609 B 115ms
115ms Fetch
application/json 52.207.81.145
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api9130.d41.co/api?req=api9130&form=json

Requested by

Host: cdn-0.d41.co
URL: https://cdn-0.d41.co/tags/dnb_coretag_v5.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.207.81.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-207-81-145.compute-1.amazonaws.com

Software

Resource Hash

5a66b400ed3590731f8335b4bd05758241ff8a9641da75a262e7112ffe0aff57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:11:14 GMT
Referrer-Policy: no-referrer-when-downgrade
Expect-CT: max-age=30, report-uri="https://a54b4ab95d40a8b116fae47033b75682.report-uri.com/r/d/ct/reportOnly"
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: application/json
access-control-allow-origin: https://www.perimeterx.com
Cache-control: no-store
access-control-allow-credentials: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 55
X-XSS-Protection: 1; mode=block

GET
H2 200 logo-light.png
d10lpsik1i8c69.cloudfront.net/graphics/ Frame 2FFF 1 KB
1 KB 25ms
24ms Image
image/png 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d10lpsik1i8c69.cloudfront.net/graphics/logo-light.png
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c34bc7bc1985e63394c3c2afff88cdcfc06e501320432dd23eaff83ea6754eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 03:51:35 GMT
via: 1.1 3395b043e03ecb4acfd925a6e5a26e92.cloudfront.net (CloudFront)
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 8518780
etag: "35ce74c31e3ef54462a234340af702d7"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 1143
x-amz-cf-id: CoH8xT9NaKcbUWfiHWyQPc8WhLH7wr7LYuvB7J1-NC7g9Sn5MeoDkA==

GET
H2 200 sound-on-white.png
d10lpsik1i8c69.cloudfront.net/graphics/ Frame 2FFF 277 B
620 B 25ms
25ms Image
image/png 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d10lpsik1i8c69.cloudfront.net/graphics/sound-on-white.png
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: da0c1bc51d4ebfa2570f3e7546d9d3ccfb3f9d3c1199b1ca49869510aa79392a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 14 Jun 2022 01:16:29 GMT
via: 1.1 3395b043e03ecb4acfd925a6e5a26e92.cloudfront.net (CloudFront)
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 3084885
etag: "76f1993de0fd323f67cece8d8e63bfa2"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 277
x-amz-cf-id: yjiYs0fh6zA5MWvAeBmkR6wymyJDdwL8vi7VVzlITpNp4nZxppeEJA==

GET
H2 200 logo-light.png
d10lpsik1i8c69.cloudfront.net/graphics/ 1 KB
1 KB 25ms
24ms Image
image/png 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d10lpsik1i8c69.cloudfront.net/graphics/logo-light.png
Requested by: Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c34bc7bc1985e63394c3c2afff88cdcfc06e501320432dd23eaff83ea6754eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 03:51:35 GMT
via: 1.1 3395b043e03ecb4acfd925a6e5a26e92.cloudfront.net (CloudFront)
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 8518780
etag: "35ce74c31e3ef54462a234340af702d7"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 1143
x-amz-cf-id: F4LyvG9uT2gfRQY_Vf9AGb4sXAYcHejm0Dfq6o_tXkkLSrS5hY3rig==

GET
H2 200 sound-on-white.png
d10lpsik1i8c69.cloudfront.net/graphics/ 277 B
620 B 25ms
24ms Image
image/png 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d10lpsik1i8c69.cloudfront.net/graphics/sound-on-white.png
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: da0c1bc51d4ebfa2570f3e7546d9d3ccfb3f9d3c1199b1ca49869510aa79392a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 14 Jun 2022 01:16:29 GMT
via: 1.1 3395b043e03ecb4acfd925a6e5a26e92.cloudfront.net (CloudFront)
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 3084885
etag: "76f1993de0fd323f67cece8d8e63bfa2"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 277
x-amz-cf-id: ab6lfoV7hG84gwxTuM4Ow6YRTPlEBVbWKmPFQghFu0eVy4zr5hx4rw==

GET
H2

200

/
attr.ml-api.io/ Frame 2FFF
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035

0
242 B

359ms
358ms

Image
application/json

2600:9000:2251:8200:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035
Protocol: H2
Server: 2600:9000:2251:8200:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:15 GMT
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
apigw-requestid: VhsGfhY-IAMEJRw=
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: xJL8IhSPveH7jTgpA926_c5T2AEzlBfuCPOm2cHXr4FIptFEkZyB4Q==

Redirect headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:11:14 GMT
X-Proxy-Origin: 217.114.218.19; 217.114.218.19; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: d4407901-c8de-41c0-a7bf-ccd786d0b75e
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035

0
242 B

397ms
397ms

Image
application/json

2600:9000:2251:8200:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035
Protocol: H2
Server: 2600:9000:2251:8200:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:11:15 GMT
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
apigw-requestid: VhsGgiugIAMEJ8w=
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: 451P2Fg31gNVBBRTbzqlHbiptpUBf9uuBXlGYkZ_XGT166Ym11_67g==

Redirect headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:11:14 GMT
X-Proxy-Origin: 217.114.218.19; 217.114.218.19; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 36eaab9b-711f-4f14-911c-99afc503cd9d
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=perimeterx.com&pId=2652707136587310035
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 22ms
21ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1808954927&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fnews-naturalfresh-magecart-analysis&el=25&_u=aDDAAEABQAAAAC~&jid=&gjid=&cid=794911285.1658254273&tid=UA-57261032-1&_gid=1810744845.1658254273&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&cd10=null&cd11=null&cd12=null&z=640477710

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 13:15:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 17743
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 22ms
21ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1808954927&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fnews-naturalfresh-magecart-analysis&el=50&_u=aDDAAEABQAAAAC~&jid=&gjid=&cid=794911285.1658254273&tid=UA-57261032-1&_gid=1810744845.1658254273&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&cd10=null&cd11=null&cd12=null&z=422303487

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 13:15:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 17743
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 23ms
22ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1808954927&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fnews-naturalfresh-magecart-analysis&el=75&_u=aDDAAEABQAAAAC~&jid=&gjid=&cid=794911285.1658254273&tid=UA-57261032-1&_gid=1810744845.1658254273&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&cd10=null&cd11=null&cd12=null&z=1870572362

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 13:15:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 17743
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 23ms
23ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1808954927&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fnews-naturalfresh-magecart-analysis&el=100&_u=aDDAAEABQAAAAC~&jid=&gjid=&cid=794911285.1658254273&tid=UA-57261032-1&_gid=1810744845.1658254273&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&cd10=null&cd11=null&cd12=null&z=874276799

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 13:15:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 17743
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 453 B
471 B 53ms
52ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: aab49b32d16614cf036f5f994a855d70168bcfe22106e11c7b38863420f66ecb

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:11:13 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 453

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 01EC 0
15 B 24ms
23ms Document
text/plain 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.perimeterx.com
Referer: https://www.perimeterx.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.perimeterx.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Tue, 19 Jul 2022 18:11:14 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 reset.css
d10lpsik1i8c69.cloudfront.net/css/ Frame 2FFF 2 KB
1 KB 25ms
24ms Stylesheet
text/css 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/css/reset.css
Requested by: Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 401f533697cfb484598d2da76b5f4708bbca985a1fab42dbcfaa0741374d3245

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 15:23:17 GMT
content-encoding: gzip
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 7613278
etag: W/"7144eaceff0b31347712515a6116074e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 3395b043e03ecb4acfd925a6e5a26e92.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: 7aC3RR6hQ0ZDQQazPac0RkViIXxzx69eab_M7g5sf41JdShyMLGo-Q==

GET
BLOB 200
OK c8307cc5-fb40-4e6c-8abc-7f2b73cbd566
https://www.perimeterx.com/ Frame DD4B 0
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.perimeterx.com/c8307cc5-fb40-4e6c-8abc-7f2b73cbd566
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Length: 0

GET
BLOB 200
OK 277f6545-9f76-403d-b7ae-2c07c37d8048
https://www.perimeterx.com/ Frame DD4B 30 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.perimeterx.com/277f6545-9f76-403d-b7ae-2c07c37d8048
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb5a1fff57218742c5c1e469970504556a10d235b2379872b4ffcef9901d3bc0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Length: 31224

GET
H2 200 reset.css
d10lpsik1i8c69.cloudfront.net/css/ 2 KB
1 KB 26ms
26ms Stylesheet
text/css 13.226.156.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/css/reset.css
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.156.190 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-156-190.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 401f533697cfb484598d2da76b5f4708bbca985a1fab42dbcfaa0741374d3245

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 15:23:17 GMT
content-encoding: gzip
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 7613279
etag: W/"7144eaceff0b31347712515a6116074e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 3395b043e03ecb4acfd925a6e5a26e92.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: 6CD7Na_WDNKt5xMV87jzsmtzya18OKQ5M6wYJ8SyKdjx4UGHDmFR8g==

GET
BLOB 200
OK d2e37774-3ef2-481e-b982-14046113a78b
https://resources.perimeterx.com/ Frame 7947 0
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://resources.perimeterx.com/d2e37774-3ef2-481e-b982-14046113a78b
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Length: 0

GET
BLOB 200
OK 3c6ac041-8407-4989-a655-127866e00047
https://resources.perimeterx.com/ Frame 7947 30 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://resources.perimeterx.com/3c6ac041-8407-4989-a655-127866e00047
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb5a1fff57218742c5c1e469970504556a10d235b2379872b4ffcef9901d3bc0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Length: 31224

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 441 B
459 B 82ms
82ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4321991824d763431b4c048a2b9bf1a5a01a869476bb40b3bd173cb928c7104e

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:11:15 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

POST
H3 200 p Show response
b.px-cdn.net/api/v1/PX2003/d/ 3 B
19 B 65ms
38ms XHR
application/json 34.149.125.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://b.px-cdn.net/api/v1/PX2003/d/p
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.149.125.36 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 36.125.149.34.bc.googleusercontent.com
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: multipart/form-data; boundary=----------------nsyuf4igfinu3ma4

Response headers

date: Tue, 19 Jul 2022 18:11:15 GMT
via: 1.1 google
access-control-allow-headers: authorization
access-control-allow-methods: HEAD,GET,POST,OPTIONS
content-type: application/json
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 441 B
459 B 82ms
82ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: beb80e69b65b1b8e4298023c693b056136445be17f20b6ad5eac81f9c5a284a6

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:11:15 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 441 B
459 B 58ms
57ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: f78f2b700d4105fbf16e5febb1c1d0d66a434b37d0fde3028c6ae647125e8c34

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:11:16 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 441 B
459 B 43ms
43ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 13dbd2376aeea14e9dd360132544d1aa77681285b6e2ccc8b797f7cfafb8732a

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:11:17 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 75ms
28ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-S5CWZF51H2&gtm=2oe7i0&_p=1808954927&_z=ccd.v9B&cid=794911285.1658254273&ul=en-us&sr=1600x1200&_s=2&sid=1658254272&sct=1&seg=0&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&dr=https%3A%2F%2Fmkto-sj130112.com%2F&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&en=scroll&epn.percent_scrolled=90&_et=96
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:11:18 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://resources.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ Frame 2FFF 0
17 B 29ms
28ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-S5CWZF51H2&gtm=2oe7i0&_p=875759618&_z=ccd.v9B&cid=794911285.1658254273&ul=en-us&sr=1600x1200&_s=1&sid=1658254272&sct=1&seg=1&dl=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&dr=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpfI8imwfOmxXolBWDFqZAoIvspKDtHbSCwj9whL9VSDfkjdOT7qJozyA05MaNNl7UWfE8W0M9ns0IMMXwA7orvBKviVcBs6blj3RyNlKKE&dt=MallRats%3A%20An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack%20%7C%20PerimeterX&en=page_view
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5CWZF51H2&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:11:19 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

106 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

54 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mkto-sj130112.com/	1970-01-20 04:37:36	Name: __cf_bm Value: QeCcTLVBWKPjX8.QgOvIPs7jsocHtQB9wBByA9PZ8_I-1658254271-0-AWNjeWcF609M84UVVINa4LxZ/207lZ8pZASd4UcfW4GetqFSN8dJT008mIYnsBXs8aszr/nrK8uvTnaURueUZjg=
.perimeterx.com/	1970-01-20 22:08:46	Name: vid Value: c8a33a31-efab-4936-916c-a755f9195023
resources.perimeterx.com/	1970-01-20 22:10:12	Name: _session_id Value: ck9HRzgxSkY2cWxCMVNjd1NNM0tlZm9nRzJxWnJHWEM5ajIvelc0c0tqVE1yUjAzL0kya0RULzhuY0IrakRHb1kzRy8zV1FLUUw0cTlyTDNxWEFBMFkvK01wYzNTM3BKd0Z5N29xZ3c5dUFNcCs1Ulh3N084TGxHL1lMRDkzMVJFTVdjRmRGRURjM2JnN3h1N2VQVDUrNFczTWF4cTdwOVV0NjY3WXY2MFA1V1FFRzNUYm5pWjVIM2JXQUh4UnJldWxBQ1hvTHh6UU9GMFB1SnJHOVpCVE5NY0lZM2FkZUc5a3BvZlczVXk3YnRMQ1FOYy9qeXJIQ2FjdEFMU1lSakFPaDV4bE9TOUdIZXZ6c0Y3cWtNZGlIb2hnakVKeHhtclpMVmFkd0d4Qkk9LS1SOCtMU2NrVGlmamhWTGFtZlBuZGhBPT0%3D--7ff7c014f54730ceceec39bafdd8d5ea56fea445
.perimeterx.com/	1970-01-20 22:08:46	Name: _mkto_trk Value: id:001-VJX-104&token:_mch-perimeterx.com-1658254272462-57194
.perimeterx.com/	1970-01-20 13:23:10	Name: _px_uAB Value: MTMzN3x0cnVl
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: Td2luMpf25Q
.youtube.com/	1970-01-20 08:56:46	Name: VISITOR_INFO1_LIVE Value: trkPPkN-1oU
tracking.g2crowd.com/	1970-01-20 04:57:43	Name: _session_id Value: 232c046c785b7b192b6ff6544d849e1c
.g2crowd.com/	1970-01-20 04:37:36	Name: __cf_bm Value: Ra9YEEdCU5a66LqdTF2mz3.Vhx_aZ4vfXmntq71EIFU-1658254272-0-AaNLFrdQw8KWDbvmM3sIFMS5G26uyqoNboTLOhVad/JVEtf0sB3j/SAYvbUoF/0p1vhRlW79ZLw7YruXTwnFWMo=
resources.perimeterx.com/	1969-12-31 23:59:59	Name: pxcts Value: 2c421caf-078e-11ed-8ed4-544d5a507375
resources.perimeterx.com/	1970-01-20 13:23:10	Name: _pxvid Value: 2c4210f2-078e-11ed-8ed4-544d5a507375
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_bdd Value: 1000
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_idp_c Value: 1,s
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_idp_p Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_cl Value: 888
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_scs Value: 1,WOWMAN
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_wow Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_ww Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_wp Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_sp Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_cd Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_rf Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_se Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_gqlr Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_rid Value: 9715777812338345693
.bidr.io/	1970-01-20 14:06:07	Name: bito Value: AACinU7FregAAEf9vYZ5VA
.bidr.io/	1970-01-20 14:06:07	Name: bitoIsSecure Value: ok
.perimeterx.com/	1970-01-20 13:24:36	Name: __pxvid Value: 2c68494d-078e-11ed-a5d8-0242ac120003
.app-sj13.marketo.com/	1970-01-20 04:37:36	Name: __cf_bm Value: 5hmLNGTaC3tUbg0.kp2Dymla8kFWOGRfeUL9QXfuGpA-1658254273-0-AXVTAtPn7OfSspRR+uWCv40DNcTHEYGbM4m03Gt+Un/Zry8XsW5krxBqjjfMihCFLEQvFVc5SJzEqQeDZSzQxcY=
.adnxs.com/	1970-01-20 06:47:10	Name: uuid2 Value: 2652707136587310035
.perimeterx.com/	1970-01-20 04:39:00	Name: _gid Value: GA1.2.1810744845.1658254273
.perimeterx.com/	1970-01-20 04:37:34	Name: _gat_UA-57261032-1 Value: 1
.linkedin.com/	1970-01-20 05:20:46	Name: UserMatchHistory Value: AQIs5VjBgBAI2wAAAYIXqCqjYPDSwQxHaNZElzsIjwqM6JjtuYbGGX7-E_PxRGFvzKf2XXCNjMUqHw
.linkedin.com/	1970-01-20 05:20:46	Name: AnalyticsSyncHistory Value: AQINRGqhMHDW5AAAAYIXqCqjgwUCXHzhrA9vtZTG5DR0booZgUKh-rZOWoE-ZfYa9VwoXaisUq6FOTOa64SJiA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 22:09:28	Name: bcookie Value: "v=2&518d4e8d-bb2f-4b5b-8829-5f9692657739"
.linkedin.com/	1970-01-20 04:39:00	Name: lidc Value: "b=VGST03:s=V:r=V:a=V:p=V:g=2635:u=1:x=1:i=1658254273:t=1658340673:v=2:sig=AQGW_yw2GBGu0sQK2_SxAYyLBaiS7gdk"
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 22:09:28	Name: bscookie Value: "v=1&202207191811130c0037eb-de65-4568-83a7-38a6c914773fAQHoV6ixiceBb-Cd9RVq5ZrR5c9kfKWu"
.linkedin.com/	1970-01-20 22:05:26	Name: li_gc Value: MTswOzE2NTgyNTQyNzM7MjswMjEQexsbvzQkTPJiohNQZGPLzpOVsTqePx772U2LemzuFQ==
.perimeterx.com/	1970-01-20 22:08:46	Name: _lfa Value: LF1.1.2b72dafceb6bd27b.1658254273819
.perimeterx.com/	1970-01-20 06:47:10	Name: _fbp Value: fb.1.1658254273891.1881879609
jukebox.pathfactory.com/	1970-01-20 22:10:12	Name: _session_id Value: a3NDZklJTlFqZHJ0WmI4dkUxQWN3WkZCWmZOWU5TU0JuM3c3R0FhejlLL1gvcE9OVXZFRTZ4d3N2SnY2ZS9UUWg3Z0ZvVHJZTzJDMmNGb1lTa1l6THVwL0s2ME93azFYd3QxK2RJdncrVFJjL0VOMWJjUFo1czRYRjNNRkU4eEZ2QlRkWHdKNTJPczNlWStMN2plaTJmM0xGRzFtRVM2VUV2QjNlQVp3NVBmRC9mMzhEWEtQbno5Vzl2T1B5N3RkLS1ucThtQ1FOTVBJNTJjV0hkalJ6RDlBPT0%3D--49000b65fdcf4e468f05eb8c0af79ba1183249ad
.perimeterx.com/	1970-01-20 22:08:46	Name: _ga_S5CWZF51H2 Value: GS1.1.1658254272.1.1.1658254274.0
.ws.zoominfo.com/	1970-01-20 13:23:10	Name: visitorId Value: 159324bb96977e52a32b703ed1c382e530a8efa2614002f6fec393a24a59b75a
.perimeterx.com/	1970-01-20 22:08:46	Name: _ga Value: GA1.2.794911285.1658254273
.perimeterx.com/	1970-01-20 08:56:46	Name: __lotr Value: https%3A%2F%2Fmkto-sj130112.com%2F
.perimeterx.com/	1970-01-20 13:23:10	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Tue+Jul+19+2022+18%3A11%3A14+GMT%2B0000+(GMT)&version=6.14.0&hosts=&consentId=7fb81fdc-86f5-43b1-b963-2612788c24f5&interactionCount=0&landingPath=NotLandingPage&groups=C0004%3A1%2CC0003%3A1%2CBG16%3A1%2CC0001%3A1%2CC0002%3A1&AwaitingReconsent=false
.perimeterx.com/	1970-01-20 22:08:46	Name: _lo_uid Value: 84276-1658254274217-b6ff1c4013193378
.perimeterx.com/	1970-01-20 04:37:34	Name: _lorid Value: 84276-1658254274217-11f947685252a8a1
.perimeterx.com/	1970-01-20 13:23:10	Name: _lo_v Value: 1
.perimeterx.com/	1970-01-20 08:56:46	Name: __lotl Value: https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F
.perimeterx.com/	1970-01-20 22:08:46	Name: _px_f394gi7Fvmc43dfg_user_id Value: MmQ1MWNmMDAtMDc4ZS0xMWVkLTlhNWMtMWQ4NDVmM2EwODhi
resources.perimeterx.com/	1970-01-20 04:40:27	Name: _px Value: XbSt4NARfPRn9Po78o6YapGfX1p5BZF3qL2xSWjVl1ZKce/uVySutSXiZg+rwdwEJLGizjj0lO5kk1kR4Z4J7A==:1000:8AIJRdEZCkQIh7aZhZeWReF47V38I85j2LdOcDViICT+9qQZmBQPvxmKjGhMo36viCPS0vhNrq0+P8SQ+5qW8Sm50V4Q6Gc8D3mFRzwOh+GBiPfOrDlM2iR8cZhVNwpr9UBe0l6aIVlKsmeEVWk9zp+nPVsK3IujJTvCr0vhAQ0jWt6ye0gRDbljhRIHXDO1fe7o7tVWOltlaDzbEamuSBt43d45SITFfxDwVY6EbPIMfK6Zs4wUGhAkQviV1Bag5SKsathnaOBLbc+4SUxwdQ==

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE= Message: The Content-Security-Policy directive name 'form-action:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
security	error	URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpfI8vHYMneWezjFO7Oym6kNS4W4sc8xiiyKrPNbQE3sOjIvuF6weDNld_1b-xO2UOF62KE= Message: The Content-Security-Policy directive name 'frame-src:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/c9c6fe98-9161238368d370bda929.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/6d317829-d3d402e5b3de0a374184.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/1bfc9850-e346f70a0d188b802bed.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/app-ee317304c744ef04cb69.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/styles-83801f3b4dd3459a4027.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/5d29be3a39afb3d02c470836880ef3668828850c-96f6cdc519f233150bf2.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/9815f04a81c9d7b5d54b3cfd1cb9f97e68eecb8a-4c69d8ab0a860387cfd2.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/5e2a4920-20a4bced7ddf9a73ac28.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/webpack-runtime-514465b51ac6845ee75f.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/framework-3bb7604d37b8059061f5.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/95b64a6e-61f21e012229bde8e9f0.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/component---src-layouts-templates-blog-blog-post-js-4cb3b9f77e1259b40c6d.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-zFovN/57TMLDlVnSpXiaPSUxV+9rsaxKWyH8swk9nL0=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

001-vjx-104.mktoresp.com
api9130.d41.co
app-sj13.marketo.com
app.cdn.lookbookhq.com
assets.perimeterx.com
attr.ml-api.io
b.px-cdn.net
cdn-0.d41.co
cdn-app.pathfactory.com
cdn.cookielaw.org
cdn.pathfactory.com
client.px-cloud.net
cnv.event.prod.bidr.io
connect.facebook.net
d.adroll.com
d10lpsik1i8c69.cloudfront.net
d33wubrfki0l68.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
jukebox.pathfactory.com
lftracker.leadfeeder.com
maxcdn.bootstrapcdn.com
mkto-sj130112.com
munchkin.marketo.net
overpass-30e2.kxcdn.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
resources.perimeterx.com
s.adroll.com
s.ml-attr.com
sapi2003.botchk.net
secure.adnxs.com
settings.luckyorange.net
snap.licdn.com
stats.g.doubleclick.net
tr.lfeeder.com
tracking.g2crowd.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.perimeterx.com
www.youtube.com
104.111.234.67
104.16.93.80
104.17.72.206
13.107.43.14
13.226.156.190
13.32.99.30
13.32.99.82
172.67.75.100
18.66.122.6
18.66.248.86
18.66.92.112
192.28.147.68
2001:4860:4802:34::36
2600:9000:2251:8200:12:3734:2a40:93a1
2600:9000:2260:4a00:6:9280:1080:93a1
2606:4700:4400::6812:2437
2606:4700::6810:9440
2606:4700::6810:a852
2606:4700::6812:acf
2620:1ec:21::14
2a00:1450:4001:800::200e
2a00:1450:4001:806::2003
2a00:1450:4001:809::200e
2a00:1450:4001:828::200a
2a00:1450:4001:82a::2008
2a00:1450:4001:82b::2003
2a00:1450:4001:830::2004
2a00:1450:400c:c0a::9a
2a02:26f0:3500:11::215:14d0
2a02:26f0:3500:16::215:149b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
2a03:b0c0:3:d0::1793:d001
2a04:4e42:600::604
2a0b:4d07:102::1
34.149.125.36
35.186.220.184
37.252.172.37
52.207.81.145
52.222.214.93
54.220.8.206
54.72.196.78
54.82.195.36
54.85.164.109
68.67.153.60
0088c55fcbe4ccb2df59204288cece3aedac3efce32493bea627d68466148e2b
04fac4a0b1ae3f61cbddf6c63d60ad3b419dba7cfd817352c7dc1d2a00e8e48e
0603195f65053eabba0100568898b6d2f29a23dbe3c742391588f9cc5853028a
0a7bae5a80d53dc5f231dfd255952b55c56a603c437e1948ea1f8bdb530bd4a4
0cb9b072cf2c8c5cabf1fc0ac2b02873e32a1ce13427655ce817cc294eea8fc9
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
139fc90823b96a757bba2c141df7fa3811af648b70cd294723a3dbb47cb13b1c
13dbd2376aeea14e9dd360132544d1aa77681285b6e2ccc8b797f7cfafb8732a
13e42cbf2390f23006b16f68d40daddb3a1e727e5dafaede2d60c2c8ddec51de
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
163c0afdbe5d2a296ee5a962b593854122fb42fb996c9cbbd388c5194aab0efe
17dc16f203a20131a9dfccce83ed74af83cb9da328011181ca745b7f3a883d08
20f73bc7302a48f92cc74f62598a5ad67a447f9e6c591fd653f1c89af4a5213c
21f0d38e2c999c64e16659f6b27d44963bb454d9aa0f5595e2dd30576c7c6606
28948159b803f5ff7f733581720bbae185968ee1f4f86dd3f2468902103d37fc
28e696f1e4297a65c928a3c82a163d9eacba8bea8725beea0b8aa2470dc88248
2ce04db8da4adcd3c61f4538252f865491c78e321bbb499909daa536ea95da24
2ef6b24ec78bb3ac4bdfa91d2abf4d9f2d4b543ad54c411d50e4307fc8677110
3536a18dd1ff568df8432d6dc496721bbf34707337fc8502e42b6f37dc1128df
390aca4ba708128182c4802df7c4a1d3a85566b96bf2542caa3b4ea1f1507c1a
3aad26234b8109cc4b18062eb16da66946040119cbfd006637836390ec64f87f
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
401f533697cfb484598d2da76b5f4708bbca985a1fab42dbcfaa0741374d3245
42238934ecd53313e8dba8fc5ca2222496d084633c81171a5c70de5d849112af
4321991824d763431b4c048a2b9bf1a5a01a869476bb40b3bd173cb928c7104e
4446e54d7bd0f4dbad541c2fcf0778d5fad8278020999a1a9c1f47838310c67b
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4da5da2f204eed8829fd9e0ee84e21479ee5db9fb5e6656d05bbdff54b2ce68e
50d3acdc6b34002e97f3763ee2072590dc43cf8f54064437085211783a5aff99
5156dff19f3da0b22f54fae9883fdc4a140ab79ec89aac752751e9fc643159bc
5325b3a490261a2328311929382f65726b725a767a39332a1b228367528bb7c8
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a66b400ed3590731f8335b4bd05758241ff8a9641da75a262e7112ffe0aff57
5feeba24e0d742f2325b55fbb0bceebbec90fb3f3b7c3a48f26120b4dc2bcb12
61eef10fb6867c58353af2e0686c6eeb1456520f33a4fcc7dcf18755c848a15b
65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e
6c161eaf631baf5bbdb7c35308da9ddac4d378263f6dd4423f3e3a2c86528fda
6c47fb7fabe2a4049645853b9bd231ea9c60fbc30f72fe3e532414a712ca8b54
6cc0b251ec54fdd5cd55d98cbe7a7af00bd34f9cfd71fd01ca08c83121c89720
6cf92da0046d45140cd9694ebc53282fe8f60e9626d76f38cb4bd2038ea672be
6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d
702396a93de43dacac67982c59314f5ae772e59e52a973027a31097e2143993b
71a41da894b51c66bad0e307a8ee51aa86ebf458433676b9c9ea8eb32f695d02
71cb5ad3dbda534886cdfb1980a588e3914a71a87e7e517df63c1abac8227772
74f060fcb905d2e08f7adfba7ced8546345547ef52be4edd16b2010a1e7aada3
76610a5fb9f64f4575e8e70dfdee68be6672f3d7f326530526f7889ab3175141
7724bf5c171c673ab3f574e6e6c3921668326904a0aa564d519c0e33e4d5b2f5
7777858e85646ef5fb3a61d3862af526216ae6f199db4bf1c6ad6b2fcde3bf47
7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
7ed25b46fbeee4d58ba491483c894338542894bfb0ef81839514edf7a2657e58
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
868f2732413f5fcb021d726343ac249b6ca630db5fbd578f6525f279dda5c22b
8c34bc7bc1985e63394c3c2afff88cdcfc06e501320432dd23eaff83ea6754eb
911e4703fc8a4e7e2e0f71c24c39599e85bcf6b7448d3ae3e5a7e5b3ce29b17b
91892af76d8bc88bb779fb1b99ae8d9a9a84d0ffa2b27c2ebf8c35b4ab3a0c83
92f65d433b40a4c4719b742357563d08b1c16d6396571933da9f02f9ef7424d8
93f2e0ec5bdac100d5c45192320aeae54aefd4e34064773d281ccad99ca2777a
9643ad4251cb0b5eac75b7141f9f2109fb2997b3ccfcbbab7ad11c8619adc0b8
98d30c45ea79d9eae8bdcdce751eb747cefcc4a331df431ba7702ccd6cf44c9f
9db9265f8119cc29e3011eb69fb5d9bfb6b2b715890351480ac0904059af7f02
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a48260f238dfb9e6f4530e94e235fc5e97450d0933789322c532a64ee2701ace
a5de3651c0aa89e6497da505565c8944039fd6480aa161b1f270d1f5953c9d5f
a61d5737f270e877b7ee2e1ded35a5d6c07cb8e16e316c6a97a1d1dd9d76c1fd
a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0
a81767aaedfe6143328709d395308f125a628198f895c78d42780a274295e3a0
aab49b32d16614cf036f5f994a855d70168bcfe22106e11c7b38863420f66ecb
abd979a2558bc92d17ef9c6c94d3d93e064cc2f029b85ddb8281eb3372f7253e
b02b20ba6ecbfd77a7b5951a906f6b9e230a607e2bd7002ae7ea79fcd7fdc1a3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b25e835722ffbec8ab733d999dc194aa9ef7fcf00edc594e453f2823e0c65fb9
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
bd1191c6d6c683d4982b98fcba8f3d01066c7fad2e4f604add5231a8e2066e9a
beb80e69b65b1b8e4298023c693b056136445be17f20b6ad5eac81f9c5a284a6
c0da1fc9c1b23d76d5b0f9d3154f4141b30a6926b68523c37ec483dd0200945a
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c4191bdf74ac201d8071060b64d19ec9d284ee7512d5a08ecef16d99b787b9d2
ca2bc9c7cf7bc7dcaf47481abea6b29fcaeebc55b92b8df622f7feb4242c3ae7
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d9df926b2a2ec4e88bbff3a55119b4fc5f2a9fd2d0fee71a12d8e67e03779b95
da0c1bc51d4ebfa2570f3e7546d9d3ccfb3f9d3c1199b1ca49869510aa79392a
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dbc2a7f895d05be1b17ed8eb1eb609589ff3b3f9b3e2ee97f9a9e530f9026b75
dc96c98b2419e72c35072ccb7d9b33b0aef45c2116eafc9c362b134db8c9b293
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd11c7626d5576d5cb2c3271bd2a20526c246da6c08c62248c8a944104edd9e7
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dfa7bb01d830f1d1ceb4c4d857e2c6f9de8f72c520f6ee031797d76af89989d8
dff1c95df1871fb00f4072de4333c7e4643c659dd8e8adbc746729eca62a98fc
e0ccd9072d23576c5e88acb4159d67dc4ce03d298e32b2fc51b91bc71ba5d56d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5ad1b24f290210e067ee5aeace152e7a510e2e457554bcada5e767292132747
e7c129ee5de51a2692632d98e0e18cbc092fb758635921e4ecc404293495fafa
eb5587a924cd997ae5ab4896d812257c47dae81e2b9b7a0a049b78cf32793968
eb8f35e2eb63ca25c5339c27b29feddac2eb36cb9709cf83dab3030a71d5d836
ec3783a450dbbff3e5c15673dc8ff4348cb71b818c43c18cb8e19bbe236c45fc
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f051f186c88f8c27c42012b723552f3dda9ac61b295a0c2be0a58d15edd3bf68
f3a589d619416bd674e0fdbcc22738e611b488dde2167be30ec00886ec475ae0
f3d15fff8a4ea22a2137649a7935dc89776c66389936e50e4ba97895099459d6
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f78f2b700d4105fbf16e5febb1c1d0d66a434b37d0fde3028c6ae647125e8c34
f92d6e79a7b51948eb161c71fefce09aa57c0bf009c8d326575950540304d49c
fb5a1fff57218742c5c1e469970504556a10d235b2379872b4ffcef9901d3bc0
fdd4315639b20e32f08bc16b37cddf4514c250e34601d29979eb4a2c471304ff
fe3cdb6342633b630a1636d3a83f1beb1aa5a9404078a93618f3235f4d609f6c
ff5dc6f952726bb9ae5490f01442459968d6add9c1201b497d840c6e9f1528ec

resources.perimeterx.com Open in urlscan Pro 54.85.164.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

184 Requests

92 %HTTPS

51 %IPv6

37 Domains

47 Subdomains

43 IPs

6 Countries

3641 kBTransfer

10895 kBSize

54 Cookies

2 Outgoing links

Page URL History

Redirected requests

184 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

resources.perimeterx.com Open in urlscan Pro
54.85.164.109 Public Scan

Screenshot
Live screenshot

Full Image

184
Requests

92 %
HTTPS

51 %
IPv6

37
Domains

47
Subdomains

43
IPs

6
Countries

3641 kB
Transfer

10895 kB
Size

54
Cookies

184 HTTP transactions
2 data transactions