ntdex.cn Open in urlscan Pro
118.178.180.202 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Submission Tags: phishing
Submission: On June 21 via api (June 21st 2022, 10:50:35 am UTC) from US — Scanned from DE

Summary HTTP 45 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 4 countries across 12 domains to perform 45 HTTP transactions. The main IP is 118.178.180.202, located in Hangzhou, China and belongs to ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN. The main domain is ntdex.cn.

This is the only time ntdex.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
18	118.178.180.202 118.178.180.202	37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.)
6	79.125.65.240 79.125.65.240	16509 (AMAZON-02) (AMAZON-02)
2	2a02:26f0:350... 2a02:26f0:3500:591::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	34.248.142.13 34.248.142.13	16509 (AMAZON-02) (AMAZON-02)
1 1	63.35.85.99 63.35.85.99	16509 (AMAZON-02) (AMAZON-02)
2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2 2	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:b4f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
2 2	2606:4700:440... 2606:4700:4400::6812:230b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	212.82.100.182 212.82.100.182	34010 (YAHOO-IRD) (YAHOO-IRD)
8 16	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
1 1	54.145.48.80 54.145.48.80	14618 (AMAZON-AES) (AMAZON-AES)
45	9

18 118.178.180.202 (Hangzhou, China)

ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)

ntdex.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 79.125.65.240 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-79-125-65-240.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:591::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.142.13 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-142-13.eu-west-1.compute.amazonaws.com

suntrustbanksinc.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.35.85.99 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-85-99.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.194 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:b4f (United States)

ASN13335 (CLOUDFLARENET, US)

idpix.media6degrees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::6812:230b (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.182 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)
PTR: spcms.pbp.vip.ir2.yahoo.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 151.101.66.49 (United States) 8 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.145.48.80 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-145-48-80.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	ntdex.cn ntdex.cn	895 KB
17	everesttech.net 9 redirects cm.everesttech.net — Cisco Umbrella Rank: 1015 sync-tm.everesttech.net — Cisco Umbrella Rank: 687	4 KB
7	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 212 suntrustbanksinc.demdex.net — Cisco Umbrella Rank: 63999	10 KB
2	tribalfusion.com 2 redirects a.tribalfusion.com — Cisco Umbrella Rank: 844 s.tribalfusion.com — Cisco Umbrella Rank: 2502	1010 B
2	doubleclick.net 2 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 217	711 B
2	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 344	140 B
2	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 432	21 KB
1	stackadapt.com 1 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 944	564 B
1	yahoo.com 1 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 963	677 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 554	356 B
1	media6degrees.com idpix.media6degrees.com — Cisco Umbrella Rank: 2460	278 B
0	goodrxstore.su Failed goodrxstore.su Failed
45	12

	Domain	Requested by
18	ntdex.cn	ntdex.cn
16	sync-tm.everesttech.net	8 redirects
6	dpm.demdex.net	ntdex.cn
2	cm.g.doubleclick.net	2 redirects
2	idsync.rlcdn.com
2	assets.adobedtm.com	ntdex.cn
1	sync.srv.stackadapt.com	1 redirects
1	cms.analytics.yahoo.com	1 redirects
1	s.tribalfusion.com	1 redirects
1	a.tribalfusion.com	1 redirects
1	analytics.twitter.com
1	idpix.media6degrees.com
1	cm.everesttech.net	1 redirects
1	suntrustbanksinc.demdex.net	ntdex.cn
0	goodrxstore.su Failed	ntdex.cn
45	15

This site contains no links.

Subject Issuer	Validity	Valid
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-10` - `2022-09-10`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
dstillery.com Sectigo RSA Domain Validation Secure Server CA	`2022-05-05` - `2023-04-28`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Frame ID: 0CB16107B7AB0BEB2FA049DA4BD92D3F
Requests: 28 HTTP requests in this frame

Frame: https://suntrustbanksinc.demdex.net/dest5.html?d_nsid=0
Frame ID: 951469DA4F25975B55D4A32EDF944281
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Authentication

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Page Statistics

45
Requests

18 %
HTTPS

23 %
IPv6

12
Domains

15
Subdomains

9
IPs

4
Countries

928 kB
Transfer

4588 kB
Size

15
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ruxitagentjs_A27SVfgqrux_10223210811140219.html HTTP 302
http://goodrxstore.su/

Request Chain 21

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/assets/tru-core-icon-sprite.svg HTTP 0
http://goodrxstore.su/

Request Chain 22

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/father-son.09ab23b1a8413f101f8b.png HTTP 302
http://goodrxstore.su/

Request Chain 23

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/Graphik-Regular-Web.f8ec249a45d5a0313b93.woff HTTP 302
http://goodrxstore.su/

Request Chain 24

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/Graphik-Semibold-Web.a4397627b9ae644f8e3b.woff HTTP 302
http://goodrxstore.su/

Request Chain 27

https://cm.everesttech.net/cm/dd?d_uuid=54780825479934944843944591110508163846 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YrGidgAAAEN-UQMx

Request Chain 30

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NTQ3ODA4MjU0Nzk5MzQ5NDQ4NDM5NDQ1OTExMTA1MDgxNjM4NDY= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NTQ3ODA4MjU0Nzk5MzQ5NDQ4NDM5NDQ1OTExMTA1MDgxNjM4NDY=&google_tc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEMaKPCDBVsS7E6cPnIy-LYM&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 33

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXJHaWVBQUFCTU14bW1vSg&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBR1d4ZndOZQ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBTVM1SkFPSg HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBR0dZZWdObg HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBRGNxbkFPVg HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBR2V5TFFOZQ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBTUI0cUFOLQ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBSEpaM2dPWQ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBS1hVd1FONg HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBR0JKY0FOLQ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1

Request Chain 34

https://a.tribalfusion.com/i.match?p=b13&u=54780825479934944843944591110508163846&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP 302
https://s.tribalfusion.com/z/i.match?p=b13&u=54780825479934944843944591110508163846&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP 302
https://dpm.demdex.net/ibs:dpid=22054

Request Chain 35

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=54780825479934944843944591110508163846&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-sOuNTapE2pFbEW0DuqGtaVsraFAewC..QhA-~A

Request Chain 36

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&_test=YrGieAAKcz03egAj

Request Chain 37

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90&_test=YrGieAAKjAamigAo

Request Chain 38

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKjsupdQAo

Request Chain 39

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKc58_fAAj

Request Chain 40

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKjSCvDAAo

Request Chain 41

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D&_test=YrGieAAKdDpEQAAj

Request Chain 42

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1&_test=YrGieAAKjpe0vAAo

Request Chain 43

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0&_test=YrGieQAKcYdKCAAj

Request Chain 44

https://sync.srv.stackadapt.com/sync?nid=adobe HTTP 302
https://dpm.demdex.net/ibs:dpid=390122&dpuuid=SFRsxXR-RBxEiRrq3KEWXFQTr7g

45 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/ 537 KB
52 KB 1243ms
318ms Document
text/html 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: cdbc1b59af291b9ca753337015f2f178ea79ba9c9fec09e124fc5921ef8e799a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 53254
Content-Type: text/html; charset=UTF-8
Date: Tue, 21 Jun 2022 10:50:19 GMT
Keep-Alive: timeout=15, max=300
Server: Apache
Vary: User-Agent,Accept-Encoding

GET

/
goodrxstore.su/
Redirect Chain

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ruxitagentjs_A27SVfgqrux_10223210811140219.html
http://goodrxstore.su/

0
0

GET
H/1.1 200
OK dbc-min.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 1009 B
833 B 527ms
265ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/dbc-min.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 3a646c145be3980978aaa0740511189e7d4aaac97f7731321fddb3a3e52f1a35

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:20 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e45-3f1-5dfb6ae8395f3"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=300
Content-Length: 485

GET
H/1.1 200
OK styles.css
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 72 KB
9 KB 514ms
260ms Stylesheet
text/css 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/styles.css
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 05d5dc2ba2ff1a17b1d055b1f1f41053d1a8692fa34636266f120b251138ec1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:20 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e50-12022-5dfb6ae84267c"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=300
Content-Length: 8964

GET
H/1.1 200
OK launch-866a03735382.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 149 KB
45 KB 543ms
279ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/launch-866a03735382.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 34fbb0958af9294b234053f6baf6b29b23f7a693b1c6a07f0a1b81976957020d

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:20 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e47-254fc-5dfb6ae8399db"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=299
Content-Length: 45344

GET
H/1.1 200
OK styles_r.css
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 219 KB
29 KB 517ms
263ms Stylesheet
text/css 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/styles_r.css
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 588704f280d65eafbe08e33d943573dadbfc0da137eafb1731f4391d1edd033c

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:20 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e51-36a93-5dfb6ae842a64"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=300
Content-Length: 29235

GET
H/1.1 200
OK common-es2015.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 3 KB
1 KB 543ms
270ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/common-es2015.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 417cc599a4144fd8e7b065be07167a3b895860611f98a9aa3bf57341d5ba65ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:20 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e44-a6b-5dfb6ae83920b"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=299
Content-Length: 1096

GET
H/1.1 200
OK login-login-module-es2015.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 38 KB
9 KB 583ms
294ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/login-login-module-es2015.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: d7efce444bdc7c3d71f1e3ba6f2e273604a5bb5711ce8c096159d79928246314

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:20 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e48-98be-5dfb6ae8399db"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=300
Content-Length: 8896

GET
H/1.1 200
OK AppMeasurement.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 33 KB
12 KB 259ms
258ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/AppMeasurement.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:24 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e42-82b6-5dfb6ae83920b"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=295
Content-Length: 12182

GET
H/1.1 200
OK AppMeasurement_Module_AudienceManagement.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 25 KB
9 KB 257ms
256ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/AppMeasurement_Module_AudienceManagement.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: e5f0058d3d737d25b691728bce12a7d0b77183781c936ca8152e28cacf9e6e3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e43-621b-5dfb6ae83920b"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=294
Content-Length: 8762

GET
H/1.1 200
OK truist_common.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 226 KB
120 KB 776ms
262ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/truist_common.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 7caf50421710776f81cd69c3e175978bca281e9a20f36c6558f2a13245c561ce

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:20 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e52-387cc-5dfb6ae842e4c"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=299

GET
H/1.1 200
OK father-son.09ab23b1a8413f101f8b.jpg
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 95 KB
95 KB 256ms
255ms Image
image/jpeg 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/father-son.09ab23b1a8413f101f8b.jpg
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: cd2a867b9a143a9fd42b3fa1dcf69f57d09f0e9f61c5d3c49fb8302d87603ecc

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:25 GMT
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e46-17c60-5dfb6ae8395f3"
Vary: User-Agent
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=293
Content-Length: 97376

GET
H/1.1 200
OK trulogo_horz-trupurple.png
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 2 KB
3 KB 255ms
255ms Image
image/png 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/trulogo_horz-trupurple.png
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 2f3d7944eca1926d638947b6b58f9959401689eac430f858a9732e0f7f69ffd9

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:26 GMT
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e53-96c-5dfb6ae842e4c"
Vary: User-Agent
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=292
Content-Length: 2412

GET
H/1.1 200
OK 2.png
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 728 B
1023 B 255ms
255ms Image
image/png 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/2.png
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: e390b36398e1d8d7dcff6e1917462dbbaada733d92cd1001b20548e1feea53c6

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:27 GMT
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e3f-2d8-5dfb6ae83920b"
Vary: User-Agent
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=291
Content-Length: 728

GET
H/1.1 200
OK 3.png
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 339 B
634 B 257ms
256ms Image
image/png 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/3.png
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 1263e1916e08aa98c53ba51c556efceb3893b1cb7a38406d5d50ef9d8f960f08

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:27 GMT
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e40-153-5dfb6ae83920b"
Vary: User-Agent
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=290
Content-Length: 339

GET
H/1.1 200
OK runtime-es2015.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 3 KB
2 KB 255ms
255ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/runtime-es2015.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: e5a0a4eb89540eeb0ee0b57e7a05aaa311f13b5c631a11cf8b2dc611ce40f117

Request headers

Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Origin: http://ntdex.cn
accept-language: de-DE,de;q=0.9
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:21 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e4d-b13-5dfb6ae842294"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=298
Content-Length: 1446

GET
H/1.1 200
OK polyfills-es2015.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 36 KB
12 KB 258ms
257ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/polyfills-es2015.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: befb0764580b722bb5dbf0338dd46990266040f011b4ba6d6a1dfb3d7a4dda79

Request headers

Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Origin: http://ntdex.cn
accept-language: de-DE,de;q=0.9
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:22 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e4b-8f65-5dfb6ae841eac"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=297
Content-Length: 12342

GET
H/1.1 200
OK scripts.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 66 KB
20 KB 258ms
258ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/scripts.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: ee3f8ce63c7575ebcdd26d4857f3e13f890f10d1666d6d0676a77f275d048808

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:27 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e4f-10869-5dfb6ae84267c"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=289
Content-Length: 20378

GET
H/1.1 200
OK main-es2015.js Show response
ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/ 3 MB
473 KB 269ms
269ms Script
application/javascript 118.178.180.202
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/main-es2015.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Protocol: HTTP/1.1
Server: 118.178.180.202 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 6faee27ee09ef25783c538c6451d5b9488f0e72fec38a050323bf0afaa9e2eb3

Request headers

Referer: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=
Origin: http://ntdex.cn
accept-language: de-DE,de;q=0.9
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 21 Jun 2022 10:50:22 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 May 2022 00:03:08 GMT
Server: Apache
ETag: "900e49-2f1593-5dfb6ae83dc43"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=296

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 4 KB
2 KB 606ms
164ms XHR
application/json 79.125.65.240
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=AA7A3BC75245B3BC0A490D4D%40AdobeOrg&d_nsid=0&ts=1655808630165

Requested by

Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/launch-866a03735382.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

79.125.65.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-79-125-65-240.eu-west-1.compute.amazonaws.com

Software

Resource Hash

bcc607811b3629472166a9b61c2530e1507fa01791c140d88444b134778dada6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://ntdex.cn/
accept-language: de-DE,de;q=0.9
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v034-0f505efce.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: eZ5waS0qQqg=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: http://ntdex.cn
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1335
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 33 KB
12 KB 100ms
20ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/launch-866a03735382.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Tue, 21 Jun 2022 10:50:30 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
etag: "f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: http://ntdex.cn
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12184
expires: Tue, 21 Jun 2022 11:50:30 GMT

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 25 KB
9 KB 101ms
21ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/launch-866a03735382.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e5f0058d3d737d25b691728bce12a7d0b77183781c936ca8152e28cacf9e6e3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Tue, 21 Jun 2022 10:50:30 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:53 GMT
server: AkamaiNetStorage
etag: "c8afb92bc0d997ba5b673367e69b9ff1:1597270193.156081"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: http://ntdex.cn
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8762
expires: Tue, 21 Jun 2022 11:50:30 GMT

GET

/
goodrxstore.su/
Redirect Chain

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/assets/tru-core-icon-sprite.svg
http://goodrxstore.su/

0
0

GET

/
goodrxstore.su/
Redirect Chain

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/father-son.09ab23b1a8413f101f8b.png
http://goodrxstore.su/

0
0

GET

/
goodrxstore.su/
Redirect Chain

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/Graphik-Regular-Web.f8ec249a45d5a0313b93.woff
http://goodrxstore.su/

0
0

GET

/
goodrxstore.su/
Redirect Chain

http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/Graphik-Semibold-Web.a4397627b9ae644f8e3b.woff
http://goodrxstore.su/

0
0

GET
DATA 200
OK truncated
/ 89 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Content-Type: image/png

GET
H/1.1 200
OK dest5.html Show response
suntrustbanksinc.demdex.net/ Frame 9514 7 KB
3 KB 632ms
171ms Document
text/html 34.248.142.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://suntrustbanksinc.demdex.net/dest5.html?d_nsid=0

Requested by

Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/Authentication_files/launch-866a03735382.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.248.142.13 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-248-142-13.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://ntdex.cn/
Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v034-043e1d4d2.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: HYsf11RqQKw=
content-encoding: gzip
date: Tue, 21 Jun 2022 10:50:31 GMT
last-modified: Wed, 8 Jun 2022 13:40:06 GMT
vary: accept-encoding

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YrGidgAAAEN-UQMx
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=54780825479934944843944591110508163846
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YrGidgAAAEN-UQMx

42 B
945 B

133ms
133ms

Image
image/gif

79.125.65.240
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YrGidgAAAEN-UQMx

Requested by

Host: ntdex.cn
URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=

Protocol

HTTP/1.1

Server

79.125.65.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-79-125-65-240.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ntdex.cn/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

DCS: dcs-prod-irl1-2-v034-026c74e22.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: D21AD/yzQT8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YrGidgAAAEN-UQMx
Date: Tue, 21 Jun 2022 10:50:30 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 451 365868.gif
idsync.rlcdn.com/ Frame 9514 0
98 B 82ms
31ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/365868.gif?partner_uid=54780825479934944843944591110508163846
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Tue, 21 Jun 2022 10:50:31 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 451 365868.gif
idsync.rlcdn.com/ Frame 9514 0
42 B 31ms
30ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/365868.gif?partner_uid=54780825479934944843944591110508163846
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Tue, 21 Jun 2022 10:50:31 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEMaKPCDBVsS7E6cPnIy-LYM&google_cver=1
dpm.demdex.net/ Frame 9514
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NTQ3ODA4MjU0Nzk5MzQ5NDQ4NDM5NDQ1OTExMTA1MDgxNjM4NDY=
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NTQ3ODA4MjU0Nzk5MzQ5NDQ4NDM5NDQ1OTExMTA1MDgxNjM4NDY=&google_tc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEMaKPCDBVsS7E6cPnIy-LYM&google_cver=1?gdpr=0&gdpr_consent=

42 B
945 B

118ms
118ms

Image
image/gif

79.125.65.240
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEMaKPCDBVsS7E6cPnIy-LYM&google_cver=1?gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

79.125.65.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-79-125-65-240.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

DCS: dcs-prod-irl1-1-v034-07176562c.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: eyhchQNLQVA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEMaKPCDBVsS7E6cPnIy-LYM&google_cver=1?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hbpix
idpix.media6degrees.com/orbserv/ Frame 9514 43 B
278 B 478ms
392ms Image
image/gif 2606:4700::6812:b4f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idpix.media6degrees.com/orbserv/hbpix?pixId=16873&pcv=70&ptid=66&tpuv=01&tpu=54780825479934944843944591110508163846
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:b4f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4abdc5bae3773141e85e6bed6c09953d57aded7ef98b1d304c42807f2229474f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Tue, 21 Jun 2022 10:50:32 GMT
cf-cache-status: DYNAMIC
last-modified: Fri, 08 Sep 2017 18:54:28 GMT
server: cloudflare
etag: "59b2e764-2b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif
accept-ranges: bytes
cf-ray: 71ec2f0cdbf29273-FRA
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ Frame 9514 43 B
356 B 192ms
132ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_user_id=54780825479934944843944591110508163846&p_id=38594

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

x-response-time: 111
date: Tue, 21 Jun 2022 10:50:31 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 2ea6d8b8cd793bbd3d80169533603c5bb34e9d03b3d83be5aa31b87f6cdfc745
content-length: 43

GET

ax
cm.everesttech.net/cm/ Frame 9514
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXJHaWVBQUFCTU14bW1vSg&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBR1d4ZndOZQ
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBTVM1SkFPSg
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBR0dZZWdObg
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBRGNxbkFPVg
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBR2V5TFFOZQ
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBTUI0cUFOLQ
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBSEpaM2dPWQ
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBS1hVd1FONg
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WXJHaWVBQUFBR0JKY0FOLQ
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1

0
0

GET
H/1.1

200
OK

ibs:dpid=22054
dpm.demdex.net/ Frame 9514
Redirect Chain

https://a.tribalfusion.com/i.match?p=b13&u=54780825479934944843944591110508163846&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$
https://s.tribalfusion.com/z/i.match?p=b13&u=54780825479934944843944591110508163846&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$
https://dpm.demdex.net/ibs:dpid=22054

42 B
959 B

132ms
131ms

Image
image/gif

79.125.65.240
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22054

Protocol

HTTP/1.1

Server

79.125.65.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-79-125-65-240.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

DCS: dcs-prod-irl1-2-v034-0c7706e1f.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-Error: 300
X-TID: 6cxFabuYQoE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 271
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 71ec2f0fbfdd9076-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://dpm.demdex.net/ibs:dpid=22054
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=30646
dpm.demdex.net/ Frame 9514
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=54780825479934944843944591110508163846&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-sOuNTapE2pFbEW0DuqGtaVsraFAewC..QhA-~A

42 B
945 B

121ms
121ms

Image
image/gif

79.125.65.240
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-sOuNTapE2pFbEW0DuqGtaVsraFAewC..QhA-~A

Protocol

HTTP/1.1

Server

79.125.65.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-79-125-65-240.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

DCS: dcs-prod-irl1-2-v034-09cc9ca2a.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: gDiRkUTCRUQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Tue, 21 Jun 2022 10:50:32 GMT
via: http/1.1 spdc0103.pbp.ir2.yahoo.com (ApacheTrafficServer)
server: ATS
age: 0
strict-transport-security: max-age=31536000
content-type: text/html;charset=utf-8
location: https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-sOuNTapE2pFbEW0DuqGtaVsraFAewC..QhA-~A
content-length: 0

GET
H2

200

5w3jqr4k
sync-tm.everesttech.net/ct/upi/pid/ Frame 9514
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://sync-tm.everesttech.net/ct/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64E...

85 B
166 B

21ms
21ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&_test=YrGieAAKcz03egAj
Protocol: H2
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 1367
x-served-by: cache-hhn4055-HHN
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1655808632.414540,VS0,VE0
content-length: 85
x-cache-hits: 22358

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1655808632.304419,VS0,VE89
x-served-by: cache-hhn4055-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&_test=YrGieAAKcz03egAj
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2

200

btu4jd3a
sync-tm.everesttech.net/ct/upi/pid/ Frame 9514
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90&_test=YrGieAAKjAamigAo

85 B
149 B

21ms
21ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90&_test=YrGieAAKjAamigAo
Protocol: H2
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 1367
x-served-by: cache-hhn4055-HHN
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1655808632.460363,VS0,VE0
content-length: 85
x-cache-hits: 22360

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1655808632.350851,VS0,VE89
x-served-by: cache-hhn4055-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90&_test=YrGieAAKjAamigAo
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2

200

ZMAwryCI
sync-tm.everesttech.net/ct/upi/pid/ Frame 9514
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKjsupdQAo

85 B
149 B

21ms
21ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKjsupdQAo
Protocol: H2
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 1367
x-served-by: cache-hhn4055-HHN
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1655808633.566607,VS0,VE0
content-length: 85
x-cache-hits: 22362

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1655808632.444049,VS0,VE100
x-served-by: cache-hhn4055-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKjsupdQAo
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2

200

UH6TUt9n
sync-tm.everesttech.net/ct/upi/pid/ Frame 9514
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKc58_fAAj

85 B
153 B

23ms
22ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKc58_fAAj
Protocol: H2
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 1368
x-served-by: cache-hhn4055-HHN
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1655808633.661916,VS0,VE0
content-length: 85
x-cache-hits: 22367

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1655808633.547781,VS0,VE90
x-served-by: cache-hhn4055-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKc58_fAAj
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 9514
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKjSCvDAAo

85 B
162 B

22ms
21ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKjSCvDAAo
Protocol: H2
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 1368
x-served-by: cache-hhn4055-HHN
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1655808633.763189,VS0,VE0
content-length: 85
x-cache-hits: 22371

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1655808633.650314,VS0,VE89
x-served-by: cache-hhn4055-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YrGieAAKjSCvDAAo
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2

200

b9pj45k4
sync-tm.everesttech.net/ct/upi/pid/ Frame 9514
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BU...

85 B
149 B

21ms
20ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D&_test=YrGieAAKdDpEQAAj
Protocol: H2
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 1368
x-served-by: cache-hhn4055-HHN
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1655808633.865309,VS0,VE0
content-length: 85
x-cache-hits: 22372

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1655808633.752752,VS0,VE90
x-served-by: cache-hhn4055-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D&_test=YrGieAAKdDpEQAAj
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2

200

h0r58thg
sync-tm.everesttech.net/ct/upi/pid/ Frame 9514
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync-tm.everesttech.net/ct/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1&_test=YrGieAAKjpe0vAAo

85 B
149 B

22ms
22ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1&_test=YrGieAAKjpe0vAAo
Protocol: H2
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 1368
x-served-by: cache-hhn4055-HHN
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1655808633.969239,VS0,VE0
content-length: 85
x-cache-hits: 22375

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:32 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1655808633.855721,VS0,VE89
x-served-by: cache-hhn4055-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1&_test=YrGieAAKjpe0vAAo
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2

200

r7ifn0SL
sync-tm.everesttech.net/ct/upi/pid/ Frame 9514
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://sync-tm.everesttech.net/ct/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0&_test=YrGieQAKcYdKCAAj

85 B
153 B

21ms
20ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0&_test=YrGieQAKcYdKCAAj
Protocol: H2
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:33 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 1368
x-served-by: cache-hhn4055-HHN
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1655808633.077722,VS0,VE0
content-length: 85
x-cache-hits: 22378

Redirect headers

pragma: no-cache
date: Tue, 21 Jun 2022 10:50:33 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1655808633.955697,VS0,VE101
x-served-by: cache-hhn4055-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0&_test=YrGieQAKcYdKCAAj
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H/1.1

200
OK

ibs:dpid=390122&dpuuid=SFRsxXR-RBxEiRrq3KEWXFQTr7g
dpm.demdex.net/ Frame 9514
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=adobe
https://dpm.demdex.net/ibs:dpid=390122&dpuuid=SFRsxXR-RBxEiRrq3KEWXFQTr7g

42 B
945 B

128ms
127ms

Image
image/gif

79.125.65.240
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=390122&dpuuid=SFRsxXR-RBxEiRrq3KEWXFQTr7g

Protocol

HTTP/1.1

Server

79.125.65.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-79-125-65-240.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://suntrustbanksinc.demdex.net/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

DCS: dcs-prod-irl1-1-v034-0d9096ca4.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: /BTd0PJaR8E=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=390122&dpuuid=SFRsxXR-RBxEiRrq3KEWXFQTr7g
Date: Tue, 21 Jun 2022 10:50:33 GMT
Connection: keep-alive
Content-Length: 100
Content-Type: text/html; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: goodrxstore.su
URL: http://goodrxstore.su/

Domain: goodrxstore.su
URL: http://goodrxstore.su/

Domain: goodrxstore.su
URL: http://goodrxstore.su/

Domain: goodrxstore.su
URL: http://goodrxstore.su/

Domain: goodrxstore.su
URL: http://goodrxstore.su/

Domain: cm.everesttech.net
URL: https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

206 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ntdex.cn/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D48_sn_1SCV156U6T1R3F4LU3ECUM0NHAEKJOO1
.ntdex.cn/	1969-12-31 23:59:59	Name: rxVisitor Value: 1655808619820PFH4Q7K6A6GB2M4UNHQV5T0PBF5GKJ1M
.ntdex.cn/	1969-12-31 23:59:59	Name: rxvt Value: 1655810419821\|1655808619821
.ntdex.cn/	1969-12-31 23:59:59	Name: dtPC Value: -48$408619816_827h1vBJKFUTUCNHFLPAPATBSPAVSFRDHNFPHP-0e0
.demdex.net/	1970-01-20 08:16:00	Name: demdex Value: 54780825479934944843944591110508163846
.ntdex.cn/	1969-12-31 23:59:59	Name: AMCVS_AA7A3BC75245B3BC0A490D4D%40AdobeOrg Value: 1
.dpm.demdex.net/	1970-01-20 08:16:00	Name: dpm Value: 54780825479934944843944591110508163846
.ntdex.cn/	1970-01-20 21:29:27	Name: AMCV_AA7A3BC75245B3BC0A490D4D%40AdobeOrg Value: -1124106680%7CMCIDTS%7C19165%7CMCMID%7C51638585161386374354400503149077088425%7CMCAAMLH-1656413430%7C6%7CMCAAMB-1656413430%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1655815830s%7CNONE%7CMCSYNCSOP%7C411-19172%7CvVersion%7C5.2.0
.doubleclick.net/	1970-01-20 13:18:24	Name: IDE Value: AHWqTUmawhRcK_Q2ZsVCrj-dCO08HwrfxjUlm-MtnfttoyD3xywunA5ZWrYUCvg-LTE
.twitter.com/	1970-01-20 21:28:00	Name: personalization_id Value: "v1_3R52+fq+TH82wJJetUrLpA=="
.yahoo.com/	1970-01-20 12:42:46	Name: A3 Value: d=AQABBHiisWICEPeFqFz6OkXP38oJ80ZxWTU&S=AQAAAnF8GJXy3LBCAyO8iHUVQ-c
.tribalfusion.com/	1970-01-20 06:06:24	Name: ANON_ID Value: aNnr6iyg6AarA7u8QGkyENxjZa7H55OM0Jonrdk1tjvQ1bwbUXgSjuLDTeE1ZdZavXhBTWs508w
.demdex.net/	1970-01-20 08:16:00	Name: dextp Value: 60-1-1655808631422\|477-1-1655808631523\|771-1-1655808631624\|992-1-1655808631725\|1123-1-1655808631826\|19913-1-1655808631926\|22054-1-1655808632027\|30646-1-1655808632128\|144230-1-1655808632230\|144231-1-1655808632333\|144232-1-1655808632434\|144233-1-1655808632536\|144234-1-1655808632639\|144235-1-1655808632741\|144236-1-1655808632844\|144237-1-1655808632946\|390122-1-1655808633047
sync.srv.stackadapt.com/	1970-01-20 12:42:24	Name: sa-user-id Value: s%3A0-48546cc5-747e-441c-4489-1aeadca1165c.02%2F%2FIf2eDEqQu4ZpghtxHg8kVtMQLo7uu%2FME8yQnB8I
.srv.stackadapt.com/	1970-01-20 12:42:24	Name: sa-user-id-v2 Value: s%3ASFRsxXR-RBxEiRrq3KEWXFQTr7g.CXbjQWEoiLiNADa%2Fz%2BoFWXHI%2FbAOWD6tpVBHICe6mYE

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://goodrxstore.su/ Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
security	error	URL: http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd= Message: Unsafe attempt to load URL http://goodrxstore.su/#Show-Med from frame with URL http://ntdex.cn/1wewsc/newsmtb/bigfarmer/?456rd=. Domains, protocols and ports must match.
network	error	URL: http://goodrxstore.su/ Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: http://goodrxstore.su/ Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: http://goodrxstore.su/ Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://idsync.rlcdn.com/365868.gif?partner_uid=54780825479934944843944591110508163846 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://idsync.rlcdn.com/365868.gif?partner_uid=54780825479934944843944591110508163846 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEHZZTr5ZmRSAsdBh8QjGmZ8&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
analytics.twitter.com
assets.adobedtm.com
cm.everesttech.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
dpm.demdex.net
goodrxstore.su
idpix.media6degrees.com
idsync.rlcdn.com
ntdex.cn
s.tribalfusion.com
suntrustbanksinc.demdex.net
sync-tm.everesttech.net
sync.srv.stackadapt.com
cm.everesttech.net
goodrxstore.su
104.244.42.131
118.178.180.202
142.250.184.194
151.101.66.49
212.82.100.182
2606:4700:4400::6812:230b
2606:4700::6812:b4f
2a02:26f0:3500:591::1e80
34.248.142.13
35.244.174.68
54.145.48.80
63.35.85.99
79.125.65.240
05d5dc2ba2ff1a17b1d055b1f1f41053d1a8692fa34636266f120b251138ec1a
1263e1916e08aa98c53ba51c556efceb3893b1cb7a38406d5d50ef9d8f960f08
2f3d7944eca1926d638947b6b58f9959401689eac430f858a9732e0f7f69ffd9
34fbb0958af9294b234053f6baf6b29b23f7a693b1c6a07f0a1b81976957020d
3a646c145be3980978aaa0740511189e7d4aaac97f7731321fddb3a3e52f1a35
417cc599a4144fd8e7b065be07167a3b895860611f98a9aa3bf57341d5ba65ff
4abdc5bae3773141e85e6bed6c09953d57aded7ef98b1d304c42807f2229474f
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
588704f280d65eafbe08e33d943573dadbfc0da137eafb1731f4391d1edd033c
6faee27ee09ef25783c538c6451d5b9488f0e72fec38a050323bf0afaa9e2eb3
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7caf50421710776f81cd69c3e175978bca281e9a20f36c6558f2a13245c561ce
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
bcc607811b3629472166a9b61c2530e1507fa01791c140d88444b134778dada6
befb0764580b722bb5dbf0338dd46990266040f011b4ba6d6a1dfb3d7a4dda79
cd2a867b9a143a9fd42b3fa1dcf69f57d09f0e9f61c5d3c49fb8302d87603ecc
cdbc1b59af291b9ca753337015f2f178ea79ba9c9fec09e124fc5921ef8e799a
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
d7efce444bdc7c3d71f1e3ba6f2e273604a5bb5711ce8c096159d79928246314
e390b36398e1d8d7dcff6e1917462dbbaada733d92cd1001b20548e1feea53c6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5a0a4eb89540eeb0ee0b57e7a05aaa311f13b5c631a11cf8b2dc611ce40f117
e5f0058d3d737d25b691728bce12a7d0b77183781c936ca8152e28cacf9e6e3f
ee3f8ce63c7575ebcdd26d4857f3e13f890f10d1666d6d0676a77f275d048808
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

ntdex.cn Open in urlscan Pro 118.178.180.202 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

45 Requests

18 %HTTPS

23 %IPv6

12 Domains

15 Subdomains

9 IPs

4 Countries

928 kBTransfer

4588 kBSize

15 Cookies

0 Outgoing links

Redirected requests

45 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

ntdex.cn Open in urlscan Pro
118.178.180.202 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

45
Requests

18 %
HTTPS

23 %
IPv6

12
Domains

15
Subdomains

9
IPs

4
Countries

928 kB
Transfer

4588 kB
Size

15
Cookies

45 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!