URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Submission: On November 23 via api from US

Summary

This website contacted 54 IPs in 6 countries across 40 domains to perform 218 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.
This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
17 35.173.160.135 14618 (AMAZON-AES)
9 65.9.86.127 16509 (AMAZON-02)
7 2606:4700:e4:... 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
8 2600:9000:212... 16509 (AMAZON-02)
13 2600:9000:212... 16509 (AMAZON-02)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 9 2a00:1450:400... 15169 (GOOGLE)
7 216.58.206.2 15169 (GOOGLE)
3 65.9.83.127 16509 (AMAZON-02)
1 15 151.101.130.137 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2620:116:800d... 16509 (AMAZON-02)
1 199.232.56.157 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:210... 16509 (AMAZON-02)
1 44.241.206.146 16509 (AMAZON-02)
4 213.19.162.21 3356 (LEVEL3)
6 185.33.220.242 29990 (ASN-APPNEX)
9 14 2606:2800:233... 15133 (EDGECAST)
1 184.31.84.150 20940 (AKAMAI-ASN1)
2 10 34.98.64.218 15169 (GOOGLE)
1 206.189.254.17 14061 (DIGITALOC...)
5 185.64.189.112 62713 (AS-PUBMATIC)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.244.42.69 13414 (TWITTER)
12 3.23.106.246 16509 (AMAZON-02)
1 34.226.158.15 14618 (AMAZON-AES)
2 2600:9000:215... 16509 (AMAZON-02)
6 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
8 65.9.86.58 16509 (AMAZON-02)
11 2a00:1450:400... 15169 (GOOGLE)
7 104.111.215.135 16625 (AKAMAI-AS)
10 2a00:1450:400... 15169 (GOOGLE)
3 104.111.215.68 16625 (AKAMAI-AS)
3 104.111.215.51 16625 (AKAMAI-AS)
1 2a00:1288:110... 34010 (YAHOO-IRD)
2 2 18.203.78.129 16509 (AMAZON-02)
4 5 35.156.106.231 16509 (AMAZON-02)
2 2 151.101.114.49 54113 (FASTLY)
2 3.126.56.137 16509 (AMAZON-02)
1 1 216.58.207.34 15169 (GOOGLE)
1 184.30.212.16 20940 (AKAMAI-ASN1)
1 2620:1ec:bdf::10 8068 (MICROSOFT...)
1 2 18.192.150.244 16509 (AMAZON-02)
1 1 134.209.129.254 14061 (DIGITALOC...)
1 205.185.216.10 20446 (HIGHWINDS3)
1 64.140.160.2 18450 (WEBNX)
1 104.244.42.3 13414 (TWITTER)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 2620:1ec:21::14 8068 (MICROSOFT...)
1 199.232.53.140 54113 (FASTLY)
1 18.197.37.94 16509 (AMAZON-02)
218 54
Apex Domain
Subdomains
Transfer
37 threatpost.com
threatpost.com
assets.threatpost.com
media.threatpost.com
657 KB
29 connatix.com
cd.connatix.com
cds.connatix.com
capi.connatix.com
vid.connatix.com
img.connatix.com
2 MB
20 advertising.com
adserver-us.adtech.advertising.com
ads.adaptv.advertising.com Failed
pixel.advertising.com
5 KB
17 adlightning.com
tagan.adlightning.com
math-aids-threatpost-tagan.adlightning.com
206 KB
16 googlesyndication.com
a62a15d7931cfb5f7d4beaf22f1c2f91.safeframe.googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
194 KB
12 google.com
www.google.com
adservice.google.com
2 KB
11 doubleclick.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
152 KB
10 ampproject.org
cdn.ampproject.org
194 KB
10 openx.net
teachingaids-d.openx.net
u.openx.net
eu-u.openx.net
2 KB
9 adnxs.com
ib.adnxs.com
acdn.adnxs.com
7 KB
8 pubmatic.com
hbopenbid.pubmatic.com
ads.pubmatic.com
351 B
7 admetricspro.com
qd.admetricspro.com
290 KB
5 casalemedia.com
htlb.casalemedia.com
as-sec.casalemedia.com
2 KB
5 rubiconproject.com
fastlane.rubiconproject.com
eus.rubiconproject.com
9 KB
3 yahoo.com
pr-bh.ybp.yahoo.com
ups.analytics.yahoo.com
3 KB
3 indexww.com
js-sec.indexww.com
3 google-analytics.com
www.google-analytics.com
19 KB
3 amazon-adsystem.com
c.amazon-adsystem.com
33 KB
3 googletagservices.com
www.googletagservices.com
75 KB
2 everesttech.net
sync-tm.everesttech.net
652 B
2 adsrvr.org
match.adsrvr.org
989 B
2 google.de
www.google.de
adservice.google.de
276 B
2 serverbid.com
e.serverbid.com
sync.serverbid.com
267 B
2 servenobid.com
ads.servenobid.com
public.servenobid.com
466 B
2 3lift.com
tlx.3lift.com Failed
eb2.3lift.com
310 B
2 quantserve.com
secure.quantserve.com
pixel.quantserve.com
9 KB
2 gstatic.com
www.gstatic.com
262 KB
1 reddit.com
www.reddit.com
1 KB
1 linkedin.com
www.linkedin.com
1 facebook.com
graph.facebook.com
582 B
1 twitter.com
analytics.twitter.com
651 B
1 ipify.org
geo.ipify.org
1 KB
1 digitaloceanspaces.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 t.co
t.co
369 B
1 a-mo.net
prebid.a-mo.net Failed
1x1.a-mo.net
89 B
1 quantcount.com
rules.quantcount.com
345 B
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 googletagmanager.com
www.googletagmanager.com
49 KB
1 kasperskycontenthub.com
kasperskycontenthub.com
398 B
0 lijit.com Failed
ap.lijit.com Failed
218 40
Domain Requested by
16 threatpost.com threatpost.com
14 adserver-us.adtech.advertising.com 9 redirects threatpost.com
13 media.threatpost.com threatpost.com
12 capi.connatix.com cd.connatix.com
11 tpc.googlesyndication.com tagan.adlightning.com
threatpost.com
11 vid.connatix.com cd.connatix.com
11 www.google.com 2 redirects threatpost.com
tagan.adlightning.com
10 cdn.ampproject.org threatpost.com
9 tagan.adlightning.com threatpost.com
tagan.adlightning.com
8 math-aids-threatpost-tagan.adlightning.com tagan.adlightning.com
8 assets.threatpost.com threatpost.com
assets.threatpost.com
7 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
threatpost.com
7 qd.admetricspro.com threatpost.com
qd.admetricspro.com
6 ib.adnxs.com qd.admetricspro.com
cds.connatix.com
5 pixel.advertising.com 4 redirects threatpost.com
5 hbopenbid.pubmatic.com qd.admetricspro.com
cds.connatix.com
5 teachingaids-d.openx.net qd.admetricspro.com
cds.connatix.com
4 u.openx.net 2 redirects cds.connatix.com
4 as-sec.casalemedia.com cds.connatix.com
4 fastlane.rubiconproject.com qd.admetricspro.com
3 js-sec.indexww.com cds.connatix.com
qd.admetricspro.com
3 acdn.adnxs.com cds.connatix.com
qd.admetricspro.com
3 ads.pubmatic.com cds.connatix.com
qd.admetricspro.com
3 pagead2.googlesyndication.com threatpost.com
securepubads.g.doubleclick.net
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
threatpost.com
3 cds.connatix.com threatpost.com
tagan.adlightning.com
cd.connatix.com
3 c.amazon-adsystem.com qd.admetricspro.com
c.amazon-adsystem.com
3 www.googletagservices.com threatpost.com
tagan.adlightning.com
securepubads.g.doubleclick.net
2 eb2.3lift.com 1 redirects qd.admetricspro.com
2 ups.analytics.yahoo.com threatpost.com
2 sync-tm.everesttech.net 2 redirects
2 match.adsrvr.org 2 redirects
2 googleads.g.doubleclick.net threatpost.com
2 a62a15d7931cfb5f7d4beaf22f1c2f91.safeframe.googlesyndication.com tagan.adlightning.com
2 img.connatix.com threatpost.com
2 www.gstatic.com www.google.com
1 www.reddit.com threatpost.com
1 www.linkedin.com threatpost.com
1 graph.facebook.com threatpost.com
1 analytics.twitter.com tagan.adlightning.com
1 geo.ipify.org qd.admetricspro.com
1 eu-u.openx.net qd.admetricspro.com
1 serverbid-sync.nyc3.cdn.digitaloceanspaces.com qd.admetricspro.com
1 sync.serverbid.com 1 redirects
1 public.servenobid.com qd.admetricspro.com
1 eus.rubiconproject.com qd.admetricspro.com
1 cm.g.doubleclick.net 1 redirects
1 pr-bh.ybp.yahoo.com threatpost.com
1 ads.adaptv.advertising.com cds.connatix.com
1 adservice.google.com tagan.adlightning.com
1 adservice.google.de tagan.adlightning.com
1 1x1.a-mo.net threatpost.com
1 pixel.quantserve.com threatpost.com
1 t.co threatpost.com
1 www.google.de threatpost.com
1 stats.g.doubleclick.net www.google-analytics.com
1 e.serverbid.com qd.admetricspro.com
1 htlb.casalemedia.com qd.admetricspro.com
1 ads.servenobid.com qd.admetricspro.com
1 rules.quantcount.com secure.quantserve.com
1 static.ads-twitter.com www.googletagmanager.com
1 secure.quantserve.com www.googletagmanager.com
1 www.googletagmanager.com threatpost.com
1 kasperskycontenthub.com threatpost.com
1 cd.connatix.com 1 redirects
0 ap.lijit.com Failed qd.admetricspro.com
0 tlx.3lift.com Failed qd.admetricspro.com
0 prebid.a-mo.net Failed qd.admetricspro.com
218 68
Subject Issuer Validity Valid
threatpost.com
DigiCert SHA2 Secure Server CA
2020-06-10 -
2021-06-15
a year crt.sh
*.adlightning.com
Amazon
2020-07-22 -
2021-08-22
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-08-10 -
2021-08-10
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
assets.threatpost.com
Amazon
2020-03-04 -
2021-04-04
a year crt.sh
media.threatpost.com
Amazon
2020-03-04 -
2021-04-04
a year crt.sh
www.google.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
*.google.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
c.amazon-adsystem.com
Amazon
2020-08-04 -
2021-08-02
a year crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2
2020-09-29 -
2021-10-19
a year crt.sh
kasperskycontenthub.com
DigiCert SHA2 Secure Server CA
2020-06-01 -
2021-06-09
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
*.gstatic.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA
2020-10-02 -
2021-10-07
a year crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2020-08-14 -
2021-08-19
a year crt.sh
*.servenobid.com
Amazon
2020-03-02 -
2021-04-02
a year crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA
2020-06-24 -
2021-02-17
8 months crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
*.adtech.advertising.com
DigiCert SHA2 Secure Server CA
2020-04-16 -
2022-04-21
2 years crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2020-03-02 -
2021-04-01
a year crt.sh
*.openx.net
GeoTrust RSA CA 2018
2020-06-18 -
2021-08-17
a year crt.sh
e.serverbid.com
Let's Encrypt Authority X3
2020-09-18 -
2020-12-17
3 months crt.sh
*.pubmatic.com
Sectigo RSA Organization Validation Secure Server CA
2019-02-22 -
2021-02-21
2 years crt.sh
www.google.de
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
t.co
DigiCert SHA2 High Assurance Server CA
2020-03-05 -
2021-03-02
a year crt.sh
*.a-mo.net
Amazon
2020-08-24 -
2021-09-24
a year crt.sh
*.google.de
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
misc-sni.google.com
GTS CA 1O1
2020-11-03 -
2021-01-26
3 months crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018
2020-01-02 -
2021-04-02
a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2020-10-30 -
2021-04-27
6 months crt.sh
pixel.advertising.com
DigiCert SHA2 High Assurance Server CA
2020-10-04 -
2021-03-31
6 months crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA
2020-10-24 -
2021-04-20
6 months crt.sh
public.servenobid.com
DigiCert SHA2 Secure Server CA
2020-08-26 -
2021-08-25
a year crt.sh
*.3lift.com
Amazon
2020-07-04 -
2021-08-05
a year crt.sh
*.nyc3.cdn.digitaloceanspaces.com
DigiCert SHA2 Secure Server CA
2020-03-11 -
2021-04-14
a year crt.sh
*.ipify.org
COMODO RSA Domain Validation Secure Server CA
2018-01-24 -
2021-01-23
3 years crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA
2020-03-05 -
2021-03-02
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2020-11-02 -
2021-01-30
3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2020-10-02 -
2021-04-02
6 months crt.sh
*.reddit.com
DigiCert SHA2 Secure Server CA
2020-08-26 -
2021-02-22
6 months crt.sh
*.v.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2020-07-29 -
2021-01-25
6 months crt.sh

This page contains 27 frames:

Primary Page: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Frame ID: CC1E204AC74AEF18B89B62133AA7204D
Requests: 114 HTTP requests in this frame

Frame: https://cds.connatix.com/p/78152/connatix.player.dc.js
Frame ID: 6033B30F26EAB50970BC886A224BF596
Requests: 43 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-54ec09d8.js
Frame ID: 54F35AF5A25D5A3D930CB63609A84969
Requests: 14 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-54ec09d8.js
Frame ID: 0C1B18EA75AAADCCADE1B89C90FCD3AD
Requests: 14 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-54ec09d8.js
Frame ID: 6CD5416BEBFE6699EEC2B15E59C2E401
Requests: 10 HTTP requests in this frame

Frame: https://a62a15d7931cfb5f7d4beaf22f1c2f91.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 55A831CB86A5B1AE29E4C9892C77CB7B
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 01F6CEF415DDB832DEE72C0D976F3149
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 5D0E2BEDE50C4E4A49C89B88AAB4216F
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: F41AD1CE3C6ED713E06A8CC363F2059C
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: D9126AA854EECED4C6DEA2801DAE5EE9
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1
Frame ID: 1A592BA4B6ED68E5738414E40750CD3A
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 374D19E5ECAEFBFDAF4623332B68CB9B
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1
Frame ID: D8EEE17D2AAA836A0CEEA58C5CDEDAAC
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 7EE4C57B88D609F4B33D94B36C3929C7
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 0E852995FC88AE513B81193E0B4FF592
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 0927134C4FFD5DFCCBA476EC7362BA38
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 9B6A77EFE0D1F0DCCB25756F65B397F7
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 53076C04C1C45F737C7032D0DCBF55C5
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: D1B253A5D192D99609B445F2128A44D6
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 2D55B2772342279AB059A5CB9199A9B5
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 8EC3A2A712B7DDD7F446725A0F076A35
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: E988E5B1F3C552F8962B32E14362765C
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&theme=standard&size=normal&cb=f8kyd88dny1z
Frame ID: 4C4F96D99F8094A6CCE2A9DB40CE61FA
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&theme=light&size=normal&cb=r1fcnvq5ywf9
Frame ID: 27E02F437D317821C9F8B13A3AC46FFE
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=nwxipv7sylv5
Frame ID: 7287497158419EB8132A37DCC0EB01A0
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=cj5d5ob78jwb
Frame ID: 22AB8B687B1D25B45596B494937430B0
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Frame ID: E5ADEC245AD0E926114E93DC387D879A
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

218
Requests

98 %
HTTPS

42 %
IPv6

40
Domains

68
Subdomains

54
IPs

6
Countries

3758 kB
Transfer

8185 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25
  • https://cd.connatix.com/connatix.player.js HTTP 302
  • https://cds.connatix.com/p/78152/connatix.player.dc.js
Request Chain 67
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=57f498a42b7f574;misc=1606160178836; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=57f498a42b7f574;misc=1606160178836 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A28bc8332-2dc3-11eb-a345-12359aeea65a;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=57f498a42b7f574;misc=1606160178836
Request Chain 68
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=582fafa93e64a4c;misc=1606160178836; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=582fafa93e64a4c;misc=1606160178836
Request Chain 69
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5942fe4d33925b6;misc=1606160178836; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=5942fe4d33925b6;misc=1606160178836 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A28bc74aa-2dc3-11eb-b09b-1204ea82ed4e;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=5942fe4d33925b6;misc=1606160178836
Request Chain 70
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60b8e409ab6bb63;misc=1606160178836; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=60b8e409ab6bb63;misc=1606160178836 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A28bc9b4c-2dc3-11eb-bb95-123ff9725662;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=60b8e409ab6bb63;misc=1606160178836
Request Chain 71
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=6192c820d1a432d;misc=1606160178836; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1606160177;v=2;cmd=bid;cors=yes;alias=6192c820d1a432d;misc=1606160178836 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A28bca132-2dc3-11eb-abd1-125139b028ba;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=6192c820d1a432d;misc=1606160178836
Request Chain 151
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 163
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 172
  • https://u.openx.net/w/1.0/pd HTTP 302
  • https://u.openx.net/w/1.0/pd?cc=1
Request Chain 174
  • https://u.openx.net/w/1.0/pd HTTP 302
  • https://u.openx.net/w/1.0/pd?cc=1
Request Chain 177
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://pixel.advertising.com/ups/55953/sync?uid=1041cdd1-b1e6-4d6b-81fb-74a2f97108a5&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=1041cdd1-b1e6-4d6b-81fb-74a2f97108a5
Request Chain 178
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=X7wPOQAAAIn33FLS HTTP 302
  • https://pixel.advertising.com/ups/55986/sync?uid=X7wPOQAAAIn33FLS&_origin=0&gdpr=0&gdpr_consent=&_test=X7wPOQAAAIn33FLS HTTP 302
  • https://pixel.advertising.com/ups/55986/sync?uid=X7wPOQAAAIn33FLS&_origin=0&gdpr=0&gdpr_consent=&_test=X7wPOQAAAIn33FLS&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=X7wPOQAAAIn33FLS&_origin=0&gdpr=0&gdpr_consent=&_test=X7wPOQAAAIn33FLS&apid=UP2d57bfe1-2dc3-11eb-9e91-06c2c86cd578
Request Chain 179
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEFXQeWfwCFk4NkdtuOUxhrA&google_cver=1 HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEFXQeWfwCFk4NkdtuOUxhrA&google_cver=1&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFXQeWfwCFk4NkdtuOUxhrA&google_cver=1&apid=UP2d57bfe1-2dc3-11eb-9e91-06c2c86cd578
Request Chain 185
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 186
  • https://sync.serverbid.com/ss/2000891.html HTTP 302
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

218 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
82 KB
21 KB
Document
General
Full URL
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
5368b02976babb5684a9eeeef96d9b4d12b86e70428ab3fd7c674997730d8b98
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
threatpost.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx
Date
Mon, 23 Nov 2020 19:36:12 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
close
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Link
<https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/wp-json/wp/v2/posts/161471>; rel="alternate"; type="application/json" <https://threatpost.com/?p=161471>; rel=shortlink
X-Frame-Options
SAMEORIGIN
X-Debug-Auth
off
X-Request-Host
threatpost.com
x-cache-hit
HIT
Content-Encoding
gzip
main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/
253 KB
39 KB
Stylesheet
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:16 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Nov 2020 08:54:39 GMT
Server
nginx
ETag
W/"5fb23e4f-3f2b8"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 30 Nov 2020 19:36:16 GMT
op.js
tagan.adlightning.com/math-aids-threatpost/
37 KB
14 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a8636ffe87230ef44e19dffa6b894c7120181af3f87666fc235c88d3dbd102c2

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
GcXR0VScIEQiqDDvdSqcciQWgsjwfaFH
content-encoding
gzip
etag
"a69f6bd4b7e986b2410ad1c9ffc3aab5"
age
2106
x-cache
Hit from cloudfront
content-length
13396
x-amz-meta-git_commit
9a4f7ce
last-modified
Mon, 23 Nov 2020 16:58:04 GMT
server
AmazonS3
date
Mon, 23 Nov 2020 19:01:12 GMT
content-type
application/javascript
via
1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
pQm8sgBa1wUv_74lz_BVBDLBnCMBUtA1ZHtzkLDE-MW4k7kQWJCpTw==
ros-layout.js
qd.admetricspro.com/js/threatpost/
22 KB
3 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a912 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:14 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
334
cf-request-id
069834668300001e75ac9ee000000001
last-modified
Thu, 06 Aug 2020 02:14:13 GMT
server
cloudflare
etag
W/"579e-5ac2c0b6aa2e7-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=JkbpyVyb9fUfKfHoAiaWeAgC9lk6bpZFfIq4qMqoXHh%2FHYAcMqv5tRPWvsyWT%2FGLCjFp9AyPF5jcagmf0UQHy5iPpgEfvV%2Fk5tDeCdQ4%2BAHy91H%2FP%2FYAET4bGKlXQXQ3"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5f6d56840af41e75-AMS
expires
Mon, 23 Nov 2020 19:33:38 GMT
gpt.js
www.googletagservices.com/tag/js/
54 KB
18 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6e56945bdbc9e3daae1694d4b49cee8f3788266449596997acc112517a9826ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"703 / 648 of 1000 / last-modified: 1606134211"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
18520
x-xss-protection
0
expires
Mon, 23 Nov 2020 19:36:14 GMT
cmp.js
qd.admetricspro.com/js/threatpost/
305 KB
82 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a912 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:14 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
434
cf-request-id
069834668400001e75ea3e5000000001
last-modified
Tue, 06 Oct 2020 19:53:29 GMT
server
cloudflare
etag
W/"4c426-5b105f3f297c7-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=SFC6u9bXGHS8ViN0bAUjMTHUCxTpLJ0eZ3qd5c5a1wGhOUNBlrtVGchZWXqTdwmX4zHEm9LYAQTfSBpjZCE6XpB0AroW2F%2BqOQVoVjaTzExDOHjVtLfHXSKHLnx%2BSo%2FU"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5f6d56840afd1e75-AMS
expires
Mon, 23 Nov 2020 19:31:16 GMT
uspcmp.js
qd.admetricspro.com/js/threatpost/
148 KB
55 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a912 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:14 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
334
cf-request-id
069834668400001e75a7b49000000001
last-modified
Sat, 08 Aug 2020 22:40:07 GMT
server
cloudflare
etag
W/"24e50-5ac65673cef1c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=n5VZMm8SxosZmtNsvI7IjHA7nWTF1uJo6CGauwtvMM%2BNvX7TX3apzAHzZo0nIllhBQGTqdjWMNqRRtPJtSpAzRnKJuf2vciRFaNWFMGuR8ijjrTXK6pBX3FMtoJiRKG9"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5f6d56840b001e75-AMS
expires
Mon, 23 Nov 2020 19:31:17 GMT
targeting.js
qd.admetricspro.com/js/threatpost/
275 B
448 B
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a912 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:14 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
333
cf-request-id
069834668300001e75b28a6000000001
last-modified
Sat, 08 Feb 2020 20:49:18 GMT
server
cloudflare
etag
W/"113-59e16a3cfb471-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4vsdt67PRu%2FFuYuKj0lCwdNBKo6V0fmVe8myCvrOPvVC3QKUDmfKdErPKE%2B%2FeNJNyfqaDYXm1wd5akgUUjQHhfXcK%2FZbYONqOWPdaX1fqMXXT3GsCAOuIBvf%2FVylQYb5"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5f6d56840afa1e75-AMS
expires
Mon, 23 Nov 2020 19:31:17 GMT
prebid.js
qd.admetricspro.com/js/threatpost/
399 KB
113 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a912 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:14 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
434
cf-request-id
069834668300001e75a31fd000000001
last-modified
Fri, 02 Oct 2020 04:32:28 GMT
server
cloudflare
etag
W/"63c0e-5b0a89ec6a525-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=U7Q6apGT5alr37FCRAVATPPolER2rAxnJqaFZZ2aygUL7DXeuv7Stp6Y0BWlhZEs87lx7n1VSxa5KZy4r9akFWOgBp8MkqaHisiKkSllJ69o4Zlqywjb7UH8LYvZA2SX"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5f6d56840afc1e75-AMS
expires
Mon, 23 Nov 2020 19:31:16 GMT
engine.js
qd.admetricspro.com/js/threatpost/
28 KB
8 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/engine.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a912 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:14 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
334
cf-request-id
069834668300001e75c0902000000001
last-modified
Fri, 09 Oct 2020 03:25:52 GMT
server
cloudflare
etag
W/"6e56-5b1348179d4a3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UjRQkmX0o5k5ReSpUAOt%2Fkv79GtRwtHzZlPLUHjfAR6HFJXb176kYAHCrgQUom4ymsOdYQAAD06bEwu9iifuBoKJ17pWLF%2BmMKP%2BDHm1W4KRCAcXZ1OB4dCKa05EMICa"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5f6d56840af81e75-AMS
expires
Mon, 23 Nov 2020 19:31:17 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
89 KB
18 KB
Stylesheet
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cda18822
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:f600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:15 GMT
content-encoding
gzip
x-amz-cf-pop
PRG50-C1
x-cache
Miss from cloudfront
content-length
18335
x-cache-hit
HIT
last-modified
Mon, 16 Nov 2020 08:54:38 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
TaodMxhomJ5p4uU8eGFM_AOMyYDsDW9sqEylhinDxC18SGptAM0xRQ==
expires
Tue, 24 Nov 2020 18:51:16 GMT
jquery.js
threatpost.com/wp-includes/js/jquery/
95 KB
37 KB
Script
General
Full URL
https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:16 GMT
Content-Encoding
gzip
Last-Modified
Fri, 30 Oct 2020 20:48:12 GMT
Server
nginx
ETag
W/"5f9c7c0c-17a69"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 30 Nov 2020 19:36:16 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
177 KB
55 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=cda18822
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:f600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:15 GMT
content-encoding
gzip
x-amz-cf-pop
PRG50-C1
x-cache
Miss from cloudfront
content-length
56256
x-cache-hit
HIT
last-modified
Mon, 16 Nov 2020 08:54:43 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
GXsiFJzDjyXtgtcdRdQTqn7yeb51t1wRDhmNtRlV4Hvl144YOSmz4A==
expires
Tue, 24 Nov 2020 18:51:14 GMT
biden.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/11/23100432/
26 KB
27 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/11/23100432/biden.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7e2b6ba6b43baa77a399ba464c6f0dba1b6d3ebd1c47c63f896db4990d5aaec1

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 16:47:41 GMT
via
1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Mon, 23 Nov 2020 15:04:34 GMT
server
AmazonS3
age
10118
etag
"43288c32431222ef1f9673e71fff6999"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
DUS51-C1, PRG50-C1
accept-ranges
bytes
content-length
27097
x-amz-cf-id
6YFNFvyqt3YpWJmznjciDzCmX5_7yzQRz-NCz5ZBCq8uaIRG3oR7yw==
expires
Tue, 23 Nov 2021 15:04:32 GMT
api.js
www.google.com/recaptcha/
850 B
646 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?hl=en
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
c78896aa2332cad7be8eb1777485215b07f69cef8a4394c16ad1ce16c8cdcd43
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
554
x-xss-protection
1; mode=block
expires
Mon, 23 Nov 2020 19:36:18 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
2 KB
1 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=cda18822
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:f600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
gzip
x-amz-cf-pop
PRG50-C1
x-cache
Miss from cloudfront
content-length
926
x-cache-hit
HIT
last-modified
Mon, 16 Nov 2020 08:54:37 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
ZB10NScUe9uMRukYFNHgx_c63Y5zBq-UTEISy-VEy4kRc14NzW-p8g==
expires
Tue, 24 Nov 2020 18:51:25 GMT
gravityforms.min.js
threatpost.com/wp-content/plugins/gravityforms/js/
34 KB
12 KB
Script
General
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:22 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Nov 2020 08:54:37 GMT
Server
nginx
ETag
W/"5fb23e4d-88c2"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 30 Nov 2020 19:36:22 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
7 KB
3 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=cda18822
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:f600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
gzip
x-amz-cf-pop
PRG50-C1
x-cache
Miss from cloudfront
content-length
2685
x-cache-hit
HIT
last-modified
Mon, 16 Nov 2020 08:54:40 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
WpbTlu7zJdKSQ3u75CUDZVgpi-I7dvBA8q4fzMXh_3LiVgexGnv1kA==
expires
Tue, 24 Nov 2020 18:51:25 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
5 KB
2 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=cda18822
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:f600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
gzip
x-amz-cf-pop
PRG50-C1
x-cache
Miss from cloudfront
content-length
1747
x-cache-hit
HIT
last-modified
Mon, 16 Nov 2020 08:54:40 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
R1J7UbC8cLKUaOsA4wkvjb0Ujr3SIokzLRvmCR2wJVrkNkcW2t_RTg==
expires
Tue, 24 Nov 2020 18:51:35 GMT
api.js
www.google.com/recaptcha/
852 B
950 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.5.3
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
23f267f8e1e0f0f70fc22b27c94516289d946b212e5805e4574c76e3e1ce791e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
555
x-xss-protection
1; mode=block
expires
Mon, 23 Nov 2020 19:36:18 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
2 KB
1 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=cda18822
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:f600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
gzip
x-amz-cf-pop
PRG50-C1
x-cache
Miss from cloudfront
content-length
973
x-cache-hit
HIT
last-modified
Fri, 30 Oct 2020 20:48:12 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
a3WnQPkOP3Jp5aVKYmCvLzp0x57WIFFa8-QeCrq5-6sZn6W5G1PvbA==
expires
Tue, 24 Nov 2020 18:51:22 GMT
b-9a4f7ce-a7f6098c.js
tagan.adlightning.com/math-aids-threatpost/
61 KB
21 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 18 Nov 2020 02:53:27 GMT
content-encoding
gzip
age
492171
x-cache
Hit from cloudfront
content-length
20808
x-amz-meta-git_commit
9a4f7ce
last-modified
Tue, 18 Aug 2020 17:45:57 GMT
server
AmazonS3
etag
"98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id
PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via
1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
uD8H543YgPMBxpWNItfxk_MRSinPd8f9THoBaPad8G_dx12h-Km1Ow==
bl-04a3385-54ec09d8.js
tagan.adlightning.com/math-aids-threatpost/
89 KB
26 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-54ec09d8.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7b74cfb5202288f56ae2eebc0bde0ddf144951f96cf49447d1cb0682fe20e1b7

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 16:58:28 GMT
content-encoding
gzip
age
9471
x-cache
Hit from cloudfront
content-length
26656
x-amz-meta-git_commit
04a3385
last-modified
Mon, 23 Nov 2020 16:57:45 GMT
server
AmazonS3
etag
"2f01427e7dc48cd7fee2958bcc67ab0e"
x-amz-version-id
Wpt7pdoTEhO7HkyBfMrgq7Ms65L0pYBQ
via
1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
5YZzdlvpRnIL7ZluOlIY9Lv8jiAYbPmDthuIm24vQoq-_RKINSbHFg==
pubads_impl_2020111701.js
securepubads.g.doubleclick.net/gpt/
277 KB
98 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js?21068792
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
sffe /
Resource Hash
68963209b16bd2a387c310495d51021d2fc57e5df9cb87ac98a0505c0daeca43
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 17 Nov 2020 09:43:24 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
99766
x-xss-protection
0
expires
Mon, 23 Nov 2020 19:36:18 GMT
vendor-list.json
qd.admetricspro.com/js/cmp2/
286 KB
29 KB
XHR
General
Full URL
https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a912 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Tue, 06 Oct 2020 19:31:27 GMT
server
cloudflare
etag
W/"4773b-5b105a5302c6b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MXLBYK%2FGBxDmqmk3FvUKgeR16W6%2FTHiGk1G166%2FUaouXrsk382qwSskzbaoyK%2BhkjJFel6%2BbC6Ri7M0u1%2BFJU5LaxAbZGLbPFN0mwLvFdShV7vRYTSUou3rZmNC2UKwI"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=600
cf-ray
5f6d569c1a1b9bf7-AMS
cf-request-id
069834759100009bf7e6909000000001
expires
Mon, 23 Nov 2020 19:46:18 GMT
apstag.js
c.amazon-adsystem.com/aax2/
114 KB
29 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.83.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c7714be5150899442faf570cab4e7846a794e81d6b420300148d1f5a9a405c7a

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:25:06 GMT
content-encoding
gzip
server
Server
age
671
etag
14b87a812615d68493a97e70b7b323fb
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 cc03ea6a31b592e93e84115778cdc495.cloudfront.net (CloudFront)
cache-control
public, max-age=900
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
viRiRVi01gUB1vLYFyr9R99bxK33QFdLJ5mjNMo_0hMFVBdwb12Shg==
connatix.player.dc.js
cds.connatix.com/p/78152/ Frame 6033
Redirect Chain
  • https://cd.connatix.com/connatix.player.js
  • https://cds.connatix.com/p/78152/connatix.player.dc.js
917 KB
227 KB
Script
General
Full URL
https://cds.connatix.com/p/78152/connatix.player.dc.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c5f426d657f5ac25b6cf1862496b4f0d0503f04d3487b12748a45d75c872cbb4

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
via
1.1 varnish, 1.1 varnish
age
268526
x-cache
HIT, HIT
content-encoding
gzip
content-length
231597
x-served-by
cache-dca17739-DCA, cache-hhn4062-HHN
last-modified
Fri, 20 Nov 2020 15:42:20 GMT
x-timer
S1606160179.805883,VS0,VE0
etag
"73f5275ca5ab2821b815aa6a925cb110"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
1, 11725

Redirect headers

date
Mon, 23 Nov 2020 19:36:18 GMT
via
1.1 varnish
server
Varnish
age
0
x-served-by
cache-hhn4062-HHN
x-cache
HIT
location
https://cds.connatix.com/p/78152/connatix.player.dc.js
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
x-timer
S1606160179.740917,VS0,VE0
content-length
0
retry-after
0
x-cache-hits
0
/
kasperskycontenthub.com/
0
398 B
Script
General
Full URL
https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=535438431&back=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 19:36:23 GMT
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
SAMEORIGIN
Connection
close
Content-Type
application/javascript
x-cache-hit
HIT
Transfer-Encoding
chunked
X-Debug-Auth
off
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Request-Host
kasperskycontenthub.com
X-XSS-Protection
1; mode=block
gtm.js
www.googletagmanager.com/
156 KB
49 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2bab31de4ae3bc2852ac72af9f3b6f7391783e64baba437711b8cf70859ccdbe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
50478
x-xss-protection
0
last-modified
Mon, 23 Nov 2020 18:46:39 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 23 Nov 2020 19:36:18 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/
13 KB
5 KB
Other
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:23 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Nov 2020 08:54:42 GMT
Server
nginx
ETag
W/"5fb23e52-3496"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 30 Nov 2020 19:36:23 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/
13 KB
5 KB
Other
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:23 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Nov 2020 08:54:42 GMT
Server
nginx
ETag
W/"5fb23e52-3496"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 30 Nov 2020 19:36:23 GMT
logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
19 KB
19 KB
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:20 GMT
Last-Modified
Mon, 16 Nov 2020 08:54:38 GMT
Server
nginx
ETag
"5fb23e4e-4a32"
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
close
Accept-Ranges
bytes
Content-Length
18994
Expires
Mon, 30 Nov 2020 19:36:20 GMT
museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
20 KB
21 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:19 GMT
Last-Modified
Mon, 16 Nov 2020 08:54:42 GMT
Server
nginx
ETag
"5fb23e52-51a4"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20900
Expires
Tue, 23 Nov 2021 19:36:19 GMT
museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
20 KB
21 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:19 GMT
Last-Modified
Mon, 16 Nov 2020 08:54:42 GMT
Server
nginx
ETag
"5fb23e52-50c8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20680
Expires
Tue, 23 Nov 2021 19:36:19 GMT
museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
20 KB
21 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:19 GMT
Last-Modified
Mon, 16 Nov 2020 08:54:38 GMT
Server
nginx
ETag
"5fb23e4e-51b8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20920
Expires
Tue, 23 Nov 2021 19:36:19 GMT
museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
20 KB
21 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:20 GMT
Last-Modified
Mon, 16 Nov 2020 08:54:42 GMT
Server
nginx
ETag
"5fb23e52-5194"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20884
Expires
Tue, 23 Nov 2021 19:36:20 GMT
0.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/
10 KB
11 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/0.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 19 Sep 2020 01:31:54 GMT
via
1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Mon, 20 Aug 2018 15:57:19 GMT
server
AmazonS3
age
5681065
etag
"756a0525b47f4557fdfec408731afd91"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1, PRG50-C1
accept-ranges
bytes
content-length
10662
x-amz-cf-id
LLQhtF7BTZcTTam9cT6QEUc1xMYRmICD3C9VAzzzTb8Xx3KqMZ70AA==
expires
Tue, 20 Aug 2019 15:57:18 GMT
Hacked-Biden-Site-Get-Out-The-Vote-300x182.png
media.threatpost.com/wp-content/uploads/sites/103/2020/11/23114111/
61 KB
61 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/11/23114111/Hacked-Biden-Site-Get-Out-The-Vote-300x182.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
793d64ca1fe1d76f1e3d56f5b7e35dc85390385f6523a7dc1aeb91a2065070bf

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 16:48:28 GMT
via
1.1 e8b17f734954ee4d46d26cf302323482.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Mon, 23 Nov 2020 16:41:13 GMT
server
AmazonS3
age
10071
etag
"b2e575e8edcc264d730673cb9deed9a3"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1, PRG50-C1
accept-ranges
bytes
content-length
62173
x-amz-cf-id
ihaLZcPWBhcGXD4OQop5SQ-HCDmFrMO_5Q7Q8LqmfWKAwZRfiyFeHQ==
expires
Tue, 23 Nov 2021 16:41:11 GMT
subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/
8 KB
9 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 08:11:35 GMT
via
1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Tue, 19 Feb 2019 20:14:58 GMT
server
AmazonS3
age
5397884
etag
"5ba45563f793f39ef6baf02645651654"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, PRG50-C1
accept-ranges
bytes
content-length
8281
x-amz-cf-id
uawuyAxf5EegmjR3KtjtgRE98o7AUP7Vw6bfjXSByNaR-CRVG17KIg==
expires
Wed, 19 Feb 2020 20:14:57 GMT
joe-biden-website-hack-300x231.png
media.threatpost.com/wp-content/uploads/sites/103/2020/11/23100144/
23 KB
24 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/11/23100144/joe-biden-website-hack-300x231.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
108a5b54d35314e05ef92a087286618e06d9dc1cdec3ad9e7c5055731b3619a7

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 16:48:28 GMT
via
1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Mon, 23 Nov 2020 15:01:46 GMT
server
AmazonS3
age
10071
etag
"1896f6a2037d0ad7adb98079a21f09e3"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1, PRG50-C1
accept-ranges
bytes
content-length
23716
x-amz-cf-id
KfF9y2R9ht2FrbImyiUpzzIA5-46SLS7MEgZa8LN3VoIQM4NLel-kw==
expires
Tue, 23 Nov 2021 15:01:44 GMT
voting-540x270.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/
20 KB
20 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/voting-540x270.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
66e069239bcb31dfe981b4c7ff9181f626513d638bf79cec2e43df62bafd4d12

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 13:48:13 GMT
via
1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Thu, 20 Aug 2020 19:26:03 GMT
server
AmazonS3
age
2872086
etag
"db34b329055c6feea937dd80599a7b28"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1, PRG50-C1
accept-ranges
bytes
content-length
20204
x-amz-cf-id
hym9RASfvikN1gSyiXqqNQN7qzM-Tx99VCd6kZSi-J43UlD7yJ58BA==
expires
Fri, 20 Aug 2021 19:26:00 GMT
presidential-election-500x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/16153157/
33 KB
33 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/16153157/presidential-election-500x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d375305f3ed36872d856c127f8c6e9526f06d2cd46293aea783cf184cdcf0bd7

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 22 Oct 2020 01:38:07 GMT
via
1.1 a10d58b5ce965502cc34c5b27682fe23.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Fri, 16 Oct 2020 19:32:01 GMT
server
AmazonS3
age
2829492
etag
"99018cdb7ef1272299ee5121366b7501"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, PRG50-C1
accept-ranges
bytes
content-length
33434
x-amz-cf-id
O_8EMpRBKrah5tV3iM5STWAQiDw_pPXfHJhvVayKbUKslyj19VIylg==
expires
Sat, 16 Oct 2021 19:32:00 GMT
Iran-APT-Hacking-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/03/11152945/
53 KB
53 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/03/11152945/Iran-APT-Hacking-540x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2dee7e97dcfbe2728fae1dece91c1760cbb16fc1d8c9d744a8af916c3c7fbada

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 21 Nov 2020 19:37:47 GMT
via
1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Mon, 11 Mar 2019 19:29:48 GMT
server
AmazonS3
age
172712
etag
"7fb4c0036222013005030aa76da75890"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1, PRG50-C1
accept-ranges
bytes
content-length
54216
x-amz-cf-id
tmD0R4P9IUIK3X3wxtSG1cN9_ZOmoWFaEhn72BpABWp8YSronozuXw==
expires
Tue, 10 Mar 2020 19:29:45 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/UFwvoDBMjc8LiYc1DKXiAomK/
335 KB
131 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/UFwvoDBMjc8LiYc1DKXiAomK/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
14a2806a256579773a3680e21459dea7827d002104c6336856e0bef9a39be0c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:20:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
976
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
133988
x-xss-protection
0
last-modified
Mon, 16 Nov 2020 01:06:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 23 Nov 2021 19:20:02 GMT
mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
828 B
722 B
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:22 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Nov 2020 08:54:38 GMT
Server
nginx
ETag
W/"5fb23e4e-33c"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 30 Nov 2020 19:36:22 GMT
twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
868 B
847 B
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:20 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Nov 2020 08:54:38 GMT
Server
nginx
ETag
W/"5fb23e4e-364"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 30 Nov 2020 19:36:20 GMT
museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
15 KB
16 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:20 GMT
Last-Modified
Mon, 16 Nov 2020 08:54:42 GMT
Server
nginx
ETag
"5fb23e52-3dcc"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
15820
Expires
Tue, 23 Nov 2021 19:36:20 GMT
holiday-shopping-1-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/11/19142358/
2 KB
3 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/11/19142358/holiday-shopping-1-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
20e0a2f0989b9e191d329c856ac973fce762959f59ad4f170c3ec87d3ebf89c9

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 19 Nov 2020 19:26:24 GMT
via
1.1 375e9ad5042f2098d2251daf2e517c52.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Thu, 19 Nov 2020 19:24:01 GMT
server
AmazonS3
age
346195
etag
"873487b5ffc87dc8439585cbf02c7a00"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
DUS51-C1, PRG50-C1
accept-ranges
bytes
content-length
2170
x-amz-cf-id
nyus1rWDtwpg-POdO3F3GwAuavE0kKd4dxq9ywBJnu-l2xVIEb49Ww==
expires
Fri, 19 Nov 2021 19:24:00 GMT
Work-from-Home-WFH-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/04/03174818/
2 KB
2 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/04/03174818/Work-from-Home-WFH-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
851913072ba36e6383ee40856fa3dea9ed4c5f03b4e3effb6a3841aab3840d26

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 21:34:39 GMT
via
1.1 03d509e8374e9f42668961b5e0201349.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Fri, 03 Apr 2020 21:48:22 GMT
server
AmazonS3
age
511300
etag
"8935e353d0d7393d74a9d2a3c8feec32"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, PRG50-C1
accept-ranges
bytes
content-length
2024
x-amz-cf-id
4hX-u-EhxPlmrAb9TeZxwLg8vLvCQoAxoRr8IWbE2g3IMQ5Fh4OHwg==
expires
Sat, 03 Apr 2021 21:48:21 GMT
darknet-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/11/12130957/
2 KB
2 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/11/12130957/darknet-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
500ea20f87ce27337a9d5c8171fb14b2bac878489809c0ce19358cb5eb051863

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 12 Nov 2020 18:13:21 GMT
via
1.1 216b2e0a8a27f8fca1b540a1c4ea6922.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Thu, 12 Nov 2020 18:10:14 GMT
server
AmazonS3
age
955377
etag
"10b58b41fb2dec5da5a3bacfed3dde87"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, PRG50-C1
accept-ranges
bytes
content-length
1701
x-amz-cf-id
D9wnsJqvA3oapX2EonjZ3jx6OP-zIuLZiUEBzVxqMLnBcFMcgvGd7Q==
expires
Fri, 12 Nov 2021 18:10:11 GMT
Trump-Biden-Cyberattacks-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/10160904/
3 KB
3 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/10160904/Trump-Biden-Cyberattacks-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e9508ba7940744f67cae3678cec9deeb32fa61111365ff6366fd7e28dbb4c00b

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 13:33:00 GMT
via
1.1 51054083366f59cdc509361d23d873eb.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Thu, 10 Sep 2020 20:09:08 GMT
server
AmazonS3
age
2268199
etag
"02d819dba7c37960134535d631118aeb"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
DUS51-C1, PRG50-C1
accept-ranges
bytes
content-length
2847
x-amz-cf-id
tFS_EOlr9usL3d761nXWwRFUpNGd-7RHadmNTS86bCnTLuTRXMFijA==
expires
Fri, 10 Sep 2021 20:09:07 GMT
voting-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/
2 KB
2 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/voting-64x64.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:b800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
680c268c211b81fee63bd2133ddeca118e1bb9ba9f5ad107e98b3c4d230bf28c

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 13:48:50 GMT
via
1.1 21da0a66bafe2c8de8be4a4d8039346b.cloudfront.net (CloudFront), 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified
Thu, 20 Aug 2020 19:26:03 GMT
server
AmazonS3
age
2872049
etag
"9293f3ef83c25d01935212cace875cd7"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1, PRG50-C1
accept-ranges
bytes
content-length
2112
x-amz-cf-id
TeEga2rYU08M-0i0qU_oC5JtBVAyzxLAie5F0pDzHU6H1maNjsMDRg==
expires
Fri, 20 Aug 2021 19:26:00 GMT
mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
812 B
722 B
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:23 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Nov 2020 08:54:38 GMT
Server
nginx
ETag
W/"5fb23e4e-32c"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 30 Nov 2020 19:36:23 GMT
logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
10 KB
10 KB
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1605516879
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Mon, 23 Nov 2020 19:36:24 GMT
Last-Modified
Mon, 16 Nov 2020 08:54:38 GMT
Server
nginx
ETag
"5fb23e4e-260a"
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
close
Accept-Ranges
bytes
Content-Length
9738
Expires
Mon, 30 Nov 2020 19:36:24 GMT
analytics.js
www.google-analytics.com/
46 KB
18 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
6414
date
Mon, 23 Nov 2020 17:49:24 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Mon, 23 Nov 2020 19:49:24 GMT
quant.js
secure.quantserve.com/
23 KB
9 KB
Script
General
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
content-encoding
gzip
etag
"O/+l6c17R2TQ0JQMJXOiXA=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Mon, 30 Nov 2020 19:36:18 GMT
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.56.157 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
via
1.1 varnish
last-modified
Wed, 21 Oct 2020 21:46:56 GMT
age
56720
etag
"a4cc3f907681b24a3efd540acd5d2996+gzip"
vary
Accept-Encoding,Host
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding
gzip
cache-control
no-cache
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
1958
x-timer
S1606160179.892300,VS0,VE0
x-served-by
cache-lon4229-LON
collect
www.google-analytics.com/j/
2 B
125 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=65303539&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&ul=en-us&de=UTF-8&dt=Joe%20Biden%20Campaign%20Subdomain%20Down%20After%20Hacktivist%20Defacement%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1629794487&gjid=1134136386&cid=1298927106.1606160179&tid=UA-35676203-21&_gid=925180063.1606160179&_r=1&gtm=2wgb41PM29HLF&z=1861024934
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
384 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j87&aip=1&a=65303539&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&ul=en-us&de=UTF-8&dt=Joe%20Biden%20Campaign%20Subdomain%20Down%20After%20Hacktivist%20Defacement%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=aEDAAEABAAAAAC~&jid=&gjid=&cid=1298927106.1606160179&tid=UA-35676203-21&_gid=925180063.1606160179&gtm=2wgb41PM29HLF&z=725400314
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 09:11:24 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
37494
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
rules-p-_7kVx0t9Jqj90.js
rules.quantcount.com/
3 B
345 B
Script
General
Full URL
https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:c000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:03 GMT
via
1.1 8dfd7af0583283ff28c8cd8eea759112.cloudfront.net (CloudFront)
last-modified
Fri, 03 Mar 2017 23:52:35 GMT
server
AmazonS3
age
15
etag
"8a80554c91d9fca8acb82f023de02f11"
x-cache
Error from cloudfront
content-type
application/x-javascript
cache-control
max-age=300
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-length
3
x-amz-cf-id
r47Mrp1OyZKrXicWg0QJ4xnRp7lIsPKV8LpKxAz0Y6hy2A_smujaGA==
c
prebid.a-mo.net/a/
0
0

auction
tlx.3lift.com/header/
0
0

adreq
ads.servenobid.com/
317 B
466 B
XHR
General
Full URL
https://ads.servenobid.com/adreq?cb=5768
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.241.206.146 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-241-206-146.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e8347b75be6fd8c8526f52623bf351ff37e10b34e1f93f243d5e80adeffb36c8

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 23 Nov 2020 19:36:19 GMT
content-encoding
gzip
amp-access-control-allow-source-origin
*
vary
accept-encoding
content-type
application/json
access-control-allow-origin
https://threatpost.com
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/
3 KB
3 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&tk_flint=pbjs_lite_v4.10.0&x_source.tid=ba3be094-91ba-4bfa-b0e2-e5457f4599ce&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7629220645970056
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
213.19.162.21 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
002539c8b67a8dcba1567e0a369c186e84bd6f779dc53c012be418bd513a9d53

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:19 GMT
Content-Encoding
gzip
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
1494
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
261 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&tk_flint=pbjs_lite_v4.10.0&x_source.tid=63e6bc51-7f89-4fd8-b8af-43ed69de0729&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.3806785512860411
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
213.19.162.21 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
0d36e9f65303fb5fca63264528bec52308d095d45643e31b4b4010492471cde7

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:19 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
261
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
261 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&tk_flint=pbjs_lite_v4.10.0&x_source.tid=dca55ee7-81ce-4a41-91e1-72684438aaab&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.645057204690282
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
213.19.162.21 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
6b01cd562a9b13766e40baba0fda8a202be256c80a8f8f0e996f5c711ae477eb

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:19 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
261
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
3 KB
3 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&tk_flint=pbjs_lite_v4.10.0&x_source.tid=dca55ee7-81ce-4a41-91e1-72684438aaab&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.26570171132922304
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
213.19.162.21 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
79407c87fa3b28ddbe2a5a8da4288b56ffae650c65a0f412d9c6135dba6610fb

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:19 GMT
Content-Encoding
gzip
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
1494
Expires
Wed, 17 Sep 1975 21:32:10 GMT
prebid
ib.adnxs.com/ut/v3/
377 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.242 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
d78f26bfd508c24c7fb9acab5ffbdc16b6bac1c8a1a88c1b7bc0a33169341dae
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:19 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 724.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.234:80
AN-X-Request-Uuid
11dd6549-a929-4d62-86fe-131e533dd8a1
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
377
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ADTECH;apid=1A28bc8332-2dc3-11eb-a345-12359aeea65a;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=57f498a42b7f574;misc=1606160178836
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=57f498a42b7f574;misc=1606160178836;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=57f498a42b7f574;misc=1606160178836
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A28bc8332-2dc3-11eb-a345-12359aeea65a;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=57f498a42b7f574;misc=16...
48 B
105 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A28bc8332-2dc3-11eb-a345-12359aeea65a;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=57f498a42b7f574;misc=1606160178836
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
c6453a5d60448b555f3cd9dd5a63c380e99ee5a979dcaa30b678a394ded64853

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
Adtech Adserver
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
48
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
nginx
access-control-allow-origin
https://threatpost.com
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A28bc8332-2dc3-11eb-a345-12359aeea65a;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=57f498a42b7f574;misc=1606160178836
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=582fafa93e64a4c;misc=1606160178836
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=582fafa93e64a4c;misc=1606160178836;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=582fafa93e64a4c;misc=1606160178836
47 B
80 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=582fafa93e64a4c;misc=1606160178836
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
e0258b52cde21505c28c3fb5e5a0f57d885ebdb51238f6eb4674b0f134087152

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
Adtech Adserver
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
47
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
nginx
access-control-allow-origin
https://threatpost.com
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=582fafa93e64a4c;misc=1606160178836
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A28bc74aa-2dc3-11eb-b09b-1204ea82ed4e;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=5942fe4d33925b6;misc=1606160178836
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5942fe4d33925b6;misc=1606160178836;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=5942fe4d33925b6;misc=1606160178836
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A28bc74aa-2dc3-11eb-b09b-1204ea82ed4e;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=5942fe4d33925b6;misc=16...
48 B
81 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A28bc74aa-2dc3-11eb-b09b-1204ea82ed4e;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=5942fe4d33925b6;misc=1606160178836
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
b130407e9b5a4d4118bb2102f7471f64d4ccdc3e82ca41cf977bd5b650ea13ce

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
Adtech Adserver
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
48
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
nginx
access-control-allow-origin
https://threatpost.com
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A28bc74aa-2dc3-11eb-b09b-1204ea82ed4e;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=5942fe4d33925b6;misc=1606160178836
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A28bc9b4c-2dc3-11eb-bb95-123ff9725662;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=60b8e409ab6bb63;misc=1606160178836
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60b8e409ab6bb63;misc=1606160178836;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=60b8e409ab6bb63;misc=1606160178836
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A28bc9b4c-2dc3-11eb-bb95-123ff9725662;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=60b8e409ab6bb63;misc=16...
48 B
207 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A28bc9b4c-2dc3-11eb-bb95-123ff9725662;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=60b8e409ab6bb63;misc=1606160178836
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
3335310f84fb019df38445d5b7a2297f0e6380b1c0bbca72c511cd8f6d8490ea

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
Adtech Adserver
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
x-adtech-meta
{"Debug": {"IP": "0.0.0.0", "Selector": "pri-select028c.us-east-1.prod.adtech.aolcloud.net", "UserId": "D8DDE792F0A8168F13D9A533F6B7E6BB"}}
content-length
48
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
nginx
access-control-allow-origin
https://threatpost.com
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A28bc9b4c-2dc3-11eb-bb95-123ff9725662;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=60b8e409ab6bb63;misc=1606160178836
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1A28bca132-2dc3-11eb-abd1-125139b028ba;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=6192c820d1a432d;misc=1606160178836
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=6192c820d1a432d;misc=1606160178836;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1606160177;v=2;cmd=bid;cors=yes;alias=6192c820d1a432d;misc=1606160178836
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A28bca132-2dc3-11eb-abd1-125139b028ba;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=6192c820d1a432d;misc=16...
48 B
81 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A28bca132-2dc3-11eb-abd1-125139b028ba;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=6192c820d1a432d;misc=1606160178836
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
afd9d52a8fba416f31782a28e1d926a02da0f16dc29c2bd9758dc8fb11065059

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
Adtech Adserver
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
48
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
server
nginx
access-control-allow-origin
https://threatpost.com
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A28bca132-2dc3-11eb-abd1-125139b028ba;cfp=1;rndc=1606160178;v=2;cmd=bid;cors=yes;alias=6192c820d1a432d;misc=1606160178836
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
cygnus
htlb.casalemedia.com/
25 B
372 B
XHR
General
Full URL
https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%22283194fcfd7da5b%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22292676c9e9b47bc%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2230e96ff3fd1b9a2%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%223110117bbe104c3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22292676c9e9b47bc%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22292676c9e9b47bc%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2230e96ff3fd1b9a2%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%223110117bbe104c3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.84.150 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a184-31-84-150.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9dfe387f4408128179039e002abd0ed21586a541626fbacc78f39a628d0c0da2

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
content-encoding
gzip
x-ak-initial-geo
CC:[DE], RC:[HE], CN:[EU], CIP:[89.249.64.171], XFF:[]
server
Apache
vary
Is-Traffic-Invalid,Accept-Encoding
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
45
x-ak-client-geo
12
expires
Mon, 23 Nov 2020 19:36:19 GMT
prebid
ib.adnxs.com/ut/v3/
376 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.242 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
32ac93f088da95e3c235c4b0af314bc0bab70eb1a3a7bc115266a60286a4bb5d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:19 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 724.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.180:80
AN-X-Request-Uuid
ba4af226-ccfb-478c-8976-d8a84ede4815
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
376
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
arj
teachingaids-d.openx.net/w/1.0/
174 B
560 B
XHR
General
Full URL
https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=ba3be094-91ba-4bfa-b0e2-e5457f4599ce%2Cba3be094-91ba-4bfa-b0e2-e5457f4599ce%2C63e6bc51-7f89-4fd8-b8af-43ed69de0729%2Cdca55ee7-81ce-4a41-91e1-72684438aaab%2Cdca55ee7-81ce-4a41-91e1-72684438aaab&nocache=1606160178841&gdpr=0&x_gdpr_f=1&pubcid=5aac7af6-4944-4ce3-a4d8-b07f8a17d26f&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.198.0 /
Resource Hash
7553727056b7ac07d419035cabee0c33d28003f2e60c11d752bb82078eb97c8f

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:19 GMT
content-encoding
gzip
server
OXGW/16.198.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
bid
ap.lijit.com/rtb/
0
0

v2
e.serverbid.com/api/
16 B
168 B
XHR
General
Full URL
https://e.serverbid.com/api/v2
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.189.254.17 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 23 Nov 2020 19:36:19 GMT
access-control-allow-credentials
true
content-length
16
vary
Origin
content-type
application/json
translator
hbopenbid.pubmatic.com/
0
115 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 23 Nov 2020 19:36:18 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
collect
stats.g.doubleclick.net/j/
4 B
87 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-35676203-21&cid=1298927106.1606160179&jid=1629794487&gjid=1134136386&_gid=925180063.1606160179&_u=YEBAAEAAAAAAAC~&z=1735797643
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Mon, 23 Nov 2020 19:36:18 GMT
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
254 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-35676203-21&cid=1298927106.1606160179&jid=1629794487&_u=YEBAAEAAAAAAAC~&z=217317712
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-35676203-21&cid=1298927106.1606160179&jid=1629794487&_u=YEBAAEAAAAAAAC~&z=217317712
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/i/
43 B
369 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
120
pragma
no-cache
last-modified
Mon, 23 Nov 2020 19:36:18 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
ad98caca2d543e7604ebc8eaf9356a65
x-transaction
00bd954a008d20dd
expires
Tue, 31 Mar 1981 05:00:00 GMT
connatix.player.css
cds.connatix.com/p/78152/
53 KB
9 KB
Stylesheet
General
Full URL
https://cds.connatix.com/p/78152/connatix.player.css
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
db2df5e70bea6b4585b510f0ea07d9498f0c6f3dc6fd0078038e51ae542cfdf6

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:18 GMT
via
1.1 varnish, 1.1 varnish
age
268528
x-cache
HIT, HIT
content-encoding
gzip
content-length
8723
x-served-by
cache-dca17733-DCA, cache-hhn4062-HHN
last-modified
Fri, 20 Nov 2020 15:42:20 GMT
x-timer
S1606160179.984611,VS0,VE0
etag
"fb9cb3e26c475cf4c198618dbf3c0a99"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
2, 16819
pixel;r=654532586;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F;fpan=1;fpa=P0-2139204483-16...
pixel.quantserve.com/
35 B
371 B
Image
General
Full URL
https://pixel.quantserve.com/pixel;r=654532586;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F;fpan=1;fpa=P0-2139204483-1606160178978;ns=0;ce=1;qjs=1;qv=3364aec3-20201006003021;cm=;gdpr=0;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=1;et=1606160178977;tzo=-60;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F11%2F23100432%2Fbiden%2Ctype.article%2Ctitle.Joe%20Biden%20Campaign%20Subdomain%20Down%20After%20Hacktivist%20Defacement%2Cdescription.A%20Turkish%20hacktivist%20defaced%20a%20subdomain%20of%20the%20president-elect's%20campaign%20websi%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:18 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
pls
capi.connatix.com/core/ Frame 6033
7 KB
3 KB
XHR
General
Full URL
https://capi.connatix.com/core/pls?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
33b62a958618646e3ba06a9c0ea0469c5351879639c9c03503c2dcff08c5122e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:19 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
transfer-encoding
chunked
Connection
keep-alive
Access-Control-Allow-Credentials
true
bid
c.amazon-adsystem.com/e/dtb/
23 B
369 B
XHR
General
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&pid=h1j6pCJKUnEo3&cb=0&ws=1600x1200&v=7.57.00&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.83.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:19 GMT
via
1.1 cc03ea6a31b592e93e84115778cdc495.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
AMS1-C1
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
o2LVNQgwb5sbQQVRsHkvDp1iJTn4zsXEd2RlOJXx4429WFT-dq9fgQ==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.83.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 01:25:44 GMT
content-encoding
gzip
vary
Origin
age
65436
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Wed, 30 Sep 2020 05:43:29 GMT
server
AmazonS3
etag
"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 043fc2faaa02eeb59193e3fa300adb6b.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
AMS1-C1
x-amz-cf-id
NDg8Pe5OURi-zv7r5456y40vu00NGAsc47ZLlxvkbarCLqqxGx4T8g==
g_pbto
1x1.a-mo.net/hbx/
0
89 B
Image
General
Full URL
https://1x1.a-mo.net/hbx/g_pbto?A=undefined&bid=undefined&a=undefined&cn=undefined&aud=undefined&ts=1606160180029&eid=65c732521d5271f
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.158.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-226-158-15.compute-1.amazonaws.com
Software
MonetEngine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:20 GMT
cache-control
max-age=0, private, must-revalidate
server
MonetEngine
sr
capi.connatix.com/tr/ Frame 6033
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/sr?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:21 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
3_media.bin
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 6033
232 B
468 B
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/3_media.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:20 GMT
content-encoding
gzip
last-modified
Thu, 17 Sep 2020 01:42:41 GMT
age
1564236
etag
"796c77896c9738780ae744fd3eb73483"
x-served-by
cache-bwi5141-BWI, cache-hhn4027-HHN
vary
Accept-Encoding
x-cache
HIT, HIT
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1606160180.278064,VS0,VE1
content-length
204
x-cache-hits
1, 1
1.png
img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/
6 KB
7 KB
Image
General
Full URL
https://img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7c00:12:238e:df80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 18 Nov 2020 10:28:54 GMT
content-encoding
gzip
age
802593
x-cache
Hit from cloudfront
fastly-io-info
ifsz=8114 idim=288x42 ifmt=png ofsz=6487 odim=288x42 ofmt=png
fastly-stats
io=1
content-length
6510
x-served-by
cache-dca17770-DCA, cache-hhn4082-HHN
access-control-allow-origin
*
x-timer
S1605695334.394086,VS0,VE0
etag
"CDlq0wWU2N6Hha9Y1OkqKS7K/JyWAUvXYL5GlZ2se8g"
content-type
image/png
via
1.1 varnish, 1.1 varnish, 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
cache-control
max-age=31557600
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
IngvbuysdQTmckGDIfpQ3RoSS-rWD2bL8pVy76skYuORUdyCfd4w7w==
x-cache-hits
1, 1
1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/
4 KB
4 KB
Image
General
Full URL
https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7c00:12:238e:df80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
5d0e7d0bd8b4693b10239e9be46c2c8d5cfc6053c41dd8775abee4a305b2ce53

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 18 Nov 2020 10:28:54 GMT
content-encoding
gzip
age
982592
x-cache
Hit from cloudfront
fastly-io-info
ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=4042 odim=400x225 ofmt=jpeg
fastly-stats
io=1
content-length
3173
x-served-by
cache-dca17731-DCA, cache-hhn4040-HHN
access-control-allow-origin
*
x-timer
S1605695334.393873,VS0,VE1
etag
"Ue8r77DYnq0faLiVjMHqJlMlucCvBvjb+Iz0zFQb+wA"
content-type
image/jpeg
via
1.1 varnish, 1.1 varnish, 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
cache-control
max-age=31557600
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
e46rJto71vmVzeUjzaByWqkb_slLElSJ4zvcIJYxyAtTuMlOV8YN2g==
x-cache-hits
1, 1
playlist.m3u8
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 6033
309 B
326 B
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/playlist.m3u8
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:20 GMT
content-encoding
gzip
last-modified
Mon, 07 Sep 2020 18:49:42 GMT
age
432913
etag
"8a966507b13615ecdc1330a4bc9dcfe1"
x-served-by
cache-bwi5149-BWI, cache-hhn4027-HHN
vary
Accept-Encoding
x-cache
HIT, HIT
content-type
application/x-mpegURL
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1606160180.347366,VS0,VE1
content-length
164
x-cache-hits
1, 1
0.m3u8
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 6033
5 KB
1 KB
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.m3u8
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:20 GMT
content-encoding
gzip
last-modified
Mon, 07 Sep 2020 18:49:41 GMT
age
413210
etag
"3a71266b043248350b2f39a55da8294e"
x-served-by
cache-bwi5137-BWI, cache-hhn4027-HHN
vary
Accept-Encoding
x-cache
HIT, HIT
content-type
application/x-mpegURL
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1606160180.393252,VS0,VE1
content-length
959
x-cache-hits
1, 1
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame
0
0
Other
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol
H2
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-origin
*
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Mon, 23 Nov 2020 19:36:20 GMT
x-served-by
cache-hhn4027-HHN
x-cache
HIT
x-cache-hits
0
x-timer
S1606160180.431660,VS0,VE0
cache-control
max-age=31557600
content-length
0
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 6033
1 KB
2 KB
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=0-1428

Response headers

date
Mon, 23 Nov 2020 19:36:20 GMT
last-modified
Mon, 07 Sep 2020 18:49:41 GMT
age
596489
etag
"7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by
cache-bwi5133-BWI, cache-hhn4027-HHN
x-cache
HIT, HIT
content-type
video/mp4
Content-Range
bytes 0-1428/32479190
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1606160180.460754,VS0,VE0
access-control-allow-origin
*
Content-Length
1429
x-cache-hits
1, 8615
integrator.js
adservice.google.de/adsid/
109 B
169 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 23 Nov 2020 19:36:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
109 B
169 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 23 Nov 2020 19:36:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
157 KB
27 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2158994980634465&correlator=3146400932017389&output=ldjh&impl=fifs&eid=21068749%2C21068792%2C21068418&vrg=2020111701&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201123&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D2%26amznp%3D2%26hb_adid_rubicon%3D63f338da847ad5c%26hb_bidder_rubicon%3Drubicon%26dyn_bids%3D0.01%26hb_adid%3D63f338da847ad5c%26hb_bidder%3Drubicon%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_adid_rubicon%3D64166fec34a8cf3%26hb_bidder_rubicon%3Drubicon%26dyn_bids%3D0.01%26hb_adid%3D64166fec34a8cf3%26hb_bidder%3Drubicon%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fjoe-biden-campaign-website-hacktivist-defacement%252F161471%252F%26urlquery%3Dgoogfc%26contentid%3D161471%26category%3Dhacks%26contenttags%3Dhacktivist%252Cjoe-biden%252Cjoe-biden-campaign%252Cpresident-elect%252Cturkey%252Cus-government%252Cu-s-presidential-election%252Cwebsite-defacement%252Cwebsite-hack%252Cwebsite-security&cookie_enabled=1&bc=31&abxe=1&lmt=1606160180&dt=1606160180461&dlt=1606160174676&idt=3839&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1565%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&dssz=47&icsg=167785091&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=1298927106.1606160179&ga_sid=1606160180&ga_hid=65303539&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js?21068792
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
1ba0ffbeb734055aa2cac5e125373291b24e334e4dc371d0b53b19a4d6dfd6de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:21 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26946
x-xss-protection
0
google-lineitem-id
-1,-1,-1,5283645110
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-1,-1,-1,138301519116
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
a62a15d7931cfb5f7d4beaf22f1c2f91.safeframe.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://a62a15d7931cfb5f7d4beaf22f1c2f91.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame
0
0
Other
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol
H2
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-origin
*
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Mon, 23 Nov 2020 19:36:20 GMT
x-served-by
cache-hhn4027-HHN
x-cache
HIT
x-cache-hits
0
x-timer
S1606160181.506279,VS0,VE0
cache-control
max-age=31557600
content-length
0
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 6033
444 KB
445 KB
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=1429-456334

Response headers

date
Mon, 23 Nov 2020 19:36:20 GMT
last-modified
Mon, 07 Sep 2020 18:49:41 GMT
age
596489
etag
"7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by
cache-bwi5133-BWI, cache-hhn4027-HHN
x-cache
HIT, HIT
content-type
video/mp4
Content-Range
bytes 1429-456334/32479190
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1606160181.537643,VS0,VE0
access-control-allow-origin
*
Content-Length
454906
x-cache-hits
1, 8616
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame
0
0
Other
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol
H2
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-origin
*
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Mon, 23 Nov 2020 19:36:20 GMT
x-served-by
cache-hhn4027-HHN
x-cache
HIT
x-cache-hits
0
x-timer
S1606160181.733325,VS0,VE0
cache-control
max-age=31557600
content-length
0
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 6033
390 KB
390 KB
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=456335-855191

Response headers

date
Mon, 23 Nov 2020 19:36:20 GMT
last-modified
Mon, 07 Sep 2020 18:49:41 GMT
age
596489
etag
"7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by
cache-bwi5133-BWI, cache-hhn4027-HHN
x-cache
HIT, HIT
content-type
video/mp4
Content-Range
bytes 456335-855191/32479190
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1606160181.769744,VS0,VE0
access-control-allow-origin
*
Content-Length
398857
x-cache-hits
1, 8617
mq
capi.connatix.com/tr/ Frame 6033
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/mq?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:21 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
ps
capi.connatix.com/tr/ Frame 6033
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/ps?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:21 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
bl-04a3385-54ec09d8.js
tagan.adlightning.com/math-aids-threatpost/ Frame 54F3
89 KB
26 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-54ec09d8.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7b74cfb5202288f56ae2eebc0bde0ddf144951f96cf49447d1cb0682fe20e1b7

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 16:58:28 GMT
content-encoding
gzip
age
9474
x-cache
Hit from cloudfront
content-length
26656
x-amz-meta-git_commit
04a3385
last-modified
Mon, 23 Nov 2020 16:57:45 GMT
server
AmazonS3
etag
"2f01427e7dc48cd7fee2958bcc67ab0e"
x-amz-version-id
Wpt7pdoTEhO7HkyBfMrgq7Ms65L0pYBQ
via
1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
ch5uc1zd8f1CayTiN4R5FiAtx9qbbcLEha92uQNFGFdrlTXihjR4DA==
b-9a4f7ce-a7f6098c.js
tagan.adlightning.com/math-aids-threatpost/ Frame 54F3
61 KB
21 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 18 Nov 2020 02:53:27 GMT
content-encoding
gzip
age
492174
x-cache
Hit from cloudfront
content-length
20808
x-amz-meta-git_commit
9a4f7ce
last-modified
Tue, 18 Aug 2020 17:45:57 GMT
server
AmazonS3
etag
"98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id
PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via
1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
1WFRvUp0S49ylJTnvjYgwKd_a3I-oEn7rOJnClsDNPNDuAcuq_QExA==
tag
math-aids-threatpost-tagan.adlightning.com/
0
425 B
Other
General
Full URL
https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vam9lLWJpZGVuLWNhbXBhaWduLXdlYnNpdGUtaGFja3RpdmlzdC1kZWZhY2VtZW50LzE2MTQ3MS8iLCJhZFVuaXQiOiIvMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC0zMDB4MjUwLUFURl8wIiwiYWRTZXJ2ZXJEZXRhaWxzIjp7ImFkdmVydGlzZXJJZCI6IjQ1OTQ1NTk3NTIiLCJjYW1wYWlnbklkIjoiMjY1NDAyNTAzOSIsImNyZWF0aXZlSWQiOiIxMzgzMDExODk1MDgiLCJsaW5laXRlbUlkIjoiNTI3NjA1NjU0NCIsImFkU2VydmVyIjoiZGZwIn0sIndpZHRoIjozMDAsImhlaWdodCI6MjUwLCJ3diI6IjEuMC4wKzlhNGY3Y2UiLCJidiI6IjEuMC4wKzlhNGY3Y2UiLCJ0YWdNYXJrdXAiOiI8aWZyYW1lIGlkPVwiZ29vZ2xlX2Fkc19pZnJhbWVfLzIxNzA3MTI0MzM2L1RocmVhdFBvc3QtMzAweDI1MC1BVEZfMFwiIHRpdGxlPVwiM3JkIHBhcnR5IGFkIGNvbnRlbnRcIiBuYW1lPVwiZ29vZ2xlX2Fkc19pZnJhbWVfLzIxNzA3MTI0MzM2L1RocmVhdFBvc3QtMzAweDI1MC1BVEZfMFwiIHdpZHRoPVwiMzM2XCIgaGVpZ2h0PVwiMjgwXCIgc2Nyb2xsaW5nPVwibm9cIiBtYXJnaW53aWR0aD1cIjBcIiBtYXJnaW5oZWlnaHQ9XCIwXCIgZnJhbWVib3JkZXI9XCIwXCIgc2FuZGJveD1cImFsbG93LWZvcm1zIGFsbG93LXBvcHVwcyBhbGxvdy1wb3B1cHMtdG8tZXNjYXBlLXNhbmRib3ggYWxsb3ctcG9pbnRlci1sb2NrIGFsbG93LXNhbWUtb3JpZ2luIGFsbG93LXNjcmlwdHMgYWxsb3ctdG9wLW5hdmlnYXRpb24tYnktdXNlci1hY3RpdmF0aW9uXCIgc3JjZG9jPVwiXCIgc3R5bGU9XCJib3JkZXI6IDBweDsgdmVydGljYWwtYWxpZ246IGJvdHRvbTtcIj48L2lmcmFtZT48IS0tIElGUkFNRSBJTk5FUiBDT05URU5UIC0tPiIsImJsYWNrbGlzdERhdGEiOnsiYWN0aW9uIjoxMCwiYWN0aW9uRGV0YWlscyI6Im5ld2NoaWMuY29tIiwicmVwb3J0TWFya3VwIjp0cnVlLCJpdGVtcyI6W3siaG9zdG5hbWUiOiJuZXdjaGljLmNvbSIsInRva2VuIjoiIiwiYWN0aW9uIjoxMH1dLCJtYXJrdXAiOiI8IWRvY3R5cGUgaHRtbD48aHRtbCBhbXA0YWRzIGNsYXNzPWktYW1waHRtbC1pbmFib3ggaS1hbXBodG1sLWxheW91dCBpLWFtcGh0bWwtbm8tYm9pbGVycGxhdGU%2BPGhlYWQ%2BPG1ldGEgbmFtZT1cInJlZmVycmVyXCIgY29udGVudD1cIm9yaWdpblwiPjxtZXRhIGh0dHAtZXF1aXY9Q29udGVudC1TZWN1cml0eS1Qb2xpY3kgY29udGVudD1cInNjcmlwdC1zcmMgaHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvO29iamVjdC1zcmMgJ25vbmUnO2NoaWxkLXNyYyBibG9iOjtmcmFtZS1zcmMgJ25vbmUnXCI%2BPG1ldGEgY2hhcnNldD11dGYtOD48c3R5bGUgYW1wLXJ1bnRpbWUgaS1hbXBodG1sLXZlcnNpb249MDEyMDEwMjcwMDQwMDAwPmh0bWx7b3ZlcmZsb3cteDpoaWRkZW4haW1wb3J0YW50fWh0bWwuaS1hbXBodG1sLWZpZXtoZWlnaHQ6MTAwJSFpbXBvcnRhbnQ7d2lkdGg6MTAwJSFpbXBvcnRhbnR9aHRtbDpub3QoW2FtcDRhZHNdKSxodG1sOm5vdChbYW1wNGFkc10pIGJvZHl7aGVpZ2h0OmF1dG8haW1wb3J0YW50fWh0bWw6bm90KFthbXA0YWRzXSkgYm9keXttYXJnaW46MCFpbXBvcnRhbnR9Ym9keXstd2Via2l0LXRleHQtc2l6ZS1hZGp1c3Q6MTAwJTstbW96LXRleHQtc2l6ZS1hZGp1c3Q6MTAwJTstbXMtdGV4dC1zaXplLWFkanVzdDoxMDAlO3RleHQtc2l6ZS1hZGp1c3Q6MTAwJX1odG1sLmktYW1waHRtbC1zaW5nbGVkb2MuaS1hbXBodG1sLWVtYmVkZGVkey1tcy10b3VjaC1hY3Rpb246cGFuLXk7dG91Y2gtYWN0aW9uOnBhbi15fWh0bWwuaS1hbXBodG1sLWZpZT5ib2R5LGh0bWwuaS1hbXBodG1sLXNpbmdsZWRvYz5ib2R5e292ZXJmbG93OnZpc2libGUhaW1wb3J0YW50fWh0bWwuaS1hbXBodG1sLWZpZTpub3QoLmktYW1waHRtbC1pbmFib3gpPmJvZHksaHRtbC5pLWFtcGh0bWwtc2luZ2xlZG9jOm5vdCguaS1hbXBodG1sLWluYWJveCk%2BYm9keXtwb3NpdGlvbjpyZWxhdGl2ZSFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtd2Vidmlldz5ib2R5e292ZXJmbG93LXg6aGlkZGVuIWltcG9ydGFudDtvdmVyZmxvdy15OnZpc2libGUhaW1wb3J0YW50O21pbi1oZWlnaHQ6MTAwdmghaW1wb3J0YW50fWh0bWwuaS1hbXBodG1sLWlvcy1lbWJlZC1sZWdhY3k%2BYm9keXtvdmVyZmxvdy14OmhpZGRlbiFpbXBvcnRhbnQ7b3ZlcmZsb3cteTphdXRvIWltcG9ydGFudDtwb3NpdGlvbjphYnNvbHV0ZSFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtaW9zLWVtYmVke292ZXJmbG93LXk6YXV0byFpbXBvcnRhbnQ7cG9zaXRpb246c3RhdGljfSNpLWFtcGh0bWwtd3JhcHBlcntvdmVyZmxvdy14OmhpZGRlbiFpbXBvcnRhbnQ7b3ZlcmZsb3cteTphdXRvIWltcG9ydGFudDtwb3NpdGlvbjphYnNvbHV0ZSFpbXBvcnRhbnQ7dG9wOjAhaW1wb3J0YW50O2xlZnQ6MCFpbXBvcnRhbnQ7cmlnaHQ6MCFpbXBvcnRhbnQ7Ym90dG9tOjAhaW1wb3J0YW50O21hcmdpbjowIWltcG9ydGFudDtkaXNwbGF5OmJsb2NrIWltcG9ydGFudH1odG1sLmktYW1waHRtbC1pb3MtZW1iZWQuaS1hbXBodG1sLWlvcy1vdmVyc2Nyb2xsLGh0bWwuaS1hbXBodG1sLWlvcy1lbWJlZC5pLWFtcGh0bWwtaW9zLW92ZXJzY3JvbGw%2BI2ktYW1waHRtbC13cmFwcGVyey13ZWJraXQtb3ZlcmZsb3ctc2Nyb2xsaW5nOnRvdWNoIWltcG9ydGFudH0jaS1hbXBodG1sLXdyYXBwZXI%2BYm9keXtwb3NpdGlvbjpyZWxhdGl2ZSFpbXBvcnRhbnQ7Ym9yZGVyLXRvcDoxcHggc29saWQgdHJhbnNwYXJlbnQhaW1wb3J0YW50fSNpLWFtcGh0bWwtd3JhcHBlcitib2R5e3Zpc2liaWxpdHk6dmlzaWJsZX0jaS1hbXBodG1sLXdyYXBwZXIrYm9keSAuaS1hbXBodG1sLWxpZ2h0Ym94LWVsZW1lbnQsI2ktYW1waHRtbC13cmFwcGVyK2JvZHlbaS1hbXBodG1sLWxpZ2h0Ym94XXt2aXNpYmlsaXR5OmhpZGRlbn0jaS1hbXBodG1sLXdyYXBwZXIrYm9keVtpLWFtcGh0bWwtbGlnaHRib3hdIC5pLWFtcGh0bWwtbGlnaHRib3gtZWxlbWVudHt2aXNpYmlsaXR5OnZpc2libGV9I2ktYW1waHRtbC13cmFwcGVyLmktYW1waHRtbC1zY3JvbGwtZGlzYWJsZWQsLmktYW1waHRtbC1zY3JvbGwtZGlzYWJsZWR7b3ZlcmZsb3cteDpoaWRkZW4haW1wb3J0YW50O292ZXJmbG93LXk6aGlkZGVuIWltcG9ydGFudH1hbXAtaW5zdGFncmFte3BhZGRpbmc6NTRweCAwcHggMHB4IWltcG9ydGFudDtiYWNrZ3JvdW5kLWNvbG9yOiNmZmZ9YW1wLWlmcmFtZSBpZnJhbWV7Ym94LXNpemluZzpib3JkZXItYm94IWltcG9ydGFudH1bYW1wLWFjY2Vzc11bYW1wLWFjY2Vzcy1oaWRlXXtkaXNwbGF5Om5vbmV9W3N1YnNjcmlwdGlvbnMtZGlhbG9nXSxib2R5Om5vdCguaS1hbXBodG1sLXN1YnMtcmVhZHkpIFtzdWJzY3JpcHRpb25zLWFjdGlvbl0sYm9keTpub3QoLmktYW1waHRtbC1zdWJzLXJlYWR5KSBbc3Vic2NyaXB0aW9ucy1zZWN0aW9uXXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fWFtcC1leHBlcmltZW50LGFtcC1saXZlLWxpc3Q%2BW3VwZGF0ZV17ZGlzcGxheTpub25lfS5pLWFtcGh0bWwtamFuay1tZXRlcntwb3NpdGlvbjpmaXhlZDtiYWNrZ3JvdW5kLWNvbG9yOnJnYmEoMjMyLDcyLDk1LDAuNSk7Ym90dG9tOjA7cmlnaHQ6MDtjb2xvcjojZmZmO2ZvbnQtc2l6ZToxNnB4O3otaW5kZXg6MTAwMDtwYWRkaW5nOjVweH1hbXAtbGlzdFtyZXNpemFibGUtY2hpbGRyZW5dPi5pLWFtcGh0bWwtbG9hZGluZy1jb250YWluZXIuYW1wLWhpZGRlbntkaXNwbGF5Om5vbmUhaW1wb3J0YW50fWFtcC1saXN0IFtmZXRjaC1lcnJvcl0sYW1wLWxpc3RbbG9hZC1tb3JlXSBbbG9hZC1tb3JlLWJ1dHRvbl0sYW1wLWxpc3RbbG9hZC1tb3JlXSBbbG9hZC1tb3JlLWVuZF0sYW1wLWxpc3RbbG9hZC1tb3JlXSBbbG9hZC1tb3JlLWZhaWxlZF0sYW1wLWxpc3RbbG9hZC1tb3JlXSBbbG9hZC1tb3JlLWxvYWRpbmdde2Rpc3BsYXk6bm9uZX1hbXAtbGlzdFtkaWZmYWJsZV0gZGl2W3JvbGU9bGlzdF17ZGlzcGxheTpibG9ja31hbXAtc3RvcnktcGFnZSxhbXAtc3Rvcnlbc3RhbmRhbG9uZV17bWluLWhlaWdodDoxcHghaW1wb3J0YW50O2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50O2hlaWdodDoxMDAlIWltcG9ydGFudDttYXJnaW46MCFpbXBvcnRhbnQ7cGFkZGluZzowIWltcG9ydGFudDtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O3dpZHRoOjEwMCUhaW1wb3J0YW50fWFtcC1zdG9yeVtzdGFuZGFsb25lXXtiYWNrZ3JvdW5kLWNvbG9yOiMyMDIxMjUhaW1wb3J0YW50O3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudH1hbXAtc3RvcnktcGFnZXtiYWNrZ3JvdW5kLWNvbG9yOiM3NTc1NzV9YW1wLXN0b3J5IC5hbXAtYWN0aXZlPmRpdixhbXAtc3RvcnkgLmktYW1waHRtbC1sb2FkZXItYmFja2dyb3VuZHtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fWFtcC1zdG9yeS1wYWdlOm5vdCg6Zmlyc3Qtb2YtdHlwZSk6bm90KFtkaXN0YW5jZV0pOm5vdChbYWN0aXZlXSl7dHJhbnNmb3JtOnRyYW5zbGF0ZVkoMTAwMHZoKSFpbXBvcnRhbnR9YW1wLWF1dG9jb21wbGV0ZXtwb3NpdGlvbjpyZWxhdGl2ZSFpbXBvcnRhbnQ7ZGlzcGxheTppbmxpbmUtYmxvY2shaW1wb3J0YW50fWFtcC1hdXRvY29tcGxldGU%2BaW5wdXQsYW1wLWF1dG9jb21wbGV0ZT50ZXh0YXJlYXtwYWRkaW5nOjAuNXJlbTtib3JkZXI6MXB4IHNvbGlkIHJnYmEoMCwwLDAsMC4zMyl9LmktYW1waHRtbC1hdXRvY29tcGxldGUtcmVzdWx0cyxhbXAtYXV0b2NvbXBsZXRlPmlucHV0LGFtcC1hdXRvY29tcGxldGU%2BdGV4dGFyZWF7Zm9udC1zaXplOjFyZW07bGluZS1oZWlnaHQ6MS41cmVtfVthbXAtZnhePWZseS1pbl17dmlzaWJpbGl0eTpoaWRkZW59YW1wLXNjcmlwdFtub2RvbV17cG9zaXRpb246Zml4ZWQhaW1wb3J0YW50O3RvcDowIWltcG9ydGFudDt3aWR0aDoxcHghaW1wb3J0YW50O2hlaWdodDoxcHghaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7dmlzaWJpbGl0eTpoaWRkZW59XG4vKiMgc291cmNlVVJMPS9jc3MvYW1wZG9jLmNzcyovW2hpZGRlbl17ZGlzcGxheTpub25lIWltcG9ydGFudH0uaS1hbXBodG1sLWVsZW1lbnR7ZGlzcGxheTppbmxpbmUtYmxvY2t9LmktYW1waHRtbC1ibHVycnktcGxhY2Vob2xkZXJ7dHJhbnNpdGlvbjpvcGFjaXR5IDAuM3MgY3ViaWMtYmV6aWVyKDAuMCwwLjAsMC4yLDEpIWltcG9ydGFudDtwb2ludGVyLWV2ZW50czpub25lfVtsYXlvdXQ9bm9kaXNwbGF5XTpub3QoLmktYW1waHRtbC1lbGVtZW50KXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtbGF5b3V0LWZpeGVkLFtsYXlvdXQ9Zml4ZWRdW3dpZHRoXVtoZWlnaHRdOm5vdCguaS1hbXBodG1sLWxheW91dC1maXhlZCl7ZGlzcGxheTppbmxpbmUtYmxvY2s7cG9zaXRpb246cmVsYXRpdmV9LmktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSxbbGF5b3V0PXJlc3BvbnNpdmVdW3dpZHRoXVtoZWlnaHRdOm5vdCguaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlKSxbd2lkdGhdW2hlaWdodF1baGVpZ2h0c106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSksW3dpZHRoXVtoZWlnaHRdW3NpemVzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlKXtkaXNwbGF5OmJsb2NrO3Bvc2l0aW9uOnJlbGF0aXZlfS5pLWFtcGh0bWwtbGF5b3V0LWludHJpbnNpYyxbbGF5b3V0PWludHJpbnNpY11bd2lkdGhdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWludHJpbnNpYyl7ZGlzcGxheTppbmxpbmUtYmxvY2s7cG9zaXRpb246cmVsYXRpdmU7bWF4LXdpZHRoOjEwMCV9LmktYW1waHRtbC1sYXlvdXQtaW50cmluc2ljIC5pLWFtcGh0bWwtc2l6ZXJ7bWF4LXdpZHRoOjEwMCV9LmktYW1waHRtbC1pbnRyaW5zaWMtc2l6ZXJ7bWF4LXdpZHRoOjEwMCU7ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9LmktYW1waHRtbC1sYXlvdXQtY29udGFpbmVy&i=1-8&t=adltag_khuyave2_Ro2GcN1ZuKC&r=1f108ed0123b951ab5d3ceaeb7b5f63&c=math-aids-threatpost&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.58 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
D2POxJleIt92FyXaxSi7iRHuNLtujALh
via
1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
4100
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:10 GMT
server
AmazonS3
date
Mon, 23 Nov 2020 18:28:02 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
T3E7TC3E3DY46dkdEYZ08VM58ki-rx21LHw-DR3KSrT2mp8h43ttVQ==
tag
math-aids-threatpost-tagan.adlightning.com/
0
425 B
Other
General
Full URL
https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=LC5pLWFtcGh0bWwtbGF5b3V0LWZpeGVkLWhlaWdodCxbbGF5b3V0PWNvbnRhaW5lcl0sW2xheW91dD1maXhlZC1oZWlnaHRdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWZpeGVkLWhlaWdodCl7ZGlzcGxheTpibG9jaztwb3NpdGlvbjpyZWxhdGl2ZX0uaS1hbXBodG1sLWxheW91dC1maWxsLC5pLWFtcGh0bWwtbGF5b3V0LWZpbGwuaS1hbXBodG1sLW5vdGJ1aWx0LFtsYXlvdXQ9ZmlsbF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWZpbGwpe2Rpc3BsYXk6YmxvY2s7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDtwb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtsZWZ0OjA7Ym90dG9tOjA7cmlnaHQ6MH0uaS1hbXBodG1sLWxheW91dC1mbGV4LWl0ZW0sW2xheW91dD1mbGV4LWl0ZW1dOm5vdCguaS1hbXBodG1sLWxheW91dC1mbGV4LWl0ZW0pe2Rpc3BsYXk6YmxvY2s7cG9zaXRpb246cmVsYXRpdmU7LW1zLWZsZXg6MSAxIGF1dG87ZmxleDoxIDEgYXV0b30uaS1hbXBodG1sLWxheW91dC1mbHVpZHtwb3NpdGlvbjpyZWxhdGl2ZX0uaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWR7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudH0uaS1hbXBodG1sLWxheW91dC1hd2FpdGluZy1zaXple3Bvc2l0aW9uOmFic29sdXRlIWltcG9ydGFudDt0b3A6YXV0byFpbXBvcnRhbnQ7Ym90dG9tOmF1dG8haW1wb3J0YW50fWktYW1waHRtbC1zaXplcntkaXNwbGF5OmJsb2NrIWltcG9ydGFudH1Ac3VwcG9ydHMgKGFzcGVjdC1yYXRpbzoxLzEpe2ktYW1waHRtbC1zaXplci5pLWFtcGh0bWwtZGlzYWJsZS1mb3ItYXJ7ZGlzcGxheTpub25lIWltcG9ydGFudH19LmktYW1waHRtbC1ibHVycnktcGxhY2Vob2xkZXIsLmktYW1waHRtbC1maWxsLWNvbnRlbnR7ZGlzcGxheTpibG9jaztoZWlnaHQ6MDttYXgtaGVpZ2h0OjEwMCU7bWF4LXdpZHRoOjEwMCU7bWluLWhlaWdodDoxMDAlO21pbi13aWR0aDoxMDAlO3dpZHRoOjA7bWFyZ2luOmF1dG99LmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIC5pLWFtcGh0bWwtZmlsbC1jb250ZW50e3Bvc2l0aW9uOmFic29sdXRlO3RvcDowO2xlZnQ6MDtib3R0b206MDtyaWdodDowfS5pLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudCwuaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7cGFkZGluZzowIWltcG9ydGFudDtib3JkZXI6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVye3Bvc2l0aW9uOmZpeGVkIWltcG9ydGFudDt0b3A6MHB4IWltcG9ydGFudDtsZWZ0OjBweCFpbXBvcnRhbnQ7d2lkdGg6NHB4IWltcG9ydGFudDtoZWlnaHQ6NHB4IWltcG9ydGFudDtvcGFjaXR5OjAhaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7bWFyZ2luOjAhaW1wb3J0YW50O2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50O3Zpc2liaWxpdHk6dmlzaWJsZSFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcntsZWZ0OjhweCFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDoxMnB4IWltcG9ydGFudH0uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ%2BLmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDoxNnB4IWltcG9ydGFudH0uaS1hbXBodG1sLXVucmVzb2x2ZWR7cG9zaXRpb246cmVsYXRpdmU7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudH0uaS1hbXBodG1sLXNlbGVjdC1kaXNhYmxlZHstd2Via2l0LXVzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50Oy1tcy11c2VyLXNlbGVjdDpub25lIWltcG9ydGFudDt1c2VyLXNlbGVjdDpub25lIWltcG9ydGFudH0uaS1hbXBodG1sLW5vdGJ1aWx0LFtsYXlvdXRdOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KXtwb3NpdGlvbjpyZWxhdGl2ZTtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O2NvbG9yOnRyYW5zcGFyZW50IWltcG9ydGFudH0uaS1hbXBodG1sLW5vdGJ1aWx0Om5vdCguaS1hbXBodG1sLWxheW91dC1jb250YWluZXIpPiosW2xheW91dF06bm90KFtsYXlvdXQ9Y29udGFpbmVyXSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCk%2BKixbd2lkdGhdW2hlaWdodF1baGVpZ2h0c106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT4qLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT4qe2Rpc3BsYXk6bm9uZX1hbXAtaW1nOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpW2ktYW1waHRtbC1zc3JdPmltZy5pLWFtcGh0bWwtZmlsbC1jb250ZW50e2Rpc3BsYXk6YmxvY2t9LmktYW1waHRtbC1ub3RidWlsdDpub3QoLmktYW1waHRtbC1sYXlvdXQtY29udGFpbmVyKSxbbGF5b3V0XTpub3QoW2xheW91dD1jb250YWluZXJdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KSxbd2lkdGhdW2hlaWdodF1baGVpZ2h0c106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KSxbd2lkdGhdW2hlaWdodF1bc2l6ZXNdOm5vdChbbGF5b3V0XSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCl7Y29sb3I6dHJhbnNwYXJlbnQhaW1wb3J0YW50O2xpbmUtaGVpZ2h0OjAhaW1wb3J0YW50fS5pLWFtcGh0bWwtZ2hvc3R7dmlzaWJpbGl0eTpoaWRkZW4haW1wb3J0YW50fS5pLWFtcGh0bWwtZWxlbWVudD5bcGxhY2Vob2xkZXJdLFtsYXlvdXRdOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpPltwbGFjZWhvbGRlcl0sW3dpZHRoXVtoZWlnaHRdW2hlaWdodHNdOm5vdChbbGF5b3V0XSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCk%2BW3BsYWNlaG9sZGVyXSxbd2lkdGhdW2hlaWdodF1bc2l6ZXNdOm5vdChbbGF5b3V0XSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCk%2BW3BsYWNlaG9sZGVyXXtkaXNwbGF5OmJsb2NrfS5pLWFtcGh0bWwtZWxlbWVudD5bcGxhY2Vob2xkZXJdLmFtcC1oaWRkZW4sLmktYW1waHRtbC1lbGVtZW50PltwbGFjZWhvbGRlcl0uaGlkZGVue3Zpc2liaWxpdHk6aGlkZGVufS5pLWFtcGh0bWwtZWxlbWVudDpub3QoLmFtcC1ub3RzdXBwb3J0ZWQpPltmYWxsYmFja10sLmktYW1waHRtbC1sYXlvdXQtY29udGFpbmVyPltwbGFjZWhvbGRlcl0uYW1wLWhpZGRlbiwuaS1hbXBodG1sLWxheW91dC1jb250YWluZXI%2BW3BsYWNlaG9sZGVyXS5oaWRkZW57ZGlzcGxheTpub25lfS5pLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZD5bZmFsbGJhY2tdLC5pLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZD5bcGxhY2Vob2xkZXJde3Bvc2l0aW9uOmFic29sdXRlIWltcG9ydGFudDt0b3A6MCFpbXBvcnRhbnQ7bGVmdDowIWltcG9ydGFudDtyaWdodDowIWltcG9ydGFudDtib3R0b206MCFpbXBvcnRhbnQ7ei1pbmRleDoxfS5pLWFtcGh0bWwtbm90YnVpbHQ%2BW3BsYWNlaG9sZGVyXXtkaXNwbGF5OmJsb2NrIWltcG9ydGFudH0uaS1hbXBodG1sLWhpZGRlbi1ieS1tZWRpYS1xdWVyeXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtZWxlbWVudC1lcnJvcntiYWNrZ3JvdW5kOnJlZCFpbXBvcnRhbnQ7Y29sb3I6I2ZmZiFpbXBvcnRhbnQ7cG9zaXRpb246cmVsYXRpdmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtZWxlbWVudC1lcnJvcjpiZWZvcmV7Y29udGVudDphdHRyKGVycm9yLW1lc3NhZ2UpfWktYW1wLXNjcm9sbC1jb250YWluZXIsaS1hbXBodG1sLXNjcm9sbC1jb250YWluZXJ7cG9zaXRpb246YWJzb2x1dGU7dG9wOjA7bGVmdDowO3JpZ2h0OjA7Ym90dG9tOjA7ZGlzcGxheTpibG9ja31pLWFtcC1zY3JvbGwtY29udGFpbmVyLmFtcC1hY3RpdmUsaS1hbXBodG1sLXNjcm9sbC1jb250YWluZXIuYW1wLWFjdGl2ZXtvdmVyZmxvdzphdXRvOy13ZWJraXQtb3ZlcmZsb3ctc2Nyb2xsaW5nOnRvdWNofS5pLWFtcGh0bWwtbG9hZGluZy1jb250YWluZXJ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnQ7cG9pbnRlci1ldmVudHM6bm9uZTt6LWluZGV4OjF9LmktYW1waHRtbC1ub3RidWlsdD4uaS1hbXBodG1sLWxvYWRpbmctY29udGFpbmVye2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fS5pLWFtcGh0bWwtbG9hZGluZy1jb250YWluZXIuYW1wLWhpZGRlbnt2aXNpYmlsaXR5OmhpZGRlbn0uaS1hbXBodG1sLWVsZW1lbnQ%2BW292ZXJmbG93XXtjdXJzb3I6cG9pbnRlcjtwb3NpdGlvbjpyZWxhdGl2ZTt6LWluZGV4OjI7dmlzaWJpbGl0eTpoaWRkZW47ZGlzcGxheTppbml0aWFsO2xpbmUtaGVpZ2h0Om5vcm1hbH0uaS1hbXBodG1sLWVsZW1lbnQ%2BW292ZXJmbG93XS5hbXAtdmlzaWJsZXt2aXNpYmlsaXR5OnZpc2libGV9dGVtcGxhdGV7ZGlzcGxheTpub25lIWltcG9ydGFudH0uYW1wLWJvcmRlci1ib3gsLmFtcC1ib3JkZXItYm94ICosLmFtcC1ib3JkZXItYm94IDphZnRlciwuYW1wLWJvcmRlci1ib3ggOmJlZm9yZXtib3gtc2l6aW5nOmJvcmRlci1ib3h9YW1wLXBpeGVse2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9YW1wLWFuYWx5dGljcyxhbXAtYXV0by1hZHMsYW1wLXN0b3J5LWF1dG8tYWRze3Bvc2l0aW9uOmZpeGVkIWltcG9ydGFudDt0b3A6MCFpbXBvcnRhbnQ7d2lkdGg6MXB4IWltcG9ydGFudDtoZWlnaHQ6MXB4IWltcG9ydGFudDtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O3Zpc2liaWxpdHk6aGlkZGVufWh0bWwuaS1hbXBodG1sLWZpZT5hbXAtYW5hbHl0aWNze3Bvc2l0aW9uOmluaXRpYWwhaW1wb3J0YW50fVt2aXNpYmxlLXdoZW4taW52YWxpZF06bm90KC52aXNpYmxlKSxmb3JtIFtzdWJtaXQtZXJyb3JdLGZvcm0gW3N1Ym1pdC1zdWNjZXNzXSxmb3JtIFtzdWJtaXR0aW5nXXtkaXNwbGF5Om5vbmV9YW1wLWFjY29yZGlvbntkaXNwbGF5OmJsb2NrIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uPnNlY3Rpb257ZmxvYXQ6bm9uZSFpbXBvcnRhbnR9YW1wLWFjY29yZGlvbj5zZWN0aW9uPip7ZmxvYXQ6bm9uZSFpbXBvcnRhbnQ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnQ7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDtwb3NpdGlvbjpyZWxhdGl2ZSFpbXBvcnRhbnR9YW1wLWFjY29yZGlvbixhbXAtYWNjb3JkaW9uPnNlY3Rpb257bWFyZ2luOjB9YW1wLWFjY29yZGlvbjpub3QoLmktYW1waHRtbC1idWlsdCk%2Bc2VjdGlvbj46bGFzdC1jaGlsZHtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fWFtcC1hY2NvcmRpb246bm90KC5pLWFtcGh0bWwtYnVpbHQpPnNlY3Rpb25bZXhwYW5kZWRdPjpsYXN0LWNoaWxke2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fVxuLyojIHNvdXJjZVVSTD0vY3NzL2FtcHNoYXJlZC5jc3MqL2h0bWwuaS1hbXBodG1sLWluYWJveHt3aWR0aDoxMDAlIWltcG9ydGFudDtoZWlnaHQ6MTAwJSFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtaW5hYm94PmJvZHl7cG9zaXRpb246aW5pdGlhbCFpbXBvcnRhbnR9PC9zdHlsZT48bWV0YSBjb250ZW50PVwid2lkdGg9ZGV2aWNlLXdpZHRoLG1pbmltdW0tc2NhbGU9MSxpbml0aWFsLXNjYWxlPTFcIiBuYW1lPXZpZXdwb3J0PjxtZXRhIGNvbnRlbnQ9XCJ2ZW5kb3I9ZG91YmxlY2xpY2ssdHlwZT1pbXByZXNzaW9uLWlkLHZhbHVlPUNQU3hrX2kwbWUwQ0ZSLU4zZ29kVHZrSWhBXCIgbmFtZT1hbXA0YWRzLWlkPjxsaW5rIGFzPXNjcmlwdCBocmVmPWh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMTAyNzAwNDAwMDAvYW1wNGFkcy12MC5tanMgcmVsPXByZWxvYWQ%2BPHNjcmlwdCBhc3luYyBzcmM9aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvcnR2LzAxMjAxMDI3MDA0MDAwMC9hbXA0YWRzLXYwLm1qcz48L3NjcmlwdD48c2NyaXB0IGFzeW5jIGN1c3RvbS1lbGVtZW50PWFtcC1hZC1leGl0IHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDEwMjcwMDQw&i=2-8&t=adltag_khuyave2_Ro2GcN1ZuKC&r=1f108ed0123b951ab5d3ceaeb7b5f63&c=math-aids-threatpost&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.58 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
D2POxJleIt92FyXaxSi7iRHuNLtujALh
via
1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
4101
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:10 GMT
server
AmazonS3
date
Mon, 23 Nov 2020 18:28:02 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
F0UBc2RGLOXM3zg3cNk_ihdwh0AXborvb3BYp-MKvjA7jnGT2w_-ug==
tag
math-aids-threatpost-tagan.adlightning.com/
0
426 B
Other
General
Full URL
https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=MDAwL3YwL2FtcC1hZC1leGl0LTAuMS5tanM%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYyBjdXN0b20tZWxlbWVudD1hbXAtYW5hbHl0aWNzIHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDEwMjcwMDQwMDAwL3YwL2FtcC1hbmFseXRpY3MtMC4xLm1qcz48L3NjcmlwdD48c2NyaXB0IGFzeW5jIGN1c3RvbS1lbGVtZW50PWFtcC1maXQtdGV4dCBzcmM9aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvcnR2LzAxMjAxMDI3MDA0MDAwMC92MC9hbXAtZml0LXRleHQtMC4xLm1qcz48L3NjcmlwdD48c2NyaXB0IGFzeW5jIGN1c3RvbS1lbGVtZW50PWFtcC1mb3JtIHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDEwMjcwMDQwMDAwL3YwL2FtcC1mb3JtLTAuMS5tanM%2BPC9zY3JpcHQ%2BPHN0eWxlIGFtcC1jdXN0b20%2BYSB7IGNvbG9yOiAjMDAwMDAwIH1ib2R5IHsgbWFyZ2luOiAwOyBiYWNrZ3JvdW5kOiB0cmFuc3BhcmVudDsgfSNnb29nbGVfaW1hZ2VfZGl2IHtoZWlnaHQ6IDI4MHB4O3dpZHRoOiAzMzZweDtvdmVyZmxvdzpoaWRkZW47cG9zaXRpb246cmVsYXRpdmV9aHRtbCwgYm9keSB7d2lkdGg6MTAwJTtoZWlnaHQ6MTAwJTt9Ym9keSB7ZGlzcGxheTp0YWJsZTt0ZXh0LWFsaWduOmNlbnRlcjt9I2dvb2dsZV9jZW50ZXJfZGl2IHtkaXNwbGF5OnRhYmxlLWNlbGw7dmVydGljYWwtYWxpZ246bWlkZGxlO30jZ29vZ2xlX2ltYWdlX2RpdiB7ZGlzcGxheTppbmxpbmUtYmxvY2s7fS5hYmdjIHtwb3NpdGlvbjphYnNvbHV0ZTt6LWluZGV4OjIxNDc0ODM2NDY7cmlnaHQ6MDt0b3A6MDt9LmFiZ2MgYW1wLWltZywgLmFiZ2MgaW1nIHtkaXNwbGF5OmJsb2NrO30uYWJncyB7cG9zaXRpb246YWJzb2x1dGU7LXdlYmtpdC10cmFuc2Zvcm06dHJhbnNsYXRlWCg3NnB4KTt0cmFuc2Zvcm06dHJhbnNsYXRlWCg3NnB4KTtyaWdodDoxNnB4O3RvcDowO30uYWJnY3Age3Bvc2l0aW9uOmFic29sdXRlO3JpZ2h0OjA7dG9wOjA7d2lkdGg6MzFweDtoZWlnaHQ6MTVweDtwYWRkaW5nLWxlZnQ6MTBweDtwYWRkaW5nLWJvdHRvbToxMHB4O30uYWJnYiB7cG9zaXRpb246cmVsYXRpdmU7bWFyZ2luLXJpZ2h0OjE2cHg7dG9wOjA7fS5hYmdjOmhvdmVyIC5hYmdzIHstd2Via2l0LXRyYW5zZm9ybTpub25lO3RyYW5zZm9ybTpub25lO30uY2JiIHtkaXNwbGF5OiBibG9jaztwb3NpdGlvbjogYWJzb2x1dGU7cmlnaHQ6MDt0b3A6MDtjdXJzb3I6IHBvaW50ZXI7aGVpZ2h0OiAxNXB4O3dpZHRoOiAxNXB4O3otaW5kZXg6IDkwMjA7cGFkZGluZy1sZWZ0OjE2cHg7fS5idG4ge2Rpc3BsYXk6IGlubGluZS1ibG9jaztib3JkZXItcmFkaXVzOiAycHg7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O2JveC1zaGFkb3c6IDBweCAwcHggMnB4IHJnYmEoMCwwLDAsMC4xMiksIDBweCAxcHggM3B4IHJnYmEoMCwwLDAsMC4yNik7Y3Vyc29yOiBwb2ludGVyO2ZvbnQtc2l6ZTogMC43ZW07bWFyZ2luOiAwIDFweCAwLjRlbSAxcHg7fUBtZWRpYSAobWF4LXdpZHRoOiAzNzVweCkgYW5kIChtaW4taGVpZ2h0OiAxMDBweCkgey5idG4ge2Rpc3BsYXk6IGJsb2NrO3dpZHRoOiA5MCU7bWF4LXdpZHRoOiAyNDBweDttYXJnaW4tbGVmdDogYXV0bzttYXJnaW4tcmlnaHQ6IGF1dG87fX0jc3B2MSBhbXAtZml0LXRleHQ%2BZGl2IHstd2Via2l0LWp1c3RpZnktY29udGVudDogZmxleC1zdGFydDtqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7fS5qdCAucG4gYW1wLWZpdC10ZXh0PmRpdiB7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7anVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O30uYnRuID4gc3BhbiB7ZGlzcGxheTogaW5saW5lLWJsb2NrO3BhZGRpbmc6IDAuNWVtIDAuNmVtO2xpbmUtaGVpZ2h0OiAxZW07fSNzYnRuIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRkZGRkZGO2NvbG9yOiAjOUU5RUE2O3RleHQtZGVjb3JhdGlvbjogbm9uZTt9I3NidG46aG92ZXIsI3NidG46YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRjVGNUY1O30jcmJ0biB7YmFja2dyb3VuZC1jb2xvcjogcmdiKDY2LDEzMywyNDUpO2NvbG9yOiB3aGl0ZTt9I3JidG46aG92ZXIsI3JidG46YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjMzI3NUU1O30jbXRhIHtwb3NpdGlvbjphYnNvbHV0ZTt0b3A6IDA7bGVmdDogMDtmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7Zm9udC1zaXplOiAxMnB4O2ZvbnQtd2VpZ2h0OiA0MDA7bGluZS1oZWlnaHQ6IDFlbTt9I210YSBpbnB1dFt0eXBlPVwicmFkaW9cIl0ge2Rpc3BsYXk6IG5vbmU7fSNtdGEgLnBuIHtyaWdodDogLTMzNnB4O3RvcDogLTI4MHB4O3dpZHRoOjMzNnB4O2hlaWdodDoyODBweDtwb3NpdGlvbjogYWJzb2x1dGU7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O2JhY2tncm91bmQtY29sb3I6ICNGQUZBRkE7dGV4dC1hbGlnbjogY2VudGVyO30jc3B2MiB7ZGlzcGxheTogLXdlYmtpdC1mbGV4O2Rpc3BsYXk6IGZsZXg7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7anVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0Oy13ZWJraXQtZmxleC13cmFwOiBub3dyYXA7ZmxleC13cmFwOiBub3dyYXA7b3ZlcmZsb3c6IGhpZGRlbjtiYWNrZ3JvdW5kLWNvbG9yOiAjRkFGQUZBO2ZvbnQtc2l6ZTogMDt9LnN2ICNzcHYyIHstd2Via2l0LWZsZXgtZGlyZWN0aW9uOiBjb2x1bW47ZmxleC1kaXJlY3Rpb246IGNvbHVtbjt9Lmp0LnN2ICNzcHYyIHstd2Via2l0LWp1c3RpZnktY29udGVudDogZmxleC1zdGFydDtqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7LXdlYmtpdC1hbGlnbi1pdGVtczogY2VudGVyO2FsaWduLWl0ZW1zOiBjZW50ZXI7fSNzcHYyICogey1tb3otYm94LXNpemluZzogYm9yZGVyLWJveDstd2Via2l0LWJveC1zaXppbmc6IGJvcmRlci1ib3g7Ym94LXNpemluZzogYm9yZGVyLWJveDt9I3NwcjE6Y2hlY2tlZCB%2BICNjYmIsI3NwcjI6Y2hlY2tlZCB%2BICNjYmIsI3NwcjM6Y2hlY2tlZCB%2BICNjYmJ7ZGlzcGxheTogbm9uZTt9I3NwdjMge29wYWNpdHk6MTt9LmFtcC1hbmltYXRlICNzcHY0IHtvcGFjaXR5OjA7dHJhbnNpdGlvbjogb3BhY2l0eSAwLjVzIGxpbmVhciAyLjVzO30uYW1wLWFuaW1hdGUgICNzcHYzIGFtcC1maXQtdGV4dCB7b3BhY2l0eToxO3RyYW5zaXRpb246IG9wYWNpdHkgMC41cyBsaW5lYXIgMnM7fSNzcHIzOmNoZWNrZWQgfiAjc3B2MyBhbXAtZml0LXRleHQge29wYWNpdHk6MH0jc3ByMzpjaGVja2VkIH4gI3NwdjQge29wYWNpdHk6MTt9I3NwcjE6Y2hlY2tlZCB%2BICNzcHYxLCNzcHIyOmNoZWNrZWQgfiAjc3B2Miwjc3ByMzpjaGVja2VkIH4gI3NwdjMsI3NwcjM6Y2hlY2tlZCB%2BICNzcHY0e3JpZ2h0OiAwcHg7dG9wOiAwcHg7fS5jbG9zZSB7cG9zaXRpb246IGFic29sdXRlO3RvcDogMnB4O2NvbG9yOiBibGFjaztmb250LXNpemU6IDE1cHg7bGluZS1oZWlnaHQ6IDE1cHg7b3BhY2l0eTogMC41O2hlaWdodDogMTVweDt3aWR0aDogMTVweDt1c2VyLXNlbGVjdDogbm9uZTtjdXJzb3I6IHBvaW50ZXI7fVtkaXI9XCJydGxcIl0gLmNsb3NlIHt0cmFuc2Zvcm06IHNjYWxlWCgtMSk7fS5jdCBzdmcge2JvcmRlcjogMDttYXJnaW46IDAgMCAtMC40NWVtIDA7ZGlzcGxheTogaW5saW5lLWJsb2NrO2hlaWdodDogMS4zOGVtO29wYWNpdHk6IDAuNDt9LmN0IHtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7bGluZS1oZWlnaHQ6IDEuMjhlbTtjb2xvcjogcmdiYSgwLDAsMCwwLjQpO3RleHQtYWxpZ246Y2VudGVyO3BhZGRpbmc6IDAuM2VtO30uZmN0IHtwYWRkaW5nOiAxZW07fSNwY3Qge2Rpc3BsYXk6IGJsb2NrO2ZvbnQtd2VpZ2h0OiBib2xkO3BhZGRpbmc6IDFlbSAwLjNlbTt9I3RpIHt3aWR0aDogMzM2cHg7fSNidG5zIHt3aWR0aDogMzM2cHg7fS5mbCB7d2lkdGg6IDMzNnB4O2hlaWdodDoyODBweDt9I3NpIHtwb3NpdGlvbjogcmVsYXRpdmU7ZGlzcGxheTogaW5saW5lLWJsb2NrO21hcmdpbi1ib3R0b206IC0wLjE1ZW07aGVpZ2h0OiAxZW07d2lkdGg6IDFlbTtvcGFjaXR5OiAwLjQ7fS5zYiB7ZmxleC1zaHJpbms6IDA7aGVpZ2h0OiA1MHB4O30uc28ge3Bvc2l0aW9uOiByZWxhdGl2ZTt6LWluZGV4OiA5MTEwO292ZXJmbG93OiBoaWRkZW47ZGlzcGxheTogaW5saW5lLWJsb2NrO3BhZGRpbmc6IDFweCA1cHg7d2lkdGg6IDk2cHg7aGVpZ2h0OiA1MHB4O2JvcmRlcjogMXB4IHNvbGlkICNFMEUwRTA7YmFja2dyb3VuZC1jb2xvcjogI0ZGRkZGRjtjdXJzb3I6IHBvaW50ZXI7fS5zbzpob3Zlciwuc286YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRjVGNUY1O30uc28gZGl2IHtkaXNwbGF5OiAtd2Via2l0LWZsZXg7ZGlzcGxheTogZmxleDstd2Via2l0LWFsaWduLWl0ZW1zOiBjZW50ZXI7YWxpZ24taXRlbXM6IGNlbnRlcjstd2Via2l0LWp1c3RpZnktY29udGVudDogY2VudGVyO2p1c3RpZnktY29udGVudDogY2VudGVyO3dpZHRoOiAxMDAlO2hlaWdodDogMTAwJTt9LnNvIHNwYW4ge2NvbG9yOiAjNDI4NUY0O2ZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjt0ZXh0LWFsaWduOiBjZW50ZXI7Zm9udC1zaXplOiAxMnB4O2xpbmUtaGVpZ2h0OiAxNHB4O3doaXRlLXNwYWNlOiBub3JtYWw7fUBtZWRpYSAobWluLWhlaWdodDogNTRweCkgey5zaC5zcyAuc28sLnN2IC5zbyB7Ym94LXNoYWRvdzogMHB4IDBweCAycHggcmdiYSgwLDAsMCwwLjEyKSwgMHB4IDFweCAzcHggcmdiYSgwLDAsMCwwLjI2KTtib3JkZXI6IG5vbmU7fX0uc3YgLnNvLC5zaC5zcyAuc28ge2JvcmRlci1yYWRpdXM6IDJweDt9LnN2IC5zbyB7bWFyZ2luOiA0cHg7fS5zdi5qdCAuc286Zmlyc3QtY2hpbGQge21hcmdpbi10b3A6IDhweDt9PC9zdHlsZT48L2hlYWQ%2BPGJvZHkgY2xhc3M9YW1wLWFuaW1hdGU%2BPGRpdiBpZD1nb29nbGVfY2VudGVyX2Rpdj48ZGl2IGlkPWdvb2dsZV9pbWFnZV9kaXY%2BPGEgaHJlZj1cImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L2FjbGs%2Fc2E9bCZhbXA7YWk9Q0N5QmJOQS04WF9USEpwLWEtZ2JPOHFPZ0NLYTM5NWhnajVhczZwME5qSnY2ZzdZSkVBRWcwWWZTSUdDVi12Q0JqQWVnQWEzY2lvZ0R5QUVENEFJQXFBTUJ5QU1JcWdTMUFrX1FVTFY1ODhTRElCZV9UOWFRZFJQMXNIUGp3ekloYXNWbDF5X2NpNDhMOHNUOHlUbjJKdndoNkM5bEE2WnlmeWl3RjRxVjR2VG56SVpYakxSeW1qcngybS00dEZoYWlpUk1EckM1LVlXcG1KVFpBdmcxZUs4M1k1RkxLczRKeUJaYjBXSWpMVE40aTRiMk51MFUyWmhodWV2cDYwZG5HMEdzenlITC1SS1ZoX2hqNzFWZXJDeEdNWGxaNTFCZzZEOEc0QTk0NC1xc05HYkszQkVUQ01YdGo1VmY0UVdxYjlBWG9xTllkV3BQY0FLbmkyRWp3eDJUMEg0R29vUmFoZkRzb1l4WEFOZUpBMTFodTNNbG1oclZ0djlMNjZ0Z2czMFVMMnRFcWo1QmdlQ2diNHppUi14MU41endRYTNSUnhJRVZWVnp2ZVN4UGw0ZUNFd0NxenAzVG5jOXZuSElya0djUTYxQldoRE5aSGRvN2lYeTRyQUdTeHI4THlrbmdXcHVidV9CZmh2dklXOGtlM2liTGtsdkFGVTJuc0FFLWVUY2hfc0M0QVFCb0FZRGdBZmFnTWRycUFmVnlSdW9CX0RaRzZnSDh0a2JxQWVPemh1b0I1UFlHNmdIdWdhb0ItNldzUUtvQjZhLUc2Z0g3TlVicUFmejBSdW9CLXpWRzZnSGx0Z2IyQWNCMGdnSkNJRGhnRUFRQVJnZDhnZ2JZV1I0TFhOMVluTjViaTAzTWpZek5UY3pORFEyT0RBME1EYzRzUWtwT1JMbzlySXdxb0FLQTVnTEFjZ0xBYmdNQWRnVERBJmFtcDthZT0xJmFtcDtudW09MSZhbXA7Y2lkPUNBQVNQZVJvZXZhbXlTaTVqYzg1dXFkNjdGOVRwYzZHLVpVU21ZTEFfTXEtQW9HVV9xdVFuQlFvV2ducVhyQ1Y5UFVwbWFKa1Y0YW5ZV1l4LTZYTU5NTSZhbXA7c2lnPUFPRDY0XzFPM084OVdpVGxUcEpKUXNJMk1UcGcyd3RDb1EmYW1wO2NsaWVudD1jYS1wdW&i=3-8&t=adltag_khuyave2_Ro2GcN1ZuKC&r=1f108ed0123b951ab5d3ceaeb7b5f63&c=math-aids-threatpost&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.58 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
D2POxJleIt92FyXaxSi7iRHuNLtujALh
via
1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
4101
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:10 GMT
server
AmazonS3
date
Mon, 23 Nov 2020 18:28:02 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
viLig1iwn6Qt_SIWPqWhX_R7GK-Fy49ZSbpNjRzZd-AbtwydR0lPww==
tag
math-aids-threatpost-tagan.adlightning.com/
0
425 B
Other
General
Full URL
https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=ItOTY4NTczNDQ0NTQ3NjgxNCZhbXA7bng9Q0xJQ0tfWCZhbXA7bnk9Q0xJQ0tfWSZhbXA7bmI9MiZhbXA7YWR1cmw9aHR0cHM6Ly93d3cubmV3Y2hpYy5jb20vLW1lbmljby1tZW5zLWJvb3RzLTM2MTgvcC0xNzI4MzgzLmh0bWwlM0Z1dG1fc291cmNlJTNEZ29vZ2xlJTI2dXRtX21lZGl1bSUzRGNwY19hZHMxJTI2dXRtX2NhbXBhaWduJTNEY25ldy1tcy1wLVNLVUY5NTcyMi11c2stbjA1LTMwMiUyNnV0bV9jb250ZW50JTNEbGVlciUyNnV0bV9kZXNpZ24lM0QlMjZ1dG1faG8lM0QyMi02NSUyNmdjbGlkJTNERUFJYUlRb2JDaE1JOUxHVC1MU1o3UUlWSDQzZUNoMU8tUWlFRUFFWUFTQUFFZ0lRZmZEX0J3RVwiIGlkPWF3MCBvbj1cInRhcDpleGl0LWFwaS5leGl0KHRhcmdldD0mIzM5O2xhbmRpbmdQYWdlJiMzOTssX2dvb2dDbGlja0xvY2F0aW9uPSYjMzk7MiYjMzk7KVwiIHRhcmdldD1fYmxhbms%2BPGFtcC1pbWcgYWx0IGNsYXNzPVwiaW1nX2FkIGktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBoZWlnaHQ9MjgwIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9aHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3NpbWdhZC8xMzExODQ3NjM1NjcwMjQ1MzYzNiBzdHlsZT13aWR0aDozMzZweDtoZWlnaHQ6MjgwcHg7IHdpZHRoPTMzNj48aW1nIGFsdCBjbGFzcz1cImktYW1waHRtbC1maWxsLWNvbnRlbnQgaS1hbXBodG1sLXJlcGxhY2VkLWNvbnRlbnRcIiBkZWNvZGluZz1hc3luYyBzcmM9aHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3NpbWdhZC8xMzExODQ3NjM1NjcwMjQ1MzYzNj48L2FtcC1pbWc%2BPC9hPjxhbXAtcGl4ZWwgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaS1hbXBodG1sLWxheW91dD1maXhlZCByZWZlcnJlcnBvbGljeT1uby1yZWZlcnJlciBzcmM9Ly93d3cuZ29vZ2xlLmNvbS9wYWdlYWQvZHJ0L3VpIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4Oz48L2FtcC1waXhlbD48ZGl2IGFyaWEtaGlkZGVuPXRydWUgY2xhc3M9XCJhYmdjIGFiZ2YgcGVuXCIgZGlyPWx0ciBpZD1hYmdjPjxkaXYgY2xhc3M9XCJhYmdjcCBwZWFcIiBpZD1hYmdjcD48ZGl2IGNsYXNzPWFiZ3MgaWQ9YWJncz48YSBjbGFzcz1hYmdsIGhyZWY9XCJodHRwczovL2Fkc3NldHRpbmdzLmdvb2dsZS5jb20vd2h5dGhpc2FkP3JlYXNvbnM9QUIzYWZHRUFBQVY5VzF0YlcyNTFiR3dzV3pFd1hTeHVkV3hzTEc1MWJHd3NiblZzYkN4YklqazJNeUpkWFN4YmJuVnNiQ3dpYUhSMGNITTZMeTluYjI5bmJHVmhaSE11Wnk1a2IzVmliR1ZqYkdsamF5NXVaWFF2Y0dGblpXRmtMMk52Ym5abGNuTnBiMjR2UDJGcFBVTkRlVUppVGtFdE9GaGZWRWhLY0MxaExXZGlUemh4VDJkRFMyRXpPVFZvWjJvMVlYTTJjREJPYWtwMk5tYzNXVXBGUVVWbk1GbG1VMGxIUTFZdGRrTkNha0ZsWjBGaE0yTnBiMmRFZVVGRlJEUkJTVUZ4UVUxQ2VVRk5TWEZuVXpGQmExOVJWVXhXTlRnNFUwUkpRbVZmVkRsaFVXUlNVREZ6U0ZCcWQzcEphR0Z6Vm13eGVWOWphVFE0VERoelZEaDVWRzR5U25aM2FEWkRPV3hCTmxwNVpubHBkMFkwY1ZZMGRsUnVla2xhV0dwTVVubHRhbko0TW0wdE5IUkdhR0ZwYVZKTlJISkROUzFaVjNCdFNsUmFRWFpuTVdWTE9ETlpOVVpNUzNNMFNubENXbUl3VjBscVRGUk9OR2swWWpKT2RUQlZNbHBvYUhWbGRuQTJNR1J1UnpCSGMzcDVTRXd0VWt0V2FGOW9hamN4Vm1WeVEzaEhUVmhzV2pVeFFtYzJSRGhITkVFNU5EUXRjWE5PUjJKTE0wSkZWRU5OV0hScU5WWm1ORkZYY1dJNVFWaHZjVTVaWkZkd1VHTkJTMjVwTWtWcWQzZ3lWREJJTkVkdmIxSmhhR1pFYzI5WmVGaEJUbVZLUVRFeGFIVXpUV3h0YUhKV2RIWTVURFkyZEdkbk16QlZUREowUlhGcU5VSm5aVU5uWWpSNmFWSXRlREZPTlhwM1VXRXpVbEo0U1VWV1ZsWjZkbVZUZUZCc05HVkRSWGREY1hwd00xUnVZemwyYmtoSmNtdEhZMUUyTVVKWGFFUk9Xa2hrYnpkcFdIazBja0ZIVTNoeU9FeDVhMjVuVjNCMVluVmZRbVpvZG5aSlZ6aHJaVE5wWWt4cmJIWkJSbFV5Ym5OQlJTMWxWR05vWDNORE5FRlJRbTlCV1VSblFXWmhaMDFrY25GQlpsWjVVblZ2UWw5RVdrYzJaMGc0ZEd0aWNVRmxUM3BvZFc5Q05WQlpSelpuU0hWbllXOUNMVFpYYzFGTGIwSTJZUzFITm1kSU4wNVZZbkZCWm5vd1VuVnZRaTE2VmtjMlowaHNkR2RpTWtGalFqQm5aMHBEU1VSb1owVkJVVUZTWjJRNFoyZGlXVmRTTkV4WVRqRlpiazQxWW1rd00wMXFXWHBPVkdONlRrUlJNazlFUVRCTlJHTTBjMUZyY0U5U1RHODVja2wzY1c5QlMwRTFaMHhCWTJkTVFXSm5UVUZrWjFSRVFWeDFNREF5Tm5OcFoyZzlaV0UwZDB0YWVHZE9jV2RjZFRBd01qWmphV1E5UTBGUlUxQjNRMDVKY2t4TlpVeEJhVFV3WlVwR1ZteERXbEZhVDFsWlZqaHRlVkJqVWsxNlNXSm5WblIyYTNwVldVcHFWMXBpUjBsVVVYSXRVa2swZGkxR05VMWZjR1J2V0ZwRVJFUTBXbVJ3Y2tweFdta3RTbmxuSWl4YmJuVnNiQ3h1ZFd4c0xHNTFiR3dzSW1oMGRIQnpPaTh2WkdsemNHeGhlV0ZrY3kxbWIzSnRZWFJ6TG1kdmIyZHNaWFZ6WlhKamIyNTBaVzUwTG1OdmJTOWhaSE12Y0hKbGRtbGxkeTlqYjI1MFpXNTBMbXB6UDJOc2FXVnVkRDEzZEdGY2RUQXdNalp2WW1aMWMyTmhkR1ZrUTNWemRHOXRaWEpKWkQwek1qVTJPRFEzT1RNMVhIVXdNREkyWTNKbFlYUnBkbVZKWkQwME56YzBNell4TnpRME9ETmNkVEF3TWpaMlpYSnphVzl1U1dROU1GeDFNREF5Tm1Ga1IzSnZkWEJEY21WaGRHbDJaVWxrUFRRMU5EWTROREkwT0RnME4xeDFNREF5Tm1oMGJXeFFZWEpsYm5SSlpEMXdjbVYyTFRCY2RUQXdNalpvWldsbmFIUTlNalV3WEhVd01ESTJkMmxrZEdnOU16QXdYSFV3TURJMmMybG5QVUZEYVZaQ1gzb3dXbU5FTjJFNWJFNXNObk5RY1VsaGRHOUlUMFo0TmtOcVMwRWlYU3h1ZFd4c0xHNTFiR3dzTVN3aVQxRmpORU5GYWs1emVFRkphalZoY3pad01FNUZUVzVvY0dacmJVZE1aV0UxYlhOcFF6STFiR1F5VG05aFYwMTFXVEk1ZEUxblkwbENVazFaYTFSTlZWRm9aR3BaVXpGM1pGZEpkRTlVV1RST1ZHTjZUa1JSTUU1VVVUTk9hbWQ0VGtWblIxZEJUbmRCVVNJc0lqRXdORFUwT1RJeE5ERTNJbDFkWFN4Yk1Td3hMREZkWFotajQ0NmJwWlY0cXhVbG8tREpnb2hQVlVKTWJxc3VnV0JrcEhZd2NyUHd5YXZDT0tXTVR6UzNZVy02RHlQZmE5VjdONzFnaVpLREFQT0hzNDZUT2ItN01DRUdmbzlYYXVjOVFfYXpPSnVmYWNpSXdTME1TQ2tTSkhWdG9SRnVFZXVEWmNCODVKRlcxdVRZNnFmMUhLZWhTS0lFOENPdVpQVmlCdE9faEJOWW1hQVBZRkFya3hjVEN2WnNFeERMbjZOSXJ0UnpvZmdoekFnbUZPZjBWWEd2aFJvOEZ5b3VMbkduMnZFWVhyQXJtRXZzeHdJSmwweTJaTTUxR2NHSERSdnBjQlN0a25wbnl4S1NYakxVQnpidkxYVV9VX1pVSjhEWHZYbHJBdW1Oa3YxZGJTbWtDNlFuaTdfWHBsVXJLa0dpQ05jdU82a1ZvRnJfU08zdWxoSSxOaWpRNW05bkI1UWx5WHBsSDE2eU5RJmFtcDtzb3VyY2U9ZGlzcGxheVwiIGlkPWFiZ2wgdGFyZ2V0PV9ibGFuaz48YW1wLWltZyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBoZWlnaHQ9MTUgaS1hbXBodG1sLWxheW91dD1maXhlZCBpLWFtcGh0bWwtc3NyIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2ltYWdlcy9hZGNob2ljZXMvZW4ucG5nIHN0eWxlPXdpZHRoOjc1cHg7aGVpZ2h0OjE1cHg7IHdpZHRoPTc1PjxpbWcgY2xhc3M9XCJpLWFtcGh0bWwtZmlsbC1jb250ZW50IGktYW1waHRtbC1yZXBsYWNlZC1jb250ZW50XCIgZGVjb2Rpbmc9YXN5bmMgc3JjPWh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvaW1hZ2VzL2FkY2hvaWNlcy9lbi5wbmc%2BPC9hbXAtaW1nPjwvYT48L2Rpdj48ZGl2IGNsYXNzPWFiZ2IgaWQ9YWJnYj48YSBocmVmPVwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tL3doeXRoaXNhZD9yZWFzb25zPUFCM2FmR0VBQUFWOVcxdGJXMjUxYkd3c1d6RXdYU3h1ZFd4c0xHNTFiR3dzYm5Wc2JDeGJJamsyTXlKZFhTeGJiblZzYkN3aWFIUjBjSE02THk5bmIyOW5iR1ZoWkhNdVp5NWtiM1ZpYkdWamJHbGpheTV1WlhRdmNHRm5aV0ZrTDJOdmJuWmxjbk5wYjI0dlAyRnBQVU5EZVVKaVRrRXRPRmhmVkVoS2NDMWhMV2RpVHpoeFQyZERTMkV6T1RWb1oybzFZWE0yY0RCT2FrcDJObWMzV1VwRlFVVm5NRmxtVTBsSFExWXRka05DYWtGbFowRmhNMk5wYjJkRWVVRkZSRFJCU1VGeFFVMUNlVUZOU1hGblV6RkJhMTlSVlV4V05UZzRVMFJKUW1WZlZEbGhVV1JTVURGelNGQnFkM3BKYUdGelZtd3hlVjlqYVRRNFREaHpWRGg1Vkc0eVNuWjNhRFpET1d4Qk5scDVabmxwZDBZMGNWWTBkbFJ1ZWtsYVdHcE1Vbmx0YW5KNE1tMHROSFJHYUdGcGFWSk5SSEpETlMxWlYzQnRTbFJhUVhabk1XVkxPRE5aTlVaTVMzTTBTbmxDV21Jd1YwbHFURlJPTkdrMFlqSk9kVEJWTWxwb2FIVmxkbkEyTUdSdVJ6QkhjM3A1U0V3dFVrdFdhRjlvYWpjeFZtVnlRM2hIVFZoc1dqVXhRbWMyUkRoSE5FRTVORFF0Y1hOT1IySkxNMEpGVkVOTldIUnFOVlptTkZGWGNXSTVRVmh2Y1U1WlpGZHdVR05CUzI1cE1rVnFkM2d5VkRCSU5FZHZiMUpoYUdaRWMyOVplRmhCVG1WS1FURXhhSFV6VFd4dGFISldkSFk1VERZMmRHZG5NekJWVERKMFJYRnFOVUpuWlVObllqUjZhVkl0ZURGT05YcDNVV0V6VWxKNFNVVldWbFo2ZG1WVGVGQnNOR1ZEUlhkRGNYcHdNMVJ1WXpsMmJraEpjbXRIWTFFMk1VSlhhRVJPV2toa2J6ZHBXSGswY2tGSFUzaHlPRXg1YTI1blYzQjFZblZmUW1ab2RuWkpWemhyWlROcFlreHJiSFpCUmxVeWJuTkJSUzFsVkdOb1gzTkRORUZSUW05QldVUm5RV1poWjAxa2NuRkJabFo1VW5WdlFsOUVXa2MyWjBnNGRHdGljVUZsVDNwb2RXOUNOVkJaUnpablNIVm5ZVzlDTFRaWGMxRkxiMEkyWVMxSE5tZElOMDVWWW5GQlpub3dVblZ2UWkxNlZrYzJaMGhzZEdkaU1rRmpRakJuWjBwRFNVUm9aMFZCVVVGU1oyUTRaMmRpV1ZkU05FeFlUakZaYms0MVlta3dNMDFxV1hwT1ZHTjZUa1JSTWs5RVFUQk5SR00wYzFGcmNFOVNURzg1Y2tsM2NXOUJTMEUxWjB4QlkyZE1RV0puVFVGa1oxUkVRVngxTURBeU5uTnBaMmc5WldFMGQwdGFlR2RPY1dkY2RUQXdNalpqYVdROVEwRlJVMUIzUTA1SmNreE5aVXhCYVRVd1pVcEdWbXhEV2xGYVQxbFpWamh0ZVZCalVrMTZTV0puVm5SMmEzcFZXVXBxVjFwaVIwbFVVWEl0VWtrMGRpMUdOVTFmY0dSdldGcEVSRVEwV21Sd2NrcHhXbWt0U25sbklpeGJiblZzYkN4dWRXeHNMRzUxYkd3c0ltaDBkSEJ6T2k4dlpHbHpjR3hoZVdGa2N5MW1iM0p0WVhSekxtZHZiMmRzWlhWelpYSmpiMjUwWlc1MExtTnZiUzloWkhNdmNISmxkbWxsZHk5amIyNTBaVzUwTG1welAyTnNhV1Z1ZEQxM2RHRmNkVEF3TWpadlltWjFjMk5oZEdWa1EzVnpkRzl0WlhKSlpEMHpNalUyT0RRM09UTTFYSFV3TURJMlkzSmxZWFJwZG1WSlpEMDBOemMwTXpZeE56UTBPRE5jZFRBd01qWjJaWEp6YVc5dVNXUTlNRngxTURBeU5tRmtSM0p2ZFhCRGNtVmhkR2wyWlVsa1BUUTFORFk0TkRJME9EZzBOMXgxTURBeU5taDBiV3hRWVhKbGJuUkpaRDF3Y21WMkxUQmNkVEF3TWpab1pXbG5hSFE5TWpVd1hIVXdNREkyZDJsa2RHZzlNekF3WEhVd01ESTJjMmxuUFVGRGFWWkNYM293V21ORU4yRTViRTVzTm5OUWNVbGhkRzlJVDBaNE5rTnFTMEVpWFN4dWRXeHNMRzUxYkd3c01Td2lUMUZqTkVORmFrNXplRUZKYWpWaGN6WndNRTVGVFc1b2NHWnJiVWRNWldFMWJYTnBRekkxYkdReVRtOWhWMDExV1RJNWRFMW5ZMGxDVWsxWmExUk5WVkZvWkdwWlV6RjNaRmRKZEU5VVdUUk9WR042VGtSUk1FNVVVVE5PYW1kNFRrVm5SMWRCVG5kQlVTSXNJakV3TkRVME9USXhOREUzSWwxZFhTeGJNU3d4TERGZFhaLWo0NDZicFpWNHF4VWxvLURKZ29oUFZVSk1icXN1Z1dCa3BIWXdjclB3eWF2Q09LV01UelMzWVctNkR5UGZhOVY3TjcxZ2laS0RBUE9IczQ2VE9iLTdNQ0VH&i=4-8&t=adltag_khuyave2_Ro2GcN1ZuKC&r=1f108ed0123b951ab5d3ceaeb7b5f63&c=math-aids-threatpost&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.58 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
D2POxJleIt92FyXaxSi7iRHuNLtujALh
via
1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
4101
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:10 GMT
server
AmazonS3
date
Mon, 23 Nov 2020 18:28:02 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
c_021fvgvzpdAGkb2f3Zzxwnr3FymHKUVbfy4EZxLs0JbAeNo2EhTw==
tag
math-aids-threatpost-tagan.adlightning.com/
0
426 B
Other
General
Full URL
https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=Zm85WGF1YzlRX2F6T0p1ZmFjaUl3UzBNU0NrU0pIVnRvUkZ1RWV1RFpjQjg1SkZXMXVUWTZxZjFIS2VoU0tJRThDT3VaUFZpQnRPX2hCTlltYUFQWUZBcmt4Y1RDdlpzRXhETG42TklydFJ6b2ZnaHpBZ21GT2YwVlhHdmhSbzhGeW91TG5HbjJ2RVlYckFybUV2c3h3SUpsMHkyWk01MUdjR0hEUnZwY0JTdGtucG55eEtTWGpMVUJ6YnZMWFVfVV9aVUo4RFh2WGxyQXVtTmt2MWRiU21rQzZRbmk3X1hwbFVyS2tHaUNOY3VPNmtWb0ZyX1NPM3VsaEksTmlqUTVtOW5CNVFseVhwbEgxNnlOUSZhbXA7c291cmNlPWRpc3BsYXlcIiB0YXJnZXQ9X2JsYW5rPjxhbXAtaW1nIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGhlaWdodD0xNSBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIGktYW1waHRtbC1zc3Igc3JjPWh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvaW1hZ2VzL2FkY2hvaWNlcy9pY29uLnBuZyBzdHlsZT13aWR0aDoxNXB4O2hlaWdodDoxNXB4OyB3aWR0aD0xNT48aW1nIGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPWFzeW5jIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2ltYWdlcy9hZGNob2ljZXMvaWNvbi5wbmc%2BPC9hbXAtaW1nPjwvYT48L2Rpdj48L2Rpdj48YW1wLWFuYWx5dGljcyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4OyB0cmlnZ2VyPWltbWVkaWF0ZT48c2NyaXB0IHR5cGU9YXBwbGljYXRpb24vanNvbj57XCJyZXF1ZXN0c1wiOiB7XCJyZXBvcnROb0xhYmVsSW5zdGFuY2VcIjogXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvY29udmVyc2lvbi8%2FYWk9Q0N5QmJOQS04WF9USEpwLWEtZ2JPOHFPZ0NLYTM5NWhnajVhczZwME5qSnY2ZzdZSkVBRWcwWWZTSUdDVi12Q0JqQWVnQWEzY2lvZ0R5QUVENEFJQXFBTUJ5QU1JcWdTMUFrX1FVTFY1ODhTRElCZV9UOWFRZFJQMXNIUGp3ekloYXNWbDF5X2NpNDhMOHNUOHlUbjJKdndoNkM5bEE2WnlmeWl3RjRxVjR2VG56SVpYakxSeW1qcngybS00dEZoYWlpUk1EckM1LVlXcG1KVFpBdmcxZUs4M1k1RkxLczRKeUJaYjBXSWpMVE40aTRiMk51MFUyWmhodWV2cDYwZG5HMEdzenlITC1SS1ZoX2hqNzFWZXJDeEdNWGxaNTFCZzZEOEc0QTk0NC1xc05HYkszQkVUQ01YdGo1VmY0UVdxYjlBWG9xTllkV3BQY0FLbmkyRWp3eDJUMEg0R29vUmFoZkRzb1l4WEFOZUpBMTFodTNNbG1oclZ0djlMNjZ0Z2czMFVMMnRFcWo1QmdlQ2diNHppUi14MU41endRYTNSUnhJRVZWVnp2ZVN4UGw0ZUNFd0NxenAzVG5jOXZuSElya0djUTYxQldoRE5aSGRvN2lYeTRyQUdTeHI4THlrbmdXcHVidV9CZmh2dklXOGtlM2liTGtsdkFGVTJuc0FFLWVUY2hfc0M0QVFCb0FZRGdBZmFnTWRycUFmVnlSdW9CX0RaRzZnSDh0a2JxQWVPemh1b0I1UFlHNmdIdWdhb0ItNldzUUtvQjZhLUc2Z0g3TlVicUFmejBSdW9CLXpWRzZnSGx0Z2IyQWNCMGdnSkNJRGhnRUFRQVJnZDhnZ2JZV1I0TFhOMVluTjViaTAzTWpZek5UY3pORFEyT0RBME1EYzRzUWtwT1JMbzlySXdxb0FLQTVnTEFjZ0xBYmdNQWRnVERBJnNpZ2g9ZWE0d0taeGdOcWcmY2lkPUNBUVNQd0NOSXJMTWVMQWk1MGVKRlZsQ1pRWk9ZWVY4bXlQY1JNekliZ1Z0dmt6VVlKaldaYkdJVFFyLVJJNHYtRjVNX3Bkb1haRERENFpkcHJKcVppLUp5ZyZjaWQ9Q0FRU1B3Q05JckxNZUxBaTUwZUpGVmxDWlFaT1lZVjhteVBjUk16SWJnVnR2a3pVWUpqV1piR0lUUXItUkk0di1GNU1fcGRvWFpEREQ0WmRwckpxWmktSnlnJmxhYmVsPSR7bGFiZWx9XCIsXCJyZXBvcnRMYWJlbEluc3RhbmNlXCI6IFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2NvbnZlcnNpb24vP2FpPUNDeUJiTkEtOFhfVEhKcC1hLWdiTzhxT2dDS2EzOTVoZ2o1YXM2cDBOakp2Nmc3WUpFQUVnMFlmU0lHQ1YtdkNCakFlZ0FhM2Npb2dEeUFFRDRBSUFxQU1CeUFNSXFnUzFBa19RVUxWNTg4U0RJQmVfVDlhUWRSUDFzSFBqd3pJaGFzVmwxeV9jaTQ4TDhzVDh5VG4ySnZ3aDZDOWxBNlp5Znlpd0Y0cVY0dlRueklaWGpMUnltanJ4Mm0tNHRGaGFpaVJNRHJDNS1ZV3BtSlRaQXZnMWVLODNZNUZMS3M0SnlCWmIwV0lqTFRONGk0YjJOdTBVMlpoaHVldnA2MGRuRzBHc3p5SEwtUktWaF9oajcxVmVyQ3hHTVhsWjUxQmc2RDhHNEE5NDQtcXNOR2JLM0JFVENNWHRqNVZmNFFXcWI5QVhvcU5ZZFdwUGNBS25pMkVqd3gyVDBINEdvb1JhaGZEc29ZeFhBTmVKQTExaHUzTWxtaHJWdHY5TDY2dGdnMzBVTDJ0RXFqNUJnZUNnYjR6aVIteDFONXp3UWEzUlJ4SUVWVlZ6dmVTeFBsNGVDRXdDcXpwM1RuYzl2bkhJcmtHY1E2MUJXaEROWkhkbzdpWHk0ckFHU3hyOEx5a25nV3B1YnVfQmZodnZJVzhrZTNpYkxrbHZBRlUybnNBRS1lVGNoX3NDNEFRQm9BWURnQWZhZ01kcnFBZlZ5UnVvQl9EWkc2Z0g4dGticUFlT3podW9CNVBZRzZnSHVnYW9CLTZXc1FLb0I2YS1HNmdIN05VYnFBZnowUnVvQi16Vkc2Z0hsdGdiMkFjQjBnZ0pDSURoZ0VBUUFSZ2Q4Z2diWVdSNExYTjFZbk41YmkwM01qWXpOVGN6TkRRMk9EQTBNRGM0c1FrcE9STG85ckl3cW9BS0E1Z0xBY2dMQWJnTUFkZ1REQSZzaWdoPWVhNHdLWnhnTnFnJmNpZD1DQVFTUHdDTklyTE1lTEFpNTBlSkZWbENaUVpPWVlWOG15UGNSTXpJYmdWdHZrelVZSmpXWmJHSVRRci1SSTR2LUY1TV9wZG9YWkRERDRaZHBySnFaaS1KeWcmY2lkPUNBUVNQd0NOSXJMTWVMQWk1MGVKRlZsQ1pRWk9ZWVY4bXlQY1JNekliZ1Z0dmt6VVlKaldaYkdJVFFyLVJJNHYtRjVNX3Bkb1haRERENFpkcHJKcVppLUp5ZyZsYWJlbD0ke2xhYmVsfSZsYWJlbF9pbnN0YW5jZT0ke2xhYmVsSW5zdGFuY2V9JmNidD1PUWM0Q0VqTnN4QUlqNWFzNnAwTkVNbmhwZmttR0xlYTVtc2lDMjVsZDJOb2FXTXVZMjl0TWdjSUJSTVlrVE1VUWhkallTMXdkV0l0T1RZNE5UY3pORFEwTlRRM05qZ3hORWdHV0FOd0FRXCJ9LFwidHJhbnNwb3J0XCI6IHtcImJlYWNvblwiOiBmYWxzZSxcInhocnBvc3RcIjogZmFsc2UsXCJpbWFnZVwiOiB0cnVlfSxcInRyaWdnZXJzXCI6IHtcInRyYWNrTXV0ZVwiOiB7XCJvblwiOiBcImNsaWNrXCIsXCJzZWxlY3RvclwiOiBcImxhYmVsW2Zvcj0nc3ByMSddXCIsXCJyZXF1ZXN0XCI6IFwicmVwb3J0Tm9MYWJlbEluc3RhbmNlXCJ9LFwidHJhY2tSZXBvcnRBZFwiOiB7XCJvblwiOiBcImNsaWNrXCIsXCJzZWxlY3RvclwiOiBcImxhYmVsW2Zvcj0nc3ByMiddXCIsXCJyZXF1ZXN0XCI6IFwicmVwb3J0TGFiZWxJbnN0YW5jZVwifSxcInRyYWNrU3VydmV5UmVzcG9uc2VcIjoge1wib25cIjogXCJjbGlja1wiLFwic2VsZWN0b3JcIjogXCJsYWJlbFtmb3I9J3NwcjMnXVwiLFwicmVxdWVzdFwiOiBcInJlcG9ydExhYmVsSW5zdGFuY2VcIn0sXCJ0cmFja1doeVRoaXNBZFwiOiB7XCJvblwiOiBcImNsaWNrXCIsXCJzZWxlY3RvclwiOiBcIiNzYnRuXCIsXCJyZXF1ZXN0XCI6IFwicmVwb3J0TGFiZWxJbnN0YW5jZVwifX19PC9zY3JpcHQ%2BPC9hbXAtYW5hbHl0aWNzPjxmb3JtIGFjdGlvbj0vL2cuY28gY2xhc3M9XCJzdiBqdCBhbXAtYW5pbWF0ZSBhYmdmIHBlblwiIGlkPW10YSB0YXJnZXQ9X2JsYW5rPjxpbnB1dCBpZD1zcHIwIG5hbWU9YSB0eXBlPXJhZGlvPjxpbnB1dCBpZD1zcHIxIG5hbWU9YSB0eXBlPXJhZGlvPjxpbnB1dCBpZD1zcHIyIG5hbWU9YSB0eXBlPXJhZGlvPjxpbnB1dCBpZD1zcHIzIG5hbWU9YSB0eXBlPXJhZGlvPjxsYWJlbCBjbGFzcz1cImNiYiBwZWFcIiBkYXRhLXZhcnMtbGFiZWw9dXNlcl9mZWVkYmFja19tZW51X2ludGVyYWN0aW9uIGZvcj1zcHIxIGlkPWNiYj48c3ZnIGhlaWdodD0xNSB3aWR0aD0xNSB4bWxucz0vL3d3dy53My5vcmcvMjAwMC9zdmc%2BPHBhdGggZD1NMCwwbDE1LDBsMCwxNWwtMTUsMFogZmlsbD0jY2RjY2NjPjwvcGF0aD48cGF0aCBkPU0zLjI1LDMuMjVsOC41LDguNU0xMS43NSwzLjI1bC04LjUsOC41IHN0cm9rZT0jMDBhZWNkIHN0cm9rZS13aWR0aD0xLjI1PjwvcGF0aD48L3N2Zz48L2xhYmVsPjxkaXYgY2xhc3M9XCJwbiBhYmdmXCIgaWQ9c3B2MT48YW1wLWZpdC10ZXh0IGNsYXNzPVwiZmwgaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaGVpZ2h0PTI4MCBpLWFtcGh0bWwtbGF5b3V0PXJlc3BvbnNpdmUgbGF5b3V0PXJlc3BvbnNpdmUgbWF4LWZvbnQtc2l6ZT0yMCBtaW4tZm9udC1zaXplPTggd2lkdGg9MzM2PjxpLWFtcGh0bWwtc2l6ZXIgc3R5bGU9ZGlzcGxheTpibG9jaztwYWRkaW5nLXRvcDo4My4zMzMzJTs%2BPC9pLWFtcGh0bWwtc2l6ZXI%2BPGRpdiBjbGFzcz1jbG9zZSBpZD1tZW51LWRpc21pc3M%2BPGxhYmVsIGZvcj1zcHIwPjxzdmcgdmlld2JveD1cIjAgMCAyNCAyNFwiPjxwYXRoIGNsYXNzPW5hdGl2ZS1hcnJvdyBkPVwiTTIwIDExSDcuODNsNS41OS01LjU5TDEyIDRsLTggOCA4IDggMS40MS0xLjQxTDcuODMgMTNIMjB2LTJ6XCI%2BPC9wYXRoPjwvc3ZnPjwvbGFiZWw%2BPC9kaXY%2BPGRpdiBpZD10aT48c3BhbiBjbGFzcz1jdD5BZHMgYnkgPHN2ZyBmaWxsPSMwMDAwMDAgdmlld2JveD1cIjAgMCA2MCAyNFwiIHhtbG5zPWh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnPjxwYXRoIGQ9XCJNNy41IDE2LjI5Yy00LjA3IDAtNy40OS0zLjMxLTcuNDktNy4zOFMzLjQzIDEuNTMgNy41IDEuNTNjMi4yNSAwIDMuODUuODggNS4wNiAyLjAzbC0xLjQyIDEuNDJjLS44Ny0uODEtMi4wNC0xLjQ0LTMuNjQtMS40NC0yLjk3IDAtNS4yOSAyLjQtNS4yOSA1LjM3czIuMzIgNS4zNyA1LjI5IDUuMzdjMS45MyAwIDMuMDMtLjc3IDMuNzMtMS40OC41OC0uNTguOTUtMS40IDEuMS0yLjU0SDcuNVY4LjI0aDYuNzljLjA3LjM2LjExLjc5LjExIDEuMjYgMCAxLjUxLS40MSAzLjM5LTEuNzUgNC43Mi0xLjMgMS4zNS0yLjk1IDIuMDctNS4xNSAyLjA3em0xNy43NS00Ljc2YzAgMi43NC0yLjEzIDQuNzUtNC43NSA0Ljc1cy00Ljc1LTIuMDItNC43NS00Ljc1YzAtMi43NSAyLjEzLTQuNzUgNC43NS00Ljc1czQuNzUgMiA0Ljc1IDQuNzV6bS0yLjA4IDBjMC0xLjcxLTEuMjQtMi44OC0yLjY3LTIuODhzLTIuNjcgMS4xNy0yLjY3IDIuODhjMCAxLjY5IDEuMjQgMi44OCAyLjY3IDIuODhzMi42Ny0xLjE4IDIuNjctMi44OHptMTMuMDggMGMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEyLjU4LTQuNDZ2OC41M2MwIDMuNTEtMi4wNyA0Ljk1LTQuNTIgNC45NS0yLjMgMC0zLjY5LTEuNTUtNC4yMS0yLjgxbDEuODItLjc2Yy4zMi43NyAxLjEyIDEuNjkgMi4zOSAxLjY5IDEuNTcgMCAyLjU0LS45NyAyLjU0LTIuNzl2LS42OGgtLjA3Yy0uNDcuNTgtMS4zNyAxLjA4LTIuNSAxLjA4LTIuMzggMC00LjU2LTIuMDctNC41Ni00Ljc0IDAtMi42OCAyLjE4LTQuNzcgNC41Ni00Ljc3IDEuMTMgMCAyLjAzLjUgMi41IDEuMDZoLjA3di0uNzZoMS45OHptLTEuODQgNC40OGMwLTEuNjctMS4xMi0yLjktMi41NC0yLjktMS40NCAwLTIuNjUgMS4yMi0yLjY1IDIuOSAwIDEuNjYgMS4yMSAyLjg2IDIuNjUgMi44NiAxLjQzLjAxIDIuNTQtMS4yIDIuNTQtMi44NnptNS44OS05LjUyVjE2aC0yLjA5VjIuMDNoMi4wOXptOC40OSAxMS4wN2wxLjYyIDEuMDhjLS41Mi43Ny0xLjc4IDIuMTEtMy45NiAyLjExLTIuNyAwLTQuNzItMi4wOS00LjcyLTQuNzUgMC0yLjgzIDIuMDMtNC43NSA0LjQ4LTQuNzUg&i=5-8&t=adltag_khuyave2_Ro2GcN1ZuKC&r=1f108ed0123b951ab5d3ceaeb7b5f63&c=math-aids-threatpost&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.58 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
D2POxJleIt92FyXaxSi7iRHuNLtujALh
via
1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
4100
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:10 GMT
server
AmazonS3
date
Mon, 23 Nov 2020 18:28:02 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
4rAEJ46DpHAvAGvPjTrv2HxE3PwdVnCsRIZn6Z7JE41I5yAe8BINpQ==
tag
math-aids-threatpost-tagan.adlightning.com/
0
424 B
Other
General
Full URL
https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=Mi40NyAwIDMuNjcgMS45NiA0LjA3IDMuMDJsLjIyLjU0LTYuMzYgMi42M2MuNDkuOTUgMS4yNCAxLjQ0IDIuMyAxLjQ0IDEuMDcgMCAxLjgxLS41MyAyLjM1LTEuMzJ6bS00Ljk5LTEuNzFsNC4yNS0xLjc2Yy0uMjMtLjU5LS45NC0xLjAxLTEuNzYtMS4wMS0xLjA2IDAtMi41NC45My0yLjQ5IDIuNzd6XCI%2BPC9wYXRoPjxwYXRoIGQ9XCJNMCAwaDYydjI0SDB6XCIgZmlsbD1ub25lPjwvcGF0aD48L3N2Zz48L3NwYW4%2BPC9kaXY%2BPGRpdiBpZD1idG5zPjxsYWJlbCBkYXRhLXZhcnMtbGFiZWw9dXNlcl9mZWVkYmFja19tZW51X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MSBmb3I9c3ByMj48YSBjbGFzcz1idG4gaWQ9cmJ0bj48c3Bhbj5TZW5kIGZlZWRiYWNrPC9zcGFuPjwvYT48L2xhYmVsPjxsYWJlbD48YSBjbGFzcz1idG4gZGF0YS12YXJzLWxhYmVsPWNsb3NlYnV0dG9uX3doeXRoaXNhZF9jbGljayBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MSBocmVmPVwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tL3doeXRoaXNhZD9yZWFzb25zPUFCM2FmR0VBQUFWOVcxdGJXMjUxYkd3c1d6RXdYU3h1ZFd4c0xHNTFiR3dzYm5Wc2JDeGJJamsyTXlKZFhTeGJiblZzYkN3aWFIUjBjSE02THk5bmIyOW5iR1ZoWkhNdVp5NWtiM1ZpYkdWamJHbGpheTV1WlhRdmNHRm5aV0ZrTDJOdmJuWmxjbk5wYjI0dlAyRnBQVU5EZVVKaVRrRXRPRmhmVkVoS2NDMWhMV2RpVHpoeFQyZERTMkV6T1RWb1oybzFZWE0yY0RCT2FrcDJObWMzV1VwRlFVVm5NRmxtVTBsSFExWXRka05DYWtGbFowRmhNMk5wYjJkRWVVRkZSRFJCU1VGeFFVMUNlVUZOU1hGblV6RkJhMTlSVlV4V05UZzRVMFJKUW1WZlZEbGhVV1JTVURGelNGQnFkM3BKYUdGelZtd3hlVjlqYVRRNFREaHpWRGg1Vkc0eVNuWjNhRFpET1d4Qk5scDVabmxwZDBZMGNWWTBkbFJ1ZWtsYVdHcE1Vbmx0YW5KNE1tMHROSFJHYUdGcGFWSk5SSEpETlMxWlYzQnRTbFJhUVhabk1XVkxPRE5aTlVaTVMzTTBTbmxDV21Jd1YwbHFURlJPTkdrMFlqSk9kVEJWTWxwb2FIVmxkbkEyTUdSdVJ6QkhjM3A1U0V3dFVrdFdhRjlvYWpjeFZtVnlRM2hIVFZoc1dqVXhRbWMyUkRoSE5FRTVORFF0Y1hOT1IySkxNMEpGVkVOTldIUnFOVlptTkZGWGNXSTVRVmh2Y1U1WlpGZHdVR05CUzI1cE1rVnFkM2d5VkRCSU5FZHZiMUpoYUdaRWMyOVplRmhCVG1WS1FURXhhSFV6VFd4dGFISldkSFk1VERZMmRHZG5NekJWVERKMFJYRnFOVUpuWlVObllqUjZhVkl0ZURGT05YcDNVV0V6VWxKNFNVVldWbFo2ZG1WVGVGQnNOR1ZEUlhkRGNYcHdNMVJ1WXpsMmJraEpjbXRIWTFFMk1VSlhhRVJPV2toa2J6ZHBXSGswY2tGSFUzaHlPRXg1YTI1blYzQjFZblZmUW1ab2RuWkpWemhyWlROcFlreHJiSFpCUmxVeWJuTkJSUzFsVkdOb1gzTkRORUZSUW05QldVUm5RV1poWjAxa2NuRkJabFo1VW5WdlFsOUVXa2MyWjBnNGRHdGljVUZsVDNwb2RXOUNOVkJaUnpablNIVm5ZVzlDTFRaWGMxRkxiMEkyWVMxSE5tZElOMDVWWW5GQlpub3dVblZ2UWkxNlZrYzJaMGhzZEdkaU1rRmpRakJuWjBwRFNVUm9aMFZCVVVGU1oyUTRaMmRpV1ZkU05FeFlUakZaYms0MVlta3dNMDFxV1hwT1ZHTjZUa1JSTWs5RVFUQk5SR00wYzFGcmNFOVNURzg1Y2tsM2NXOUJTMEUxWjB4QlkyZE1RV0puVFVGa1oxUkVRVngxTURBeU5uTnBaMmc5WldFMGQwdGFlR2RPY1dkY2RUQXdNalpqYVdROVEwRlJVMUIzUTA1SmNreE5aVXhCYVRVd1pVcEdWbXhEV2xGYVQxbFpWamh0ZVZCalVrMTZTV0puVm5SMmEzcFZXVXBxVjFwaVIwbFVVWEl0VWtrMGRpMUdOVTFmY0dSdldGcEVSRVEwV21Sd2NrcHhXbWt0U25sbklpeGJiblZzYkN4dWRXeHNMRzUxYkd3c0ltaDBkSEJ6T2k4dlpHbHpjR3hoZVdGa2N5MW1iM0p0WVhSekxtZHZiMmRzWlhWelpYSmpiMjUwWlc1MExtTnZiUzloWkhNdmNISmxkbWxsZHk5amIyNTBaVzUwTG1welAyTnNhV1Z1ZEQxM2RHRmNkVEF3TWpadlltWjFjMk5oZEdWa1EzVnpkRzl0WlhKSlpEMHpNalUyT0RRM09UTTFYSFV3TURJMlkzSmxZWFJwZG1WSlpEMDBOemMwTXpZeE56UTBPRE5jZFRBd01qWjJaWEp6YVc5dVNXUTlNRngxTURBeU5tRmtSM0p2ZFhCRGNtVmhkR2wyWlVsa1BUUTFORFk0TkRJME9EZzBOMXgxTURBeU5taDBiV3hRWVhKbGJuUkpaRDF3Y21WMkxUQmNkVEF3TWpab1pXbG5hSFE5TWpVd1hIVXdNREkyZDJsa2RHZzlNekF3WEhVd01ESTJjMmxuUFVGRGFWWkNYM293V21ORU4yRTViRTVzTm5OUWNVbGhkRzlJVDBaNE5rTnFTMEVpWFN4dWRXeHNMRzUxYkd3c01Td2lUMUZqTkVORmFrNXplRUZKYWpWaGN6WndNRTVGVFc1b2NHWnJiVWRNWldFMWJYTnBRekkxYkdReVRtOWhWMDExV1RJNWRFMW5ZMGxDVWsxWmExUk5WVkZvWkdwWlV6RjNaRmRKZEU5VVdUUk9WR042VGtSUk1FNVVVVE5PYW1kNFRrVm5SMWRCVG5kQlVTSXNJakV3TkRVME9USXhOREUzSWwxZFhTeGJNU3d4TERGZFhaLWo0NDZicFpWNHF4VWxvLURKZ29oUFZVSk1icXN1Z1dCa3BIWXdjclB3eWF2Q09LV01UelMzWVctNkR5UGZhOVY3TjcxZ2laS0RBUE9IczQ2VE9iLTdNQ0VHZm85WGF1YzlRX2F6T0p1ZmFjaUl3UzBNU0NrU0pIVnRvUkZ1RWV1RFpjQjg1SkZXMXVUWTZxZjFIS2VoU0tJRThDT3VaUFZpQnRPX2hCTlltYUFQWUZBcmt4Y1RDdlpzRXhETG42TklydFJ6b2ZnaHpBZ21GT2YwVlhHdmhSbzhGeW91TG5HbjJ2RVlYckFybUV2c3h3SUpsMHkyWk01MUdjR0hEUnZwY0JTdGtucG55eEtTWGpMVUJ6YnZMWFVfVV9aVUo4RFh2WGxyQXVtTmt2MWRiU21rQzZRbmk3X1hwbFVyS2tHaUNOY3VPNmtWb0ZyX1NPM3VsaEksTmlqUTVtOW5CNVFseVhwbEgxNnlOUSZhbXA7c291cmNlPWRpc3BsYXlcIiBpZD1zYnRuIHRhcmdldD1fYmxhbms%2BPHNwYW4%2BV2h5IHRoaXMgYWQ%2FwqA8c3ZnIGZpbGw9IzAwMDAwMCBpZD1zaSB2aWV3Ym94PVwiMCAwIDE2IDE2XCIgeG1sbnM9Ly93d3cudzMub3JnLzIwMDAvc3ZnPjxjaXJjbGUgY3g9NiBjeT02IHI9MC42Nz48L2NpcmNsZT48cGF0aCBkPU00LjIsMTEuM1EzLjMsMTEuOCwzLjMsMTAuNzVMMy4zLDQuMVEzLjMsMy4xLDQuMywzLjVMMTAuNCw3LjBRMTIuMCw3LjUsMTAuNCw4LjBMNi42NSwxMC4wTDYuNjUsNy43NWEwLjY1LDAuNjUsMCwxLDAsLTEuMywwTDUuMzUsMTAuNzVhMC45LDAuOSwwLDAsMCwxLjMsMC44TDEyLjcsOC4yUTEzLjcsNy41LDEyLjcsNi43TDMuMywxLjZRMi4yLDEuMywxLjgsMi41TDEuOCwxMi41UTIuMiwxMy45LDMuMywxMy4zTDQuOCwxMi41QTAuMywwLjMsMCwxLDAsNC4yLDExLjNaPjwvcGF0aD48L3N2Zz48L3NwYW4%2BPC9hPjwvbGFiZWw%2BPC9kaXY%2BPC9hbXAtZml0LXRleHQ%2BPC9kaXY%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1zcHYyPjxsYWJlbCBjbGFzcz1cInNiIHNvXCIgZGF0YS12YXJzLWxhYmVsPW11dGVfc3VydmV5X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9NyBmb3I9c3ByMz48ZGl2PjxzcGFuPk5vdCBpbnRlcmVzdGVkIGluIHRoaXMgYWQ8L3NwYW4%2BPC9kaXY%2BPC9sYWJlbD48bGFiZWwgY2xhc3M9XCJzYiBzb1wiIGRhdGEtdmFycy1sYWJlbD1tdXRlX3N1cnZleV9vcHRpb24gZGF0YS12YXJzLWxhYmVsLWluc3RhbmNlPTIgZm9yPXNwcjM%2BPGRpdj48c3Bhbj5TZWVuIHRoaXMgYWQgbXVsdGlwbGUgdGltZXM8L3NwYW4%2BPC9kaXY%2BPC9sYWJlbD48bGFiZWwgY2xhc3M9XCJzYiBzb1wiIGRhdGEtdmFycy1sYWJlbD1tdXRlX3N1cnZleV9vcHRpb24gZGF0YS12YXJzLWxhYmVsLWluc3RhbmNlPTggZm9yPXNwcjM%2BPGRpdj48c3Bhbj5BZCB3YXMgaW5hcHByb3ByaWF0ZTwvc3Bhbj48L2Rpdj48L2xhYmVsPjxsYWJlbCBjbGFzcz1cInNiIHNvXCIgZGF0YS12YXJzLWxhYmVsPW11dGVfc3VydmV5X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MyBmb3I9c3ByMz48ZGl2PjxzcGFuPkFkIGNvdmVyZWQgY29udGVudDwvc3Bhbj48L2Rpdj48L2xhYmVsPjwvZGl2PjxkaXYgY2xhc3M9XCJwbiBhYmdmXCIgaWQ9c3B2Mz48YW1wLWZpdC10ZXh0IGNsYXNzPVwiZmwgaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaGVpZ2h0PTI4MCBpLWFtcGh0bWwtbGF5b3V0PXJlc3BvbnNpdmUgbGF5b3V0PXJlc3BvbnNpdmUgbWF4LWZvbnQtc2l6ZT0xNyBtaW4tZm9udC1zaXplPTggd2lkdGg9MzM2PjxpLWFtcGh0bWwtc2l6ZXIgc3R5bGU9ZGlzcGxheTpibG9jaztwYWRkaW5nLXRvcDo4My4zMzMzJTs%2BPC9pLWFtcGh0bWwtc2l6ZXI%2BPHNwYW4gaWQ9cGN0PlRoYW5rcy4gRmVlZGJhY2sgaW1wcm92ZXMgR29vZ2xlIGFkczwvc3Bhbj48L2FtcC1maXQtdGV4dD48L2Rpdj48ZGl2IGNsYXNzPVwicG4gYWJnZlwiIGlkPXNwdjQ%2BPGFtcC1maXQtdGV4dCBjbGFzcz1cImZsIGktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGhlaWdodD0yODAgaS1hbXBodG1sLWxheW91dD1yZXNwb25zaXZlIGxheW91dD1yZXNwb25zaXZlIG1heC1mb250LXNpemU9MjAgbWluLWZvbnQtc2l6ZT04IHdpZHRoPTMzNj48aS1hbXBodG1sLXNpemVyIHN0eWxlPWRpc3BsYXk6YmxvY2s7cGFkZGluZy10b3A6ODMuMzMzMyU7PjwvaS1hbXBodG1sLXNpemVyPjxzcGFuIGNsYXNzPVwiY3QgZmN0XCI%2BQWQgY2xvc2VkIGJ5IDxzdmcgZmlsbD0jMDAwMDAwIHZpZXdib3g9XCIwIDAgNjAgMjRcIiB4bWxucz1odHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2Zz48cGF0aCBkPVwiTTcuNSAxNi4yOWMtNC4wNyAwLTcuNDktMy4zMS03LjQ5LTcuMzhTMy40MyAxLjUzIDcuNSAxLjUzYzIuMjUgMCAzLjg1Ljg4IDUuMDYgMi4wM2wtMS40MiAxLjQyYy0uODctLjgxLTIuMDQtMS40NC0zLjY0LTEuNDQtMi45NyAwLTUuMjkgMi40LTUuMjkgNS4zN3MyLjMyIDUuMzcgNS4yOSA1LjM3YzEuOTMgMCAzLjAzLS43NyAzLjczLTEuNDguNTgtLjU4Ljk1LTEuNCAxLjEtMi41NEg3LjVWOC4yNGg2Ljc5Yy4wNy4zNi4xMS43OS4xMSAxLjI2IDAgMS41MS0uNDEgMy4zOS0xLjc1IDQuNzItMS4zIDEuMzUtMi45NSAyLjA3LTUuMTUgMi4wN3ptMTcuNzUtNC43NmMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEzLjA4IDBjMCAyLjc0LTIuMTMgNC43NS00Ljc1IDQuNzVzLTQuNzUtMi4wMi00Ljc1LTQuNzVjMC0yLjc1IDIuMTMtNC43NSA0Ljc1LTQuNzVzNC43NSAyIDQuNzUgNC43NXptLTIuMDggMGMwLTEuNzEtMS4yNC0yLjg4LTIuNjctMi44OHMtMi42NyAxLjE3LTIuNjcgMi44OGMwIDEuNjkgMS4yNCAyLjg4IDIuNjcgMi44OHMyLjY3LTEuMTggMi42Ny0yLjg4em0xMi41OC00LjQ2djguNTNjMCAzLjUxLTIuMDcgNC45NS00LjUyIDQuOTUtMi4zIDAtMy42OS0xLjU1LTQuMjEtMi44MWwxLjgyLS43NmMuMzIuNzcgMS4xMiAxLjY5IDIuMzkgMS42OSAxLjU3IDAgMi41NC0uOTcgMi41NC0yLjc5di0uNjhoLS4wN2MtLjQ3LjU4LTEuMzcgMS4wOC0yLjUgMS4wOC0yLjM4IDAtNC41Ni0yLjA3LTQuNTYtNC43NCAwLTIuNjggMi4xOC00Ljc3IDQuNTYtNC43NyAxLjEzIDAgMi4wMy41IDIuNSAxLjA2aC4wN3YtLjc2aDEuOTh6bS0xLjg0IDQuNDhjMC0xLjY3LTEuMTItMi45LTIuNTQtMi45LTEuNDQgMC0yLjY1IDEuMjItMi42NSAyLjkgMCAxLjY2IDEuMjEgMi44NiAyLjY1IDIuODYgMS40My4wMSAyLjU0LTEuMiAyLjU0LTIuODZ6bTUuODktOS41MlYxNmgtMi4wOVYyLjAzaDIuMDl6bTguNDkgMTEuMDdsMS42MiAxLjA4Yy0uNTIuNzctMS43OCAyLjExLTMuOTYgMi4xMS0yLjcgMC00LjcyLTIuMDktNC43Mi00Ljc1IDAtMi44MyAyLjAzLTQuNzUgNC40OC00Ljc1IDIuNDcgMCAzLjY3IDEuOTYgNC4wNy&i=6-8&t=adltag_khuyave2_Ro2GcN1ZuKC&r=1f108ed0123b951ab5d3ceaeb7b5f63&c=math-aids-threatpost&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.58 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
D2POxJleIt92FyXaxSi7iRHuNLtujALh
via
1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
4101
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:10 GMT
server
AmazonS3
date
Mon, 23 Nov 2020 18:28:02 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
RO7o9OReShcx36MsYT62AY_g0z2oHrcV6EcRZ-DiN7t9TFvdD8mbIQ==
tag
math-aids-threatpost-tagan.adlightning.com/
0
425 B
Other
General
Full URL
https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=AzLjAybC4yMi41NC02LjM2IDIuNjNjLjQ5Ljk1IDEuMjQgMS40NCAyLjMgMS40NCAxLjA3IDAgMS44MS0uNTMgMi4zNS0xLjMyem0tNC45OS0xLjcxbDQuMjUtMS43NmMtLjIzLS41OS0uOTQtMS4wMS0xLjc2LTEuMDEtMS4wNiAwLTIuNTQuOTMtMi40OSAyLjc3elwiPjwvcGF0aD48cGF0aCBkPVwiTTAgMGg2MnYyNEgwelwiIGZpbGw9bm9uZT48L3BhdGg%2BPC9zdmc%2BPC9zcGFuPjwvYW1wLWZpdC10ZXh0PjwvZGl2PjwvZm9ybT48L2Rpdj48L2Rpdj48L2Rpdj48YW1wLWFuYWx5dGljcyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4OyB0cmlnZ2VyPWltbWVkaWF0ZT48c2NyaXB0IHR5cGU9YXBwbGljYXRpb24vanNvbj57XCJ0cmFuc3BvcnRcIjoge1wiYmVhY29uXCI6IGZhbHNlLCBcInhocnBvc3RcIjogZmFsc2V9LFwicmVxdWVzdHNcIjoge1widmlzaWJpbGl0eTFcIjogXCJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3Bjcy9hY3RpdmV2aWV3P3hhaT1BS0FPanNzSEJnSndubHQtRmJRM193WHlKcS1SdE5WSnJzT3Q0VGNteU02TFpnYWl5c0dzaXNaRWhXZUFSYi1yQnRMUDVvVmVEcnpTLW0zcUJPXzFpLUgzeld3ejZmTmtEMlVEYmktdFY1Uy1aaXB6Z1hrSU1GZmxxbHhDZWlSRl9BJnNhaT1BTWZsLVlRWV9yUURnYTVDeC1ySlpScFk0cFRuZTV2MUJJdkl1czRKZ0gtNlRZbVFLNm1vYzVzOFktV1daanBJQWJ4YjIyZnR3by1KbnYtWHhVaGJqd0VRRTF5alpSUGx0cko5Sm1vVXhqZU9DSFB4U2Y1MW1fdTBGN2VTaE1GSW1qbncmc2lnPUNnMEFyS0pTekI3WTZTcUdQbXNRRUFFJmNpZD1DQUFTUGVSb2V2YW15U2k1amM4NXVxZDY3RjlUcGM2Ry1aVVNtWUxBX01xLUFvR1VfcXVRbkJRb1dnbnFYckNWOVBVcG1hSmtWNGFuWVdZeC02WE1OTU0maWQ9YW1waW0mbz0ke2VsZW1lbnRYfSwke2VsZW1lbnRZfSZkPSR7ZWxlbWVudFdpZHRofSwke2VsZW1lbnRIZWlnaHR9JnNzPSR7c2NyZWVuV2lkdGh9LCR7c2NyZWVuSGVpZ2h0fSZicz0ke3ZpZXdwb3J0V2lkdGh9LCR7dmlld3BvcnRIZWlnaHR9Jm1jdnQ9JHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9Jm10b3M9MCwwLCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0sJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9JnRvcz0wLDAsJHt0b3RhbFZpc2libGVUaW1lfSwwLDAmdGZzPSR7Zmlyc3RTZWVuVGltZX0mdGxzPSR7bGFzdFNlZW5UaW1lfSZnPSR7bWluVmlzaWJsZVBlcmNlbnRhZ2V9Jmg9JHttYXhWaXNpYmxlUGVyY2VudGFnZX0mdHQ9JHt0b3RhbFRpbWV9JnI9diZhdm1zPWFtcGEmYWRrPTY1NDI4NjYxMlwifSxcInRyaWdnZXJzXCI6IHtcImNvbnRpbnVvdXNWaXNpYmxlXCI6IHtcIm9uXCI6IFwidmlzaWJsZVwiLFwicmVxdWVzdFwiOiBbXCJ2aXNpYmlsaXR5MVwiXSxcInBhcmVudFBvc3RNZXNzYWdlXCI6IFwiaW1wcmVzc2lvbi12aWV3YWJsZVwiLFwidmlzaWJpbGl0eVNwZWNcIjoge1wic2VsZWN0b3JcIjogXCI6cm9vdFwiLFwidmlzaWJsZVBlcmNlbnRhZ2VNaW5cIjogNTAsXCJjb250aW51b3VzVGltZU1pblwiOiAxMDAwfX0sXCJ2aXNpYmlsaXR5Q2hhbmdlZFwiOiB7XCJvblwiOiBcInZpc2libGVcIixcInBhcmVudFBvc3RNZXNzYWdlXCI6IFwidmlzaWJpbGl0eS1jaGFuZ2VkLSR7aW50ZXJzZWN0aW9uUmF0aW99XCIsXCJ2aXNpYmlsaXR5U3BlY1wiOiB7XCJyZXBlYXRcIjogdHJ1ZSxcInNlbGVjdG9yXCI6IFwiOnJvb3RcIixcInZpc2libGVQZXJjZW50YWdlVGhyZXNob2xkc1wiOiBbWzAsMF0sWzAsNV0sWzUsMTBdLFsxMCwxNV0sWzE1LDIwXSxbMjAsMjVdLFsyNSwzMF0sWzMwLDM1XSxbMzUsNDBdLFs0MCw0NV0sWzQ1LDUwXSxbNTAsNTVdLFs1NSw2MF0sWzYwLDY1XSxbNjUsNzBdLFs3MCw3NV0sWzc1LDgwXSxbODAsODVdLFs4NSw5MF0sWzkwLDk1XSxbOTUsMTAwXSxbMTAwLDEwMF1dfX0sXCJpbmlMb2FkXCI6IHtcIm9uXCI6IFwiaW5pLWxvYWRcIixcInBhcmVudFBvc3RNZXNzYWdlXCI6IFwie1xcXCJjXFxcIjpcXFwic2ZjaGFubmVsMlxcXCIsXFxcInBcXFwiOlxcXCJ7XFxcXFxcXCJ1aWRcXFxcXFxcIjpcXFxcXFxcIjJcXFxcXFxcIixcXFxcXFxcIndpZHRoXFxcXFxcXCI6JHtzY3JvbGxXaWR0aH0sXFxcXFxcXCJoZWlnaHRcXFxcXFxcIjoke3Njcm9sbEhlaWdodH19XFxcIixcXFwic1xcXCI6XFxcImNyZWF0aXZlX2dlb21ldHJ5X3VwZGF0ZVxcXCJ9XFxuXCJ9fX08L3NjcmlwdD48L2FtcC1hbmFseXRpY3M%2BPGFtcC1hbmFseXRpY3MgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaS1hbXBodG1sLWxheW91dD1maXhlZCBzdHlsZT13aWR0aDoxcHg7aGVpZ2h0OjFweDsgdHJpZ2dlcj1pbW1lZGlhdGU%2BPHNjcmlwdCB0eXBlPWFwcGxpY2F0aW9uL2pzb24%2Be1widHJhbnNwb3J0XCI6IHtcImJlYWNvblwiOiB0cnVlLCBcInhocnBvc3RcIjogZmFsc2V9LFwicmVxdWVzdHNcIjoge1wiYW1wZW9zXCI6IFwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wY3MvYWN0aXZldmlldz94YWk9QUtBT2pzc0hCZ0p3bmx0LUZiUTNfd1h5SnEtUnROVkpyc090NFRjbXlNNkxaZ2FpeXNHc2lzWkVoV2VBUmItckJ0TFA1b1ZlRHJ6Uy1tM3FCT18xaS1IM3pXd3o2Zk5rRDJVRGJpLXRWNVMtWmlwemdYa0lNRmZscWx4Q2VpUkZfQSZzYWk9QU1mbC1ZUVlfclFEZ2E1Q3gtckpaUnBZNHBUbmU1djFCSXZJdXM0SmdILTZUWW1RSzZtb2M1czhZLVdXWmpwSUFieGIyMmZ0d28tSm52LVh4VWhiandFUUUxeWpaUlBsdHJKOUptb1V4amVPQ0hQeFNmNTFtX3UwRjdlU2hNRkltam53JnNpZz1DZzBBcktKU3pCN1k2U3FHUG1zUUVBRSZjaWQ9Q0FBU1BlUm9ldmFteVNpNWpjODV1cWQ2N0Y5VHBjNkctWlVTbVlMQV9NcS1Bb0dVX3F1UW5CUW9XZ25xWHJDVjlQVXBtYUprVjRhbllXWXgtNlhNTk1NJmlkPWFtcGVvcyZvPSR7ZWxlbWVudFh9LCR7ZWxlbWVudFl9JmQ9JHtlbGVtZW50V2lkdGh9LCR7ZWxlbWVudEhlaWdodH0mc3M9JHtzY3JlZW5XaWR0aH0sJHtzY3JlZW5IZWlnaHR9JmJzPSR7dmlld3BvcnRXaWR0aH0sJHt2aWV3cG9ydEhlaWdodH0mbWN2dD0ke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mbXRvcz0wLDAsJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9LCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mdG9zPTAsMCwke3RvdGFsVmlzaWJsZVRpbWV9LDAsMCZ0ZnM9JHtmaXJzdFNlZW5UaW1lfSZ0bHM9JHtsYXN0U2VlblRpbWV9Jmc9JHttaW5WaXNpYmxlUGVyY2VudGFnZX0maD0ke21heFZpc2libGVQZXJjZW50YWdlfSZwdD0ke3BhZ2VMb2FkVGltZX0mdHQ9JHt0b3RhbFRpbWV9JnJwdD0ke25hdlRpbWluZyhuYXZpZ2F0aW9uU3RhcnQsbG9hZEV2ZW50U3RhcnQpfSZyc3Q9JHtuYXZUaW1pbmcobmF2aWdhdGlvblN0YXJ0KX0mcj1kZSZpc2Q9JHtpbml0aWFsU2Nyb2xsRGVwdGh9Jm1zZD0ke21heFNjcm9sbERlcHRofSZhdm1zPWFtcGFcIn0sXCJ0cmlnZ2Vyc1wiOiB7XCJlbmRPZlNlc3Npb25cIjoge1wib25cIjogXCJ2aXNpYmxlXCIsXCJyZXF1ZXN0XCI6IFwiYW1wZW9zXCIsXCJ2aXNpYmlsaXR5U3BlY1wiOiB7XCJyZXBvcnRXaGVuXCI6IFwiZG9jdW1lbnRFeGl0XCIsXCJzZWxlY3RvclwiOiBcIjpyb290XCIsXCJ2aXNpYmxlUGVyY2VudGFnZU1pblwiOiA1MH19fX08L3NjcmlwdD48L2FtcC1hbmFseXRpY3M%2BPGRpdiBzdHlsZT1cImJvdHRvbTowO3JpZ2h0OjA7d2lkdGg6MzM2cHg7aGVpZ2h0OjI4MHB4O2JhY2tncm91bmQ6aW5pdGlhbDtwb3NpdGlvbjphYnNvbHV0ZTttYXgtd2lkdGg6MTAwJTttYXgtaGVpZ2h0OjEwMCU7cG9pbnRlci1ldmVudHM6bm9uZTtpbWFnZS1yZW5kZXJpbmc6cGl4ZWxhdGVkO3otaW5kZXg6MjE0NzQ4MzY0NztiYWNrZ3JvdW5kLWltYWdlOnVybCgmIzM5O2RhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQ3NBQUFBV0JBTUFBQUNybDNpQUFBQUFCbEJNVkVVQUFBRCtBY2lXbVp6V0FBQUFBblJTVGxNQUFwaWRyQlFBQUFCK1NVUkJWQmpUYlpBQkRzQWdDQVBMRC9yLzEyN1FBcm9NRTJOandiUEFmNFVxVDdsR3NXNEpabzBxeDd2WFlaVjh0ZU5RZXg5dWFmZk9YdFZ2eDRka3F6bUdHeWM2WktZb21rYXkzeDRlMjJsZ2VyYkliY1dBNHlhaHB5dVk0WTdtRWtuL3kyTjlIcElORUxnVGRPVFpjbk1iNWt4UVhVNXhFL1FucStNQnowa0dVVE1WQzJZQUFBQUFTVVZPUks1Q1lJST0mIzM5Oyk7XCI%2BPC9kaXY%2BPGFtcC1waXhlbCBhbGxvdy1zc3ItaW1nIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9XCJodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvYWR2aWV3P2FpPUNDOWJkTkEtOFhfVEhKcC1hLWdiTzhxT2dDS2EzOTVoZ2o1YXM2cDBOakp2Nmc3WUpFQUVnMFlmU0lHQ1YtdkNCakFlZ0FhM2Npb2dEeUFFRDRBSUFxQU1CeUFNSXFnU3lBa19RVUxWNTg4U0RJQmVfVDlhUWRSUDFzSFBqd3pJaGFzVmwxeV9jaTQ4TDhzVDh5VG4ySnZ3aDZDOWxBNlp5Znlpd0Y0cVY0dlRueklaWGpMUnltanJ4Mm0tNHRGaGFpaVJNRHJDNS1ZV3BtSlRaQXZnMWVLODNZNUZMS3M0SnlCWmIwV0lqTFRONGk0YjJOdTBVMlpoaHVldnA2MGRuRzBHc3p5SEwtUktWaF9oajcxVmVyQ3hHTVhsWjUxQmc2RDhHNEE5NDQtcXNOR2JLM0JFVENNWHRqNVZmNFFXcWI5QVhvcU5ZZFdwUGNBS25pMkVqd3gyVDBINEdvb1JhaGZEc29ZeFhBTmVKQTExaHUzTWxtaHJWdHY5TDY2dGdnMzBVTDJ0RXFqNUJnZUNnYjR6aVIteDFONXp3UWEzUlJ4SUVWVlZ6dmVTeFBsNGVDRXdDcXpwM1RuYzl2bkhJcmtHY1E2MUJXaEROWkhkbzdpWHk0ckFHU3hyOEx5a25nV3B1YnEzRGNJa2t1b2tLLXA3XzJaSXctY0FFLWVUY2hfc0M0QVFCa2dVRUNBUVlBWklGQkFnRkdBU2dCZ09BQjlxQXgydW9COVhKRzZnSDhOa2JxQWZ5MlJ1b0I0N09HNmdIazlnYnFBZTZCcWdIN3BheEFxZ0hwcjRicUFmczFSdllCd0h5QndRUWlla0gwZ2dKQ0lEaGdFQVFBUmdkOGdnYllXUjRMWE4xWW5ONWJpMDNNall6TlRjek5EUTJPREEwTURjNGdBb0R5QXNCMkJNTXNoY2FDaGdJQVJJVWNIVmlMVGsyT0RVM016UTBORFUwTnpZNE1UUSZhbXA7c2lnaD1yeXJZQW90QlN0QSZhbXA7dHBkPUFHV2hKbXQ4cGVsUTVsNDRtX3RieERoZ3c2WVFHY01lRjM3TGhmVXcyZjl0RWg2eG9RXCIgc3R5bGU9d2lkdGg6MXB4O2hlaWdodDoxcHg7PjxpbWcgc3JjPVwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2Fkdmlldz9haT1DQzliZE5BLThYX1RISnAtYS1nYk84cU9nQ0thMzk1aGdqNWFzNnAwTmpKdjZnN1lKRUFFZzBZZlNJR0NWLXZDQmpBZWdBYTNjaW9nRHlBRUQ0QUlBcUFNQnlBTUlxZ1N5QWtfUVVMVjU4OFNESUJlX1Q5YVFkUlAxc0hQand6SWhhc1ZsMXlfY2k0OEw4c1Q4eVRuMkp2d2g2QzlsQTZaeWZ5aXdGNHFWNHZUbnpJWlhqTFJ5bWpyeDJtLTR0RmhhaWlSTURyQzUtWVdwbUpUWkF2ZzFlSzgzWTVGTEtzNEp5QlpiMFdJakxUTjRpNGIyTnUwVTJaaGh1ZXZwNjBkbkcwR3N6eUhMLVJLVmhfaGo3MVZlckN4R01YbFo1MUJnNkQ4RzRBOTQ0LXFzTkdiSzNCRVRDTVh0ajVWZjRRV3FiOUFYb3FOWWRXcFBjQUtuaTJFand4MlQwSDRHb29SYWhmRHNvWXhYQU5lSkExMWh1M01sbWhyVnR2OUw2NnRnZzMwVUwydEVxajVCZ2VDZ2I0emlSLXgxTjV6d1FhM1JSeElFVlZWenZlU3hQbDRlQ0V3Q3F6cDNUbmM5dm5ISXJrR2NRNjFCV2hETlpIZG83aVh5NHJBR1N4cjhMeWtuZ1dwdWJxM0RjSWtrdW9rSy1wN18yWkl3LWNBRS1lVGNoX3&i=7-8&t=adltag_khuyave2_Ro2GcN1ZuKC&r=1f108ed0123b951ab5d3ceaeb7b5f63&c=math-aids-threatpost&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.58 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
D2POxJleIt92FyXaxSi7iRHuNLtujALh
via
1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
4101
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:10 GMT
server
AmazonS3
date
Mon, 23 Nov 2020 18:28:02 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
i0FAurS_tNXCP9A1C-QbLrqr8D4D22tEGd9E8JHRRnPuqt5uHwaDFg==
tag
math-aids-threatpost-tagan.adlightning.com/
0
424 B
Other
General
Full URL
https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=NDNEFRQmtnVUVDQVFZQVpJRkJBZ0ZHQVNnQmdPQUI5cUF4MnVvQjlYSkc2Z0g4TmticUFmeTJSdW9CNDdPRzZnSGs5Z2JxQWU2QnFnSDdwYXhBcWdIcHI0YnFBZnMxUnZZQndIeUJ3UVFpZWtIMGdnSkNJRGhnRUFRQVJnZDhnZ2JZV1I0TFhOMVluTjViaTAzTWpZek5UY3pORFEyT0RBME1EYzRnQW9EeUFzQjJCTU1zaGNhQ2hnSUFSSVVjSFZpTFRrMk9EVTNNelEwTkRVME56WTRNVFEmYW1wO3NpZ2g9cnlyWUFvdEJTdEEmYW1wO3RwZD1BR1doSm10OHBlbFE1bDQ0bV90YnhEaGd3NllRR2NNZUYzN0xoZlV3MmY5dEVoNnhvUVwiPjwvYW1wLXBpeGVsPjxhbXAtYWQtZXhpdCBjbGFzcz1pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lciBpLWFtcGh0bWwtbGF5b3V0PWNvbnRhaW5lciBpZD1leGl0LWFwaT48c2NyaXB0IHR5cGU9YXBwbGljYXRpb24vanNvbj57XCJmaWx0ZXJzXCI6e30sXCJvcHRpb25zXCI6e1wic3RhcnRUaW1pbmdFdmVudFwiOlwibmF2aWdhdGlvblN0YXJ0XCJ9LFwidGFyZ2V0c1wiOntcImxhbmRpbmdQYWdlXCI6e1wiZmlsdGVyc1wiOltdLFwiZmluYWxVcmxcIjpcImh0dHBzOi8vd3d3Lm5ld2NoaWMuY29tLy1tZW5pY28tbWVucy1ib290cy0zNjE4L3AtMTcyODM4My5odG1sP3V0bV9zb3VyY2U9Z29vZ2xlXFx1MDAyNnV0bV9tZWRpdW09Y3BjX2FkczFcXHUwMDI2dXRtX2NhbXBhaWduPWNuZXctbXMtcC1TS1VGOTU3MjItdXNrLW4wNS0zMDJcXHUwMDI2dXRtX2NvbnRlbnQ9bGVlclxcdTAwMjZ1dG1fZGVzaWduPVxcdTAwMjZ1dG1faG89MjItNjVcXHUwMDI2Z2NsaWQ9RUFJYUlRb2JDaE1JOUxHVC1MU1o3UUlWSDQzZUNoMU8tUWlFRUFFWUFTQUFFZ0lRZmZEX0J3RVwiLFwidHJhY2tpbmdVcmxzXCI6W1wiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvYWNsaz9zYT1sXFx1MDAyNmFpPUNDeUJiTkEtOFhfVEhKcC1hLWdiTzhxT2dDS2EzOTVoZ2o1YXM2cDBOakp2Nmc3WUpFQUVnMFlmU0lHQ1YtdkNCakFlZ0FhM2Npb2dEeUFFRDRBSUFxQU1CeUFNSXFnUzFBa19RVUxWNTg4U0RJQmVfVDlhUWRSUDFzSFBqd3pJaGFzVmwxeV9jaTQ4TDhzVDh5VG4ySnZ3aDZDOWxBNlp5Znlpd0Y0cVY0dlRueklaWGpMUnltanJ4Mm0tNHRGaGFpaVJNRHJDNS1ZV3BtSlRaQXZnMWVLODNZNUZMS3M0SnlCWmIwV0lqTFRONGk0YjJOdTBVMlpoaHVldnA2MGRuRzBHc3p5SEwtUktWaF9oajcxVmVyQ3hHTVhsWjUxQmc2RDhHNEE5NDQtcXNOR2JLM0JFVENNWHRqNVZmNFFXcWI5QVhvcU5ZZFdwUGNBS25pMkVqd3gyVDBINEdvb1JhaGZEc29ZeFhBTmVKQTExaHUzTWxtaHJWdHY5TDY2dGdnMzBVTDJ0RXFqNUJnZUNnYjR6aVIteDFONXp3UWEzUlJ4SUVWVlZ6dmVTeFBsNGVDRXdDcXpwM1RuYzl2bkhJcmtHY1E2MUJXaEROWkhkbzdpWHk0ckFHU3hyOEx5a25nV3B1YnVfQmZodnZJVzhrZTNpYkxrbHZBRlUybnNBRS1lVGNoX3NDNEFRQm9BWURnQWZhZ01kcnFBZlZ5UnVvQl9EWkc2Z0g4dGticUFlT3podW9CNVBZRzZnSHVnYW9CLTZXc1FLb0I2YS1HNmdIN05VYnFBZnowUnVvQi16Vkc2Z0hsdGdiMkFjQjBnZ0pDSURoZ0VBUUFSZ2Q4Z2diWVdSNExYTjFZbk41YmkwM01qWXpOVGN6TkRRMk9EQTBNRGM0c1FrcE9STG85ckl3cW9BS0E1Z0xBY2dMQWJnTUFkZ1REQVxcdTAwMjZhZT0xXFx1MDAyNm51bT0xXFx1MDAyNmNpZD1DQUFTUGVSb2V2YW15U2k1amM4NXVxZDY3RjlUcGM2Ry1aVVNtWUxBX01xLUFvR1VfcXVRbkJRb1dnbnFYckNWOVBVcG1hSmtWNGFuWVdZeC02WE1OTU1cXHUwMDI2c2lnPUFPRDY0XzFPM084OVdpVGxUcEpKUXNJMk1UcGcyd3RDb1FcXHUwMDI2Y2xpZW50PWNhLXB1Yi05Njg1NzM0NDQ1NDc2ODE0XFx1MDAyNm5iPV9nb29nQ2xpY2tMb2NhdGlvblxcdTAwMjZueD1DTElDS19YXFx1MDAyNm55PUNMSUNLX1lcXHUwMDI2YWN0PTFcXHUwMDI2cmk9MVxcdTAwMjZhZHVybD1odHRwczovL3d3dy5uZXdjaGljLmNvbS8tbWVuaWNvLW1lbnMtYm9vdHMtMzYxOC9wLTE3MjgzODMuaHRtbCUzRnV0bV9zb3VyY2UlM0Rnb29nbGUlMjZ1dG1fbWVkaXVtJTNEY3BjX2FkczElMjZ1dG1fY2FtcGFpZ24lM0RjbmV3LW1zLXAtU0tVRjk1NzIyLXVzay1uMDUtMzAyJTI2dXRtX2NvbnRlbnQlM0RsZWVyJTI2dXRtX2Rlc2lnbiUzRCUyNnV0bV9obyUzRDIyLTY1JTI2Z2NsaWQlM0RFQUlhSVFvYkNoTUk5TEdULUxTWjdRSVZINDNlQ2gxTy1RaUVFQUVZQVNBQUVnSVFmZkRfQndFXCJdLFwidmFyc1wiOntcIl9nb29nQ2xpY2tMb2NhdGlvblwiOntcImRlZmF1bHRWYWx1ZVwiOlwiXCIsXCJpZnJhbWVUcmFuc3BvcnRTaWduYWxcIjpcIlwifX19fX08L3NjcmlwdD48L2FtcC1hZC1leGl0PjwvYm9keT48L2h0bWw%2BIiwibWV0aG9kQmxvY2tlZCI6ImluaXRpYWxERlAtd3JpdGUifSwiYmxvY2tlZCI6dHJ1ZSwiY2FsbFN0YWNrIjoiRXJyb3JcbiAgICBhdCBhQyAoaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYi05YTRmN2NlLWE3ZjYwOThjLmpzOjE6MjAyNzApXG4gICAgYXQgYU0gKGh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2ItOWE0ZjdjZS1hN2Y2MDk4Yy5qczoxOjIzODI4KVxuICAgIGF0IEhUTUxEb2N1bWVudC48YW5vbnltb3VzPiAoaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3Qvb3AuanM6MToyMzIxNClcbiAgICBhdCBUdiAoaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvZ3B0L3B1YmFkc19pbXBsXzIwMjAxMTE3MDEuanM%2FMjEwNjg3OTI6NjoyMDQ2MTIpXG4gICAgYXQgeXcubSAoaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvZ3B0L3B1YmFkc19pbXBsXzIwMjAxMTE3MDEuanM%2FMjEwNjg3OTI6NjoyMTI2ODMpXG4gICAgYXQgdHcgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMTExNzAxLmpzPzIxMDY4NzkyOjY6MjA5OTYxKVxuICAgIGF0IEF3LmogKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMTExNzAxLmpzPzIxMDY4NzkyOjY6MjEzNzEwKVxuICAgIGF0IGZkLmwgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMTExNzAxLmpzPzIxMDY4NzkyOjY6MTMyMjUwKVxuICAgIGF0IGhkIChodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9ncHQvcHViYWRzX2ltcGxfMjAyMDExMTcwMS5qcz8yMTA2ODc5Mjo2OjE3NDU4KVxuICAgIGF0IGpkLm5leHQgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMTExNzAxLmpzPzIxMDY4NzkyOjY6MTc3NTApIn0%3D&i=8-8&t=adltag_khuyave2_Ro2GcN1ZuKC&r=1f108ed0123b951ab5d3ceaeb7b5f63&c=math-aids-threatpost&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.58 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
D2POxJleIt92FyXaxSi7iRHuNLtujALh
via
1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
4101
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:10 GMT
server
AmazonS3
date
Mon, 23 Nov 2020 18:28:02 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
Zae3zhm4-wpCoTApCihNNWT2JW97a6oEE2nBqiQyidFRQAKsxLaBvQ==
bl-04a3385-54ec09d8.js
tagan.adlightning.com/math-aids-threatpost/ Frame 0C1B
89 KB
26 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-54ec09d8.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7b74cfb5202288f56ae2eebc0bde0ddf144951f96cf49447d1cb0682fe20e1b7

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 16:58:28 GMT
content-encoding
gzip
age
9474
x-cache
Hit from cloudfront
content-length
26656
x-amz-meta-git_commit
04a3385
last-modified
Mon, 23 Nov 2020 16:57:45 GMT
server
AmazonS3
etag
"2f01427e7dc48cd7fee2958bcc67ab0e"
x-amz-version-id
Wpt7pdoTEhO7HkyBfMrgq7Ms65L0pYBQ
via
1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
OhMCoU_hXxijH-HLrCL5QYFBE0pY0qSYNq1w3H462QiOdAAo-nv5ww==
b-9a4f7ce-a7f6098c.js
tagan.adlightning.com/math-aids-threatpost/ Frame 0C1B
61 KB
21 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 18 Nov 2020 02:53:27 GMT
content-encoding
gzip
age
492174
x-cache
Hit from cloudfront
content-length
20808
x-amz-meta-git_commit
9a4f7ce
last-modified
Tue, 18 Aug 2020 17:45:57 GMT
server
AmazonS3
etag
"98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id
PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via
1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
ykURrobIs0LcfS4SKIwTzC0KuTwSH6EyAP0hpXGtz6m0KIWs1iArNA==
bl-04a3385-54ec09d8.js
tagan.adlightning.com/math-aids-threatpost/ Frame 6CD5
89 KB
26 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-54ec09d8.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7b74cfb5202288f56ae2eebc0bde0ddf144951f96cf49447d1cb0682fe20e1b7

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 16:58:28 GMT
content-encoding
gzip
age
9474
x-cache
Hit from cloudfront
content-length
26656
x-amz-meta-git_commit
04a3385
last-modified
Mon, 23 Nov 2020 16:57:45 GMT
server
AmazonS3
etag
"2f01427e7dc48cd7fee2958bcc67ab0e"
x-amz-version-id
Wpt7pdoTEhO7HkyBfMrgq7Ms65L0pYBQ
via
1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
lTSbD8MF-fHbOQE87P_qh44Wm0FRQOL43QIvk1g-unVe-4ojMwRJqw==
b-9a4f7ce-a7f6098c.js
tagan.adlightning.com/math-aids-threatpost/ Frame 6CD5
61 KB
21 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 18 Nov 2020 02:53:27 GMT
content-encoding
gzip
age
492174
x-cache
Hit from cloudfront
content-length
20808
x-amz-meta-git_commit
9a4f7ce
last-modified
Tue, 18 Aug 2020 17:45:57 GMT
server
AmazonS3
etag
"98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id
PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via
1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
o7Ay28fXAF2KFfkuecA4Nououu3mrTusW6RTt7PQSc2OCw-wYjqVTw==
7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 6CD5
330 B
476 B
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/7464639028652035684
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 06:06:09 GMT
x-content-type-options
nosniff
age
567012
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
330
x-xss-protection
0
last-modified
Tue, 28 Jan 2020 23:02:00 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 17 Nov 2021 06:06:09 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20201112/r20110914/ Frame 6CD5
18 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20201112/r20110914/abg_lite_fy2019.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
80412b3870c5b5349ad52d6393130fe405055e16560a3398a03c9b85302ef320
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:33:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
148
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7327
x-xss-protection
0
server
cafe
etag
4109265994257346226
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 07 Dec 2020 19:33:53 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20201112/r20110914/client/ Frame 6CD5
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20201112/r20110914/client/window_focus_fy2019.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9c8c5ae8437903bcd9d8737d4c119c14492373d06e719215ba9ef065bc5e1186
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 14:39:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
17806
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1336
x-xss-protection
0
server
cafe
etag
4033927919502905291
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 07 Dec 2020 14:39:35 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 6CD5
75 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1605702985553312"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
29194
x-xss-protection
0
expires
Mon, 23 Nov 2020 19:36:21 GMT
l
www.google.com/ads/measurement/ Frame 6CD5
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaT2asSlDoQ4IEvk0SvjvHWZrOnq_RXJWVr1Os4pkgvsUgcZ2TcsEXR-WyqLutSKVh_NNTzi
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

osd.js
www.googletagservices.com/activeview/js/current/
73 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js?21068792
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d56ee6a2ba915ad87e2dc9b49d9199563f3b35f9e048938e84d1a033e5c2b1c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1605702985553312"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28207
x-xss-protection
0
expires
Mon, 23 Nov 2020 19:36:21 GMT
ads
securepubads.g.doubleclick.net/gampad/
79 KB
26 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2158994980634465&correlator=1066746580305877&output=ldjh&impl=fifs&adsid=NT&eid=21068749%2C21068792%2C21068418&vrg=2020111701&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201123&iu_parts=21707124336%2CThreatPost-300x250-ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280&ris=1&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fjoe-biden-campaign-website-hacktivist-defacement%252F161471%252F%26urlquery%3Dgoogfc%26contentid%3D161471%26category%3Dhacks%26contenttags%3Dhacktivist%252Cjoe-biden%252Cjoe-biden-campaign%252Cpresident-elect%252Cturkey%252Cus-government%252Cu-s-presidential-election%252Cwebsite-defacement%252Cwebsite-hack%252Cwebsite-security&cookie=ID%3D8306724993272d13-22ad888344b900be%3AT%3D1606160180%3AS%3DALNI_MbD76NSHngsFYAbajCftiRO_F0Bng&bc=31&abxe=1&lmt=1606160181&dt=1606160181188&dlt=1606160174676&idt=3839&frm=20&biw=1600&bih=1200&oid=3&adxs=1064&adys=417&adks=654286612&ucis=5&ifi=5&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&dssz=44&icsg=167785091&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=336x280&msz=336x280&psts=AGkb-H_nmAyquLgFZVuB6X6At94bOy8y8BdSt3x56uYLFEaCJpQXMafwrIWkcPMA-yqdinhU9iMBAPJWdSV4XjKFYexKYjYVByc&ga_vid=1298927106.1606160179&ga_sid=1606160180&ga_hid=65303539&fws=0&ohw=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js?21068792
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
d4740fa72d8b73cd21cc9eff4e5bb9b639a4f197a406c5a6fe6ebf879deed1bf
Security Headers
Name Value
Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7681916943469774019/300x250_Katze_v2/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7681916943469774019/300x250_Katze_v2/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKTlufi0me0CFUIL4AodyVoOjw&gqi=&layout=/sadbundle/%24csp%253Der3%24/7681916943469774019/300x250_Katze_v2/index.html
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7681916943469774019/300x250_Katze_v2/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7681916943469774019/300x250_Katze_v2/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKTlufi0me0CFUIL4AodyVoOjw&gqi=&layout=/sadbundle/%24csp%253Der3%24/7681916943469774019/300x250_Katze_v2/index.html
content-encoding
br
x-content-type-options
nosniff
google-creative-id
-1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26037
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
date
Mon, 23 Nov 2020 19:36:21 GMT
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
a62a15d7931cfb5f7d4beaf22f1c2f91.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 55A8
0
0
Document
General
Full URL
https://a62a15d7931cfb5f7d4beaf22f1c2f91.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
a62a15d7931cfb5f7d4beaf22f1c2f91.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-37/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
2973
date
Mon, 23 Nov 2020 19:36:20 GMT
expires
Tue, 23 Nov 2021 19:36:20 GMT
last-modified
Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ao
capi.connatix.com/tr/ Frame 6033
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/ao?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:21 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
g
capi.connatix.com/rtb/ Frame 6033
217 B
490 B
XHR
General
Full URL
https://capi.connatix.com/rtb/g?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
87a9bccee0c87e5a827bfacc2206a5550e149a3408c16a427cbe01dbb03d51d6

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:21 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
186
prebid3.25.0-1.js
cds.connatix.com/p/plugins/ Frame 6033
286 KB
89 KB
Script
General
Full URL
https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:21 GMT
via
1.1 varnish, 1.1 varnish
age
6083537
x-cache
HIT, HIT
content-encoding
gzip
content-length
90468
x-served-by
cache-dca17730-DCA, cache-hhn4062-HHN
last-modified
Mon, 14 Sep 2020 09:43:49 GMT
x-timer
S1606160182.732350,VS0,VE0
etag
"9c38c88a790efaae20de0f5391a27029"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
2, 28907
openrtb
ads.adaptv.advertising.com/rtb/ Frame 6033
0
0

prebid
ib.adnxs.com/ut/v3/ Frame 6033
143 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.242 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
02245587b3802de49ddfc90e555a1c921b10282ab0f7918cc1e5e5d87af6d072
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:21 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 724.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.139:80
AN-X-Request-Uuid
9e5bb7ca-b787-4668-a83d-4deee39c4038
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
143
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 6033
142 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.242 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
b4522dc470bf48aed1e044f32d3e0a85bffb47fc51d16ba761fa82e9e110974a
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:21 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 724.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.170:80
AN-X-Request-Uuid
dcbf6c18-5f94-4ecd-b20f-b053b6165573
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
142
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
avjp
teachingaids-d.openx.net/v/1.0/ Frame 6033
92 B
285 B
XHR
General
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=0865ac58-dcdd-4a0c-b51e-1dc839afa5ea&nocache=1606160181795&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882778&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.198.0 /
Resource Hash
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:21 GMT
via
1.1 google
server
OXGW/16.198.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
92
expires
Mon, 26 Jul 1997 05:00:00 GMT
cygnus
as-sec.casalemedia.com/ Frame 6033
24 B
455 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%2296a9575f290b6e%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22109ae2356df2d75%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3b95433ba02ae071b5810de00f8e1a9b500c5758f25a4bc952e1e482d837fdfb

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:21 GMT
Content-Encoding
gzip
Server
Apache
Vary
Is-Traffic-Invalid,Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
44
Expires
Mon, 23 Nov 2020 19:36:21 GMT
cygnus
as-sec.casalemedia.com/ Frame 6033
25 B
456 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%2211d1cf645e6e3e3%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2212f6a50ec5c81ea%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
be58c2f88a746f969c68cf496fb6bbf7ed1966174b99df14804479ba5a2308ea

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:22 GMT
Content-Encoding
gzip
Server
Apache
Vary
Is-Traffic-Invalid,Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
45
Expires
Mon, 23 Nov 2020 19:36:22 GMT
translator
hbopenbid.pubmatic.com/ Frame 6033
0
59 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 23 Nov 2020 19:36:22 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/ Frame 6033
0
59 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 23 Nov 2020 19:36:21 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
avjp
teachingaids-d.openx.net/v/1.0/ Frame 6033
92 B
282 B
XHR
General
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=d34e42ea-472c-425b-bfcd-3c13444cef86&nocache=1606160181803&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882779&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.198.0 /
Resource Hash
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:21 GMT
via
1.1 google
server
OXGW/16.198.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
92
expires
Mon, 26 Jul 1997 05:00:00 GMT
sv
capi.connatix.com/tr/ Frame 6033
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/sv?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:22 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012010270040000/ Frame 54F3
180 KB
50 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
123909
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51478
x-xss-protection
0
server
sffe
date
Sun, 22 Nov 2020 09:11:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"0305d7d21a7fe4a1"
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 22 Nov 2021 09:11:13 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 54F3
13 KB
5 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
191989
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4850
x-xss-protection
0
server
sffe
date
Sat, 21 Nov 2020 14:16:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"77bd676d834aaa8d"
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Nov 2021 14:16:33 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 54F3
90 KB
27 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
191989
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27668
x-xss-protection
0
server
sffe
date
Sat, 21 Nov 2020 14:16:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"1304c1c0caf7ca3c"
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Nov 2021 14:16:33 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 54F3
3 KB
1 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
123552
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1350
x-xss-protection
0
server
sffe
date
Sun, 22 Nov 2020 09:17:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"12c034eb739190af"
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 22 Nov 2021 09:17:10 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 54F3
41 KB
14 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
191988
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13075
x-xss-protection
0
server
sffe
date
Sat, 21 Nov 2020 14:16:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"1e8a1dae72af56cd"
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Nov 2021 14:16:34 GMT
6700709392776282634
tpc.googlesyndication.com/daca_images/simgad/ Frame 54F3
124 KB
124 KB
Image
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/6700709392776282634
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f74e99191bec2d3d7cd58804f92b54564a34766e3a13dc37c556d31dce1aee4d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 21 Nov 2020 19:17:29 GMT
x-content-type-options
nosniff
age
173933
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
126888
x-xss-protection
0
last-modified
Fri, 06 Nov 2020 07:11:45 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Nov 2021 19:17:29 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54F3
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 23 Nov 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
30444
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Tue, 24 Nov 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54F3
295 B
389 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 22 Nov 2020 22:32:01 GMT
x-content-type-options
nosniff
server
cafe
age
75861
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Mon, 23 Nov 2020 22:32:01 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 54F3
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=Ct2v2NA-8X_PHJp-a-gbO8qOgCP62weBdk-emgdsMrJWzmaQXEAEg0YfSIGCV-vCBjAegAbKGrvQCyAEC4AIAqAMByAMIqgSzAk_Q4mYsYo4H3EqJKg1k6Fz8uBEoIaNZ_XL-JNGXcO6gRUDyYElcxsmrmywoTIKgDIsVgl9LD_24FtbdZ9BLGTMxVB-xK7b7RPAFjrW5Nnzo95Y92PCzZay1r3ufiDBJCOcM3D3GuFhwv81Y0lVGottmGIF5--I3dxcKYmBIhAIUmwuwyHYNxebEU6EuXUPrnG-gnhkoG0jJo3kLo2aS-L9JKDywa7EV9GBj16SzEs_GqGUNHphIVdL1H5SjdAFAFpfOEY2Gd2fn_4t7iNAZ4ms9BvnWYZbnrN3vHXK-_gsTXDAY4gu-nmihA5mS1B8fXMYdtUrShTzgBWvAotBSKUY3fNserkhoTTXqOovV3NIqCFmlvhN4uSWcCZENyakFOKm1nTY3xwjMRulgCbUly8MWAQbABKH2ofH0AuAEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYCgAfMl4yeAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBDl6AzSCAkIgOGAQBABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwHYEwyyFxoKGAgBEhRwdWItOTY4NTczNDQ0NTQ3NjgxNA&sigh=5j8nCJTbMCU&tpd=AGWhJmtkvhIvZDfwJSKI_cxvj85-Qc5l-5YJhVbGtDFmAZfqkw
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

truncated
/ Frame 54F3
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
94490f31f9ea17c5facd54d39e950b0d01e8d3000357e809687492f22d68a2fe

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
si
googleads.g.doubleclick.net/pagead/drt/ Frame 54F3
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date
Mon, 23 Nov 2020 19:36:22 GMT
x-content-type-options
nosniff
server
safe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
246
x-xss-protection
0
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012010270040000/ Frame 0C1B
180 KB
50 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
123910
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51478
x-xss-protection
0
server
sffe
date
Sun, 22 Nov 2020 09:11:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"0305d7d21a7fe4a1"
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 22 Nov 2021 09:11:13 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 0C1B
13 KB
5 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
191990
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4850
x-xss-protection
0
server
sffe
date
Sat, 21 Nov 2020 14:16:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"77bd676d834aaa8d"
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Nov 2021 14:16:33 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 0C1B
90 KB
27 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
191990
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27668
x-xss-protection
0
server
sffe
date
Sat, 21 Nov 2020 14:16:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"1304c1c0caf7ca3c"
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Nov 2021 14:16:33 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 0C1B
3 KB
1 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
123553
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1350
x-xss-protection
0
server
sffe
date
Sun, 22 Nov 2020 09:17:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"12c034eb739190af"
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 22 Nov 2021 09:17:10 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 0C1B
41 KB
13 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
191989
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13075
x-xss-protection
0
server
sffe
date
Sat, 21 Nov 2020 14:16:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"1e8a1dae72af56cd"
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Nov 2021 14:16:34 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 0C1B
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 23 Nov 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
30445
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Tue, 24 Nov 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 0C1B
295 B
325 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 22 Nov 2020 22:32:01 GMT
x-content-type-options
nosniff
server
cafe
age
75862
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Mon, 23 Nov 2020 22:32:01 GMT
1579707521371803792
tpc.googlesyndication.com/daca_images/simgad/ Frame 0C1B
42 KB
42 KB
Image
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/1579707521371803792
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
719b70c90e6abca2b15a9a4b71da0f48f2caebfa2504e53ed0439fda8f0d4eae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 13:12:04 GMT
x-content-type-options
nosniff
age
541459
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43149
x-xss-protection
0
last-modified
Wed, 14 Oct 2020 02:04:23 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 17 Nov 2021 13:12:04 GMT
l
www.google.com/ads/measurement/ Frame 0C1B
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRmypJm4JdVJbiw8y9h6Hx--yhydQPmAPaGmuzB_HOk2sZ-Ycp3eAwTWD4OCy-nD8DkpibR
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

adview
securepubads.g.doubleclick.net/pagead/ Frame 0C1B
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CSZudNA-8X_XHJp-a-gbO8qOgCPr7j5BghNmRgIANypeExrscEAEg0YfSIGCV-vCBjAegAeyxw4YDyAECqQKnyHN-wpeoPuACAKgDAcgDCKoEswJP0MLDr1FyylBdfhJcQSjlCA34q9Q5PA6J2Ll2mHFzh1wLeF3zYPzyPEjDGtvML8UHMfANjiGpvHlkNCKhbzA3D-ocpW8E-_ac35Dmb7_zcO_mV0naE6xRD-2frzuOCZFYZjjddf5oUogf-0S9IFSUQm93zmCOQiKpTbjHJ3vPWP8lKB8HBNURSW4njk_azWlwCawPo2CmlI9c-1zlnprUCGN3uYlUvirY0c06-1zliDfuwZJi4eeg5d8w2bgxEZJWJUqvlOnP7nE3yMFfs615aF6opxc9naXN9UN-z0sJ84EtN8jtoTyRThqyrFRi2QCYJ7OIRac24X-vVQNp0UMF3Sz9GqfiWdtijwUBMGlM5UACRv0EUf-KWZ_BhDMmlz73wPVAoVltIJ1TTclKo_rsKxRTwATtksXXngPgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAHwpqTtwGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQs5IJ0ggJCIDhgEAQARgd8ggbYWR4LXN1YnN5bi03MjYzNTczNDQ2ODA0MDc4gAoDyAsB2BMNshcaChgIARIUcHViLTk2ODU3MzQ0NDU0NzY4MTQ&sigh=a71R3e9JEN4&tpd=AGWhJmvyLC-FVLCZeyV6V4wnUF28x5Egpyn546TkqDUsFjpWPw
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

truncated
/ Frame 0C1B
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
058bfaf2afb5cfb81f91c13e2c7178f1f896328698bd83994e00ec8c0b339592

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
si
googleads.g.doubleclick.net/pagead/drt/ Frame 0C1B
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date
Mon, 23 Nov 2020 19:36:23 GMT
x-content-type-options
nosniff
server
safe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
246
x-xss-protection
0
view
securepubads.g.doubleclick.net/pcs/ Frame 6CD5
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu_OUnnV3JFSem-enyLxSePnW0qWiFx7zBN8S0bOAjBcUfrfB-S3duBmKjViiell9Z62LQQ91xDBw8cerHsG7JCcB_GvEOLIzm5gxn2eu-QroPPuU9U0071-pKRvt4MxAi98AWSneCsK8J_HAUf4UPXi2_ik7h_0yjtNzAW7TqoSlwOiw7rosS2dz9Y1w3aKNvyWDZaBq15iQds9dUaFIWloo8G47rGrKdy8veVGfQWyZ-q1rGea2EmYRvwtV1X-km-AS0n3tmqfIXqgiFvpg&sai=AMfl-YR2nSyMbBTN_eWDWTHEcBi_Abyywd9Q6kMpWDPeiITnhHjNd-iiNBnu5TjgSJ08Tpar0ni5FaGfiipgoH7i9opQTdrqSu4rPJQLfTWNhBLDteRLEtEEK2-sVmry705_&sig=Cg0ArKJSzJqmBdu6dv8WEAE&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 23 Nov 2020 19:36:23 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Mon, 23 Nov 2020 19:36:23 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 6CD5
0
338 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvObJk49DWEsE21KJa2DROrIUkV75mCs9_qV5jf3R8-9aCgFS4jULgaxi9sFWlLA6Uc8GbMiMh2Yyzo0VcFjEmhJgpZwxWY_Z8hghD0XvvybU7HhFuVV10vRHfV_82z9D1NSK84on9yW2hsmH9Ahy7apD1yJHNZ40FgOMY-mhXFBXMgNLK3uIskMGeNDvJcZ0BH3mc3GbgfEsBRtpvrNekn7aqGbn9JLXkFG-U7D6lkmBeJWMK8ZJ_xRRvcMklC5ZqEOVY5uV06_XuMF0IOs30V&sai=AMfl-YQ39dXM9pVLeeN-D1XhFRX_Er26HaYGXJZ3XVjFL2m_YIU65S22VHw_wbtZkZVTfgrzmdj8rKd1HBHl1AUbJY16TAKt-ezaFSV3qH-S9G38ciBlQVNMH271mnSphNvz&sig=Cg0ArKJSzBFVkkNAD_0zEAE&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 23 Nov 2020 19:36:23 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Mon, 23 Nov 2020 19:36:23 GMT
truncated
/ Frame 6CD5
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
78db27debbefed4220f3886a04dd63b306a95c2aa092c2b512e7b70f965a802e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
activeview
pagead2.googlesyndication.com/pcs/ Frame 54F3
42 B
176 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstEhrY-YTs3frpjcSiGVXqCm_7yHbpznN5AklegHrr0ifcE796zH5zShXrFGnXBBRpVMif9xu28gELrfuAhSYUzIDibhdzSql9n43GHVlYyaLCe1c1IPnwke0aXfQ&sai=AMfl-YTOFksl77vzw-LO2ml-oQuPZ0zwAa3TrLRpWBpUTx2baYe7d6ADc1S4H4uKaWS8YCUTr3AphESAfeae4mKMvF_NTfiUcjryT7kVtpOFncW5jiArTeLW_WN_bhFLzc3l&sig=Cg0ArKJSzP7I7IeDPwpOEAE&cid=CAASPeRoZJ-NdNoGQmPJqaaweeAgVwvC2Pqc6tXi_l6Lg92s_s7QKFju9QOklDsEGo2oDYHSC0AZUujeRVD3EsI&id=ampim&o=315,10&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1006&mtos=0,0,0,1006,1006&tos=0,0,0,1006,0&tfs=126&tls=1132&g=100&h=100&tt=1132&r=v&avms=ampa&adk=1015519800
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:23 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
showad.js
ads.pubmatic.com/AdServer/js/ Frame 01F6
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-68.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified
Wed, 21 Oct 2020 18:57:52 GMT
ETag
"13006b6-94f8-5b232eca8cf5e"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
13837
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=118001
Expires
Wed, 25 Nov 2020 04:23:06 GMT
Date
Mon, 23 Nov 2020 19:36:25 GMT
Connection
keep-alive
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 5D0E
0
0
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.51 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-51.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
icu=ChgIzLJhEAoYAiACKAIwtZ7w_QU4AkACSAIQtZ7w_QUYAQ..; uuid2=1413296632699071245
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified
Tue, 24 Mar 2020 15:52:19 GMT
ETag
"5e7a2cb3-cefd"
Server
nginx/1.13.10
Content-Type
text/html
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
17037
Cache-Control
max-age=86402
Expires
Tue, 24 Nov 2020 19:36:27 GMT
Date
Mon, 23 Nov 2020 19:36:25 GMT
Connection
keep-alive
showad.js
ads.pubmatic.com/AdServer/js/ Frame F41A
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-68.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified
Wed, 21 Oct 2020 18:57:52 GMT
ETag
"13006b6-94f8-5b232eca8cf5e"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
13837
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=118001
Expires
Wed, 25 Nov 2020 04:23:06 GMT
Date
Mon, 23 Nov 2020 19:36:25 GMT
Connection
keep-alive
Vary
Accept-Encoding
ixmatch.html
js-sec.indexww.com/um/ Frame D912
0
0
Document
General
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
js-sec.indexww.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
Apache
Last-Modified
Tue, 06 Oct 2020 14:04:48 GMT
ETag
"e20015-8f4-5b10114f2003a"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1136
Date
Mon, 23 Nov 2020 19:36:25 GMT
Connection
keep-alive
pd
u.openx.net/w/1.0/ Frame 1A59
Redirect Chain
  • https://u.openx.net/w/1.0/pd
  • https://u.openx.net/w/1.0/pd?cc=1
0
0
Document
General
Full URL
https://u.openx.net/w/1.0/pd?cc=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.198.0 /
Resource Hash

Request headers

:method
GET
:authority
u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=b0a95e53-dddd-4d4c-9239-7474a49a83c4|1606160184
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

vary
Accept, Accept-Encoding
set-cookie
i=b0a95e53-dddd-4d4c-9239-7474a49a83c4|1606160184; Version=1; Expires=Tue, 23-Nov-2021 19:36:25 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1606160185|gekin0vNiygu; Version=1; Expires=Tue, 08-Dec-2020 19:36:25 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.198.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 23 Nov 2020 19:36:25 GMT
content-type
text/html
content-length
417
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

set-cookie
i=32b3b931-897f-4807-b51d-0dac2ed332b7|1606160184; Version=1; Expires=Tue, 23-Nov-2021 19:36:24 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.198.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://u.openx.net/w/1.0/pd?cc=1
date
Mon, 23 Nov 2020 19:36:24 GMT
content-length
0
via
1.1 google
alt-svc
clear
async_usersync.html
acdn.adnxs.com/dmp/ Frame 374D
0
0
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.51 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-51.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
icu=ChgIzLJhEAoYAiACKAIwtZ7w_QU4AkACSAIQtZ7w_QUYAQ..; uuid2=1413296632699071245
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified
Tue, 24 Mar 2020 15:52:19 GMT
ETag
"5e7a2cb3-cefd"
Server
nginx/1.13.10
Content-Type
text/html
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
17037
Cache-Control
max-age=86402
Expires
Tue, 24 Nov 2020 19:36:27 GMT
Date
Mon, 23 Nov 2020 19:36:25 GMT
Connection
keep-alive
pd
u.openx.net/w/1.0/ Frame D8EE
Redirect Chain
  • https://u.openx.net/w/1.0/pd
  • https://u.openx.net/w/1.0/pd?cc=1
0
0
Document
General
Full URL
https://u.openx.net/w/1.0/pd?cc=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.198.0 /
Resource Hash

Request headers

:method
GET
:authority
u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=b0a95e53-dddd-4d4c-9239-7474a49a83c4|1606160184
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

vary
Accept, Accept-Encoding
set-cookie
i=b0a95e53-dddd-4d4c-9239-7474a49a83c4|1606160184; Version=1; Expires=Tue, 23-Nov-2021 19:36:25 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1606160185|gekin0vNiygu; Version=1; Expires=Tue, 08-Dec-2020 19:36:25 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.198.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 23 Nov 2020 19:36:25 GMT
content-type
text/html
content-length
417
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

set-cookie
i=b0a95e53-dddd-4d4c-9239-7474a49a83c4|1606160184; Version=1; Expires=Tue, 23-Nov-2021 19:36:24 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.198.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://u.openx.net/w/1.0/pd?cc=1
date
Mon, 23 Nov 2020 19:36:24 GMT
content-length
0
via
1.1 google
alt-svc
clear
ixmatch.html
js-sec.indexww.com/um/ Frame 7EE4
0
0
Document
General
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
js-sec.indexww.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
Apache
Last-Modified
Tue, 06 Oct 2020 14:04:48 GMT
ETag
"e20015-8f4-5b10114f2003a"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1136
Date
Mon, 23 Nov 2020 19:36:25 GMT
Connection
keep-alive
%7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame 6033
43 B
840 B
Image
General
Full URL
https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:25 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
pixel.advertising.com/ups/55953/ Frame 6033
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://pixel.advertising.com/ups/55953/sync?uid=1041cdd1-b1e6-4d6b-81fb-74a2f97108a5&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=1041cdd1-b1e6-4d6b-81fb-74a2f97108a5
0
124 B
Image
General
Full URL
https://pixel.advertising.com/ups/55953/sync?uid=1041cdd1-b1e6-4d6b-81fb-74a2f97108a5&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=1041cdd1-b1e6-4d6b-81fb-74a2f97108a5
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.106.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-106-231.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:26 GMT
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:25 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.advertising.com/ups/55953/sync?uid=1041cdd1-b1e6-4d6b-81fb-74a2f97108a5&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=1041cdd1-b1e6-4d6b-81fb-74a2f97108a5
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
369
sync
ups.analytics.yahoo.com/ups/55986/ Frame 6033
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
  • https://pixel.advertising.com/ups/55986/sync?uid=X7wPOQAAAIn33FLS&_origin=0&gdpr=0&gdpr_consent=&_test=X7wPOQAAAIn33FLS
  • https://pixel.advertising.com/ups/55986/sync?uid=X7wPOQAAAIn33FLS&_origin=0&gdpr=0&gdpr_consent=&_test=X7wPOQAAAIn33FLS&verify=true
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=X7wPOQAAAIn33FLS&_origin=0&gdpr=0&gdpr_consent=&_test=X7wPOQAAAIn33FLS&apid=UP2d57bfe1-2dc3-11eb-9e91-06c2c86cd578
0
964 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X7wPOQAAAIn33FLS&_origin=0&gdpr=0&gdpr_consent=&_test=X7wPOQAAAIn33FLS&apid=UP2d57bfe1-2dc3-11eb-9e91-06c2c86cd578
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-56-137.eu-central-1.compute.amazonaws.com
Software
ATS/7.1.2.128 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 19:36:29 GMT
Server
ATS/7.1.2.128
Connection
keep-alive
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X7wPOQAAAIn33FLS&_origin=0&gdpr=0&gdpr_consent=&_test=X7wPOQAAAIn33FLS&apid=UP2d57bfe1-2dc3-11eb-9e91-06c2c86cd578
date
Mon, 23 Nov 2020 19:36:27 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
ups.analytics.yahoo.com/ups/57304/ Frame 6033
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEFXQeWfwCFk4NkdtuOUxhrA&google_cver=1
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEFXQeWfwCFk4NkdtuOUxhrA&google_cver=1&verify=true
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFXQeWfwCFk4NkdtuOUxhrA&google_cver=1&apid=UP2d57bfe1-2dc3-11eb-9e91-06c2c86cd578
0
964 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFXQeWfwCFk4NkdtuOUxhrA&google_cver=1&apid=UP2d57bfe1-2dc3-11eb-9e91-06c2c86cd578
Requested by
Host: threatpost.com
URL: https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-56-137.eu-central-1.compute.amazonaws.com
Software
ATS/7.1.2.128 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 19:36:29 GMT
Server
ATS/7.1.2.128
Connection
keep-alive
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFXQeWfwCFk4NkdtuOUxhrA&google_cver=1&apid=UP2d57bfe1-2dc3-11eb-9e91-06c2c86cd578
date
Mon, 23 Nov 2020 19:36:27 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
usync.html
eus.rubiconproject.com/ Frame 0E85
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.212.16 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a184-30-212-16.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Mon, 28 Sep 2020 17:02:39 GMT
ETag
"4000c-123-5b062a240e9c0"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
238
Content-Type
text/html; charset=UTF-8
Date
Mon, 23 Nov 2020 19:36:25 GMT
Connection
keep-alive
Vary
Accept-Encoding
showad.js
ads.pubmatic.com/AdServer/js/ Frame 0927
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-68.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

Last-Modified
Wed, 21 Oct 2020 18:57:52 GMT
ETag
"13006b6-94f8-5b232eca8cf5e"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
13837
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=118001
Expires
Wed, 25 Nov 2020 04:23:06 GMT
Date
Mon, 23 Nov 2020 19:36:25 GMT
Connection
keep-alive
Vary
Accept-Encoding
ixmatch.html
js-sec.indexww.com/um/ Frame 9B6A
0
0
Document
General
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
js-sec.indexww.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

Server
Apache
Last-Modified
Tue, 06 Oct 2020 14:04:48 GMT
ETag
"e20015-8f4-5b10114f2003a"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1136
Date
Mon, 23 Nov 2020 19:36:25 GMT
Connection
keep-alive
sync.html
public.servenobid.com/ Frame 5307
0
0
Document
General
Full URL
https://public.servenobid.com/sync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
public.servenobid.com
:scheme
https
:path
/sync.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

cache-control
max-age=86400
content-type
text/html
content-encoding
br
last-modified
Fri, 20 Nov 2020 22:29:36 GMT
accept-ranges
bytes
etag
"a6b962bc9a589ee949a711f0d67148c0"
server
AmazonS3
x-cache
TCP_HIT
x-amz-id-2
Jkccas6oFFTy3i6QdExEaQ/duGR88vAOba3bNxacJshaAHPb91OXXpDe6Kq3oJJ//CQGfj6AvDg=
x-amz-request-id
B4F3141F9BF460C5
x-azure-ref-originshield
0G+K7XwAAAAAHF/kEwqvfSofwuR2ZG/ekTE9OMjFFREdFMDIxOQA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref
0OQ+8XwAAAADWJu0mAZmMQ7aoMda2NjIjRlJBRURHRTEwMTgAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
date
Mon, 23 Nov 2020 19:36:24 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame D1B2
0
0
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.51 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-51.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
icu=ChgIzLJhEAoYAiACKAIwtZ7w_QU4AkACSAIQtZ7w_QUYAQ..; uuid2=1413296632699071245
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

Last-Modified
Tue, 24 Mar 2020 15:52:19 GMT
ETag
"5e7a2cb3-cefd"
Server
nginx/1.13.10
Content-Type
text/html
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
17037
Cache-Control
max-age=86402
Expires
Tue, 24 Nov 2020 19:36:28 GMT
Date
Mon, 23 Nov 2020 19:36:26 GMT
Connection
keep-alive
sync
eb2.3lift.com/ Frame 2D55
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
0
0
Document
General
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.192.150.244 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-192-150-244.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
eb2.3lift.com
:scheme
https
:path
/sync?&ld=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
tluid=4789684314258996053
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

date
Mon, 23 Nov 2020 19:36:25 GMT
content-type
text/html; charset=utf-8
content-length
537
set-cookie
sync=CgoIgQIQ4PHttN8uCgoI4gEQ4PHttN8uCgoI5gEQ4PHttN8uCgoIhwIQ4PHttN8uCgkIORDg8e203y4KCQg6EODx7bTfLgoJCAsQ4PHttN8uCgoIjAIQ4PHttN8uCgkIXxDg8e203y4KCQgfEODx7bTfLg==; Max-Age=7776000; Expires=Sun, 21 Feb 2021 19:36:25 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=4789684314258996053; Max-Age=7776000; Expires=Sun, 21 Feb 2021 19:36:25 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

date
Mon, 23 Nov 2020 19:36:25 GMT
content-length
0
set-cookie
tluid=4789684314258996053; Max-Age=7776000; Expires=Sun, 21 Feb 2021 19:36:25 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location
/sync?&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 8EC3
Redirect Chain
  • https://sync.serverbid.com/ss/2000891.html
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
0
0
Document
General
Full URL
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Host
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

Date
Mon, 23 Nov 2020 19:36:26 GMT
Connection
Keep-Alive
Cache-Control
max-age=80572
Content-Length
4947
Content-Type
text/html
Last-Modified
Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges
bytes
ETag
"1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id
tx00000000000000a82c8f0-005fbbf876-413691b-nyc3a
Strict-Transport-Security
max-age=15552000; includeSubDomains; preload
Age
45
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1606160186.dop046.pa1.t,1606160186.cds212.pa1.shn,1606160186.dop046.pa1.t,1606160186.cds204.pa1.c

Redirect headers

content-length
0
location
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control
no-cache
pd
eu-u.openx.net/w/1.0/ Frame E988
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.198.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=b0a95e53-dddd-4d4c-9239-7474a49a83c4|1606160184
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

vary
Accept, Accept-Encoding
set-cookie
i=b0a95e53-dddd-4d4c-9239-7474a49a83c4|1606160184; Version=1; Expires=Tue, 23-Nov-2021 19:36:25 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1606160185|gekin0vNiygu; Version=1; Expires=Tue, 08-Dec-2020 19:36:25 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.198.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 23 Nov 2020 19:36:25 GMT
content-type
text/html
content-length
417
content-encoding
gzip
via
1.1 google
alt-svc
clear
abt
capi.connatix.com/tr/ Frame 6033
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/abt?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:25 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
recaptcha__en.js
www.gstatic.com/recaptcha/releases/UFwvoDBMjc8LiYc1DKXiAomK/
335 KB
131 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/UFwvoDBMjc8LiYc1DKXiAomK/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.5.3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
14a2806a256579773a3680e21459dea7827d002104c6336856e0bef9a39be0c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:20:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
983
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
133988
x-xss-protection
0
last-modified
Mon, 16 Nov 2020 01:06:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 23 Nov 2021 19:20:02 GMT
v1
geo.ipify.org/api/
462 B
1 KB
XHR
General
Full URL
https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.140.160.2 Los Angeles, United States, ASN18450 (WEBNX, US),
Reverse DNS
threatintelligenceplatform.com
Software
nginx /
Resource Hash
e3153b6ece02ba398d4b04f11afc78dea20a6a25edd5bdb9498eec237669a382
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 19:36:26 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, private
Transfer-Encoding
chunked
Connection
keep-alive
flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/
236 B
566 B
Image
General
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cda18822
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:f600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cda18822
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Nov 2020 19:36:26 GMT
content-encoding
gzip
last-modified
Mon, 16 Nov 2020 08:54:38 GMT
server
nginx
x-amz-cf-pop
PRG50-C1
etag
W/"5fb23e4e-ec"
x-cache
Miss from cloudfront
content-type
image/svg+xml
via
1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront)
cache-control
max-age=604800, public
x-amz-cf-id
PlU8BlCCm_zo3OaopEP6FLp2_glXZ8Sjpnjqv3OErpf1NXIiOlU22g==
expires
Mon, 30 Nov 2020 19:36:26 GMT
fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/
75 KB
76 KB
Font
General
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cda18822
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:f600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin
https://threatpost.com
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cda18822
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Nov 2020 19:36:26 GMT
via
1.1 e14614617e85116e937d5168b35a94df.cloudfront.net (CloudFront)
last-modified
Mon, 16 Nov 2020 08:54:39 GMT
server
nginx
x-amz-cf-pop
PRG50-C1
etag
"5fb23e4f-12d68"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
77160
x-amz-cf-id
i1-pL6peFocRiteQF63KLr3c3k7n-hMmsJftxM7XgL8JMAubpjQtLQ==
expires
Tue, 23 Nov 2021 19:36:26 GMT
adsct
analytics.twitter.com/i/
31 B
651 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
x-response-time
120
pragma
no-cache
last-modified
Mon, 23 Nov 2020 19:36:28 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
685201ba820ab05e61ea45fca30c7765
x-transaction
00f582ff00d6b27c
expires
Tue, 31 Mar 1981 05:00:00 GMT
anchor
www.google.com/recaptcha/api2/ Frame 4C4F
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&theme=standard&size=normal&cb=f8kyd88dny1z
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-0ke7WtZFemU/Cr/x7MEuGg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&theme=standard&size=normal&cb=f8kyd88dny1z
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 23 Nov 2020 19:36:26 GMT
content-security-policy
script-src 'report-sample' 'nonce-0ke7WtZFemU/Cr/x7MEuGg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
10832
server
GSE
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
graph.facebook.com/
202 B
582 B
XHR
General
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
1f0d1edadb60b2ea4e49965d25c246c5b94f525d1c5bfbe04eaa808caa0eb863
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
www-authenticate
OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev
1003022883
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
149
pragma
no-cache
x-fb-debug
WoA1uS46yJY/J1rkcW+TAt1bV3RkuUmhtMChVMfYD9IaQph1o49EvPulAE2yviNcHHkeWl18B8UgdlaPJwhg4Q==
x-fb-trace-id
EIhVq+6ihKP
date
Mon, 23 Nov 2020 19:36:26 GMT
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-fb-request-id
AaLbs5L27o8LmRpEmCrR7Oo
cache-control
no-store
facebook-api-version
v3.2
expires
Sat, 01 Jan 2000 00:00:00 GMT
share
www.linkedin.com/countserv/count/
0
0
Script
General
Full URL
https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&format=jsonp&callback=jQuery112409269004874098818_1606160178588&_=1606160178589
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

info.json
www.reddit.com/api/
102 B
1 KB
XHR
General
Full URL
https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.53.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:30 GMT
via
1.1 varnish
x-content-type-options
nosniff
content-length
102
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
server
snooserv
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges
bytes
expires
-1
anchor
www.google.com/recaptcha/api2/ Frame 27E0
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&theme=light&size=normal&cb=r1fcnvq5ywf9
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-k4XXKXFLpwK5zLyDDFZ4mw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&theme=light&size=normal&cb=r1fcnvq5ywf9
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 23 Nov 2020 19:36:26 GMT
content-security-policy
script-src 'report-sample' 'nonce-k4XXKXFLpwK5zLyDDFZ4mw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
10863
server
GSE
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bframe
www.google.com/recaptcha/api2/ Frame 7287
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=nwxipv7sylv5
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-uw+VdCg5aq+9cI58helIqA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=nwxipv7sylv5
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 23 Nov 2020 19:36:26 GMT
content-security-policy
script-src 'report-sample' 'nonce-uw+VdCg5aq+9cI58helIqA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1121
server
GSE
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bframe
www.google.com/recaptcha/api2/ Frame 22AB
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=cj5d5ob78jwb
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-KvudPGmaZvQwLTWgX1lsyw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=UFwvoDBMjc8LiYc1DKXiAomK&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=cj5d5ob78jwb
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 23 Nov 2020 19:36:26 GMT
content-security-policy
script-src 'report-sample' 'nonce-KvudPGmaZvQwLTWgX1lsyw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1121
server
GSE
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
st
capi.connatix.com/tr/ Frame 6033
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/st?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:27 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
g
capi.connatix.com/rtb/ Frame 6033
102 B
418 B
XHR
General
Full URL
https://capi.connatix.com/rtb/g?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
d1b90240f50bd6d157378be3763493df8c380781a600924b20a68974b8abd020

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:31 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
114
openrtb
ads.adaptv.advertising.com/rtb/ Frame 6033
0
215 B
XHR
General
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.37.94 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-37-94.eu-central-1.compute.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
prebid
ib.adnxs.com/ut/v3/ Frame 6033
144 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.242 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
40d3e8714942501e06dc10af93c93fd58799995bbd21c5553e7a92de8c7daac5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:32 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 724.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.85:80
AN-X-Request-Uuid
9c3d38f0-812e-4305-9d2f-80fe9b5b60b1
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
144
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 6033
144 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.242 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3e95b6de39019550cc26b2798a00c8de57acc203b4bb7fcf6ac8caad5dd3b04
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:31 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 724.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.170:80
AN-X-Request-Uuid
c36d98fb-a758-4ce3-97ae-98553a9b313f
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
144
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
avjp
teachingaids-d.openx.net/v/1.0/ Frame 6033
92 B
282 B
XHR
General
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=78c1929a-3d7e-4c90-a5b1-757bdfcc8597&nocache=1606160191719&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882778&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.198.0 /
Resource Hash
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:31 GMT
via
1.1 google
server
OXGW/16.198.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
92
expires
Mon, 26 Jul 1997 05:00:00 GMT
cygnus
as-sec.casalemedia.com/ Frame 6033
25 B
456 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%2235d02957e8f3ca5%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22367178fc52e60d8%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
357a71305805e9266be45fba40ec65eb5690161ccd3714d30e5e30a878a187d9

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:31 GMT
Content-Encoding
gzip
Server
Apache
Vary
Is-Traffic-Invalid,Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
45
Expires
Mon, 23 Nov 2020 19:36:31 GMT
cygnus
as-sec.casalemedia.com/ Frame 6033
25 B
456 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%2237d688914bb02fe%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2238e5e7117c4afc4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
243623aaae4672a307a0e7e0f5135ada1e92b9559ad365ae9be4aeb179ad2326

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 19:36:31 GMT
Content-Encoding
gzip
Server
Apache
Vary
Is-Traffic-Invalid,Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
45
Expires
Mon, 23 Nov 2020 19:36:31 GMT
translator
hbopenbid.pubmatic.com/ Frame 6033
0
59 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 23 Nov 2020 19:36:31 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/ Frame 6033
0
59 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 23 Nov 2020 19:36:31 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
avjp
teachingaids-d.openx.net/v/1.0/ Frame 6033
92 B
281 B
XHR
General
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=7f45dc4c-76a9-4508-9175-20a5b74bd01f&nocache=1606160191724&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882779&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.198.0 /
Resource Hash
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:31 GMT
via
1.1 google
server
OXGW/16.198.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
92
expires
Mon, 26 Jul 1997 05:00:00 GMT
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame
0
0
Other
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol
H2
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-origin
*
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Mon, 23 Nov 2020 19:36:32 GMT
x-served-by
cache-hhn4027-HHN
x-cache
HIT
x-cache-hits
0
x-timer
S1606160192.106389,VS0,VE0
cache-control
max-age=31557600
content-length
0
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 6033
407 KB
407 KB
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3edf0837f49625ad64af84f2a4d223b69ea99fb468ebbb2ece40286dbe64b6a1

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=855192-1271452

Response headers

date
Mon, 23 Nov 2020 19:36:32 GMT
last-modified
Mon, 07 Sep 2020 18:49:41 GMT
age
596500
etag
"7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by
cache-bwi5133-BWI, cache-hhn4027-HHN
x-cache
HIT, HIT
content-type
video/mp4
Content-Range
bytes 855192-1271452/32479190
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1606160192.148620,VS0,VE0
access-control-allow-origin
*
Content-Length
416261
x-cache-hits
1, 8619
st
capi.connatix.com/tr/ Frame 6033
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/st?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:35 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
abt
capi.connatix.com/tr/ Frame 6033
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/abt?v=78152
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.23.106.246 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-106-246.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Mon, 23 Nov 2020 19:36:35 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
sodar
pagead2.googlesyndication.com/getconfig/
8 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020111701&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js?21068792
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8c8787487e400b332256d22d5e580b57eb4232f86729f2f91b97f97c6f9a2464
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 23 Nov 2020 19:36:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6340
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/
16 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 19:36:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1603823857801521"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6015
x-xss-protection
0
expires
Mon, 23 Nov 2020 19:36:37 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/219/ Frame E5AD
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/219/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
4867
date
Mon, 23 Nov 2020 18:43:00 GMT
expires
Tue, 23 Nov 2021 18:43:00 GMT
last-modified
Mon, 05 Oct 2020 22:33:01 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3217
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
gen_204
pagead2.googlesyndication.com/pagead/
0
166 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gpt_2020111701&jk=2158994980634465&bg=!yMuly-vNAAVGySeIRlhaIgHdWOj69AIAAAB8UgAAABFoAQcKALBOhTEoUX43Ddl5BjgMZKOpNuYjkadO2iHNqlTM37sx8X9aL8kKSxsDUwxkco13H-VcUgOfggXa2WJDC5k_iQNoj5fl3oe6o3UpGCIilCdPkluk5sy3TOaIpnWu7iy2xlN4i26Bo1Agyw2tAKK91PdMRV3m8-oyOEG4GefiitPw7OV3w3TmlbGOxKz0xNiA18-LrrezaOtnRaITv6XmN3unmxh6sl-fkwlpJ77uYDkIyZkBtyK1UEhFLk9x0QRGpMG_wrdbApYp3ODTYWS_WwUOK7k0knjEQIrpsq6J6xzPtXoIRt82AbwPBI7j4JdSc9KqU9ASwyvP7XLabHMQCuuk5wFx7qiKMKdwYFY9gj47DJK6bPfAmXFcgSTxqFIyKZkfnyj3d19z4_kHj6EcYD9wgmYiBLwdKOK76AJOSDdxSzEV5BUAL89y4gaV6wsSHsXQwDSw9qUdtgD94JZJPQQ-uAL_uE3b49HPe6SNf7HJ_OLuP7NW0ERMod5mXVRMJkX_qm-G8y8kSyOoTKqZiKOOJMW68dQ-vsvuMdwwR_UzARRsEl7WXoy46x7gfNOp7p3ILuT2C470su7FF-UG9BPK3rPv5EeH1fqKg6aTYmwhvTnylvbqMvYiPiHfjc7HgBflE1ykzFxv8VmnsV8P5RUY8_JuaZbelcxyRpFQzA6Ds59IDi-x0Kiq1XdUeEvIWhnu_zQe8D3rHLV9DQwT-EmvsV4gWWO32WCMR45psIxFgVKFdwBeHxtUki60WOP1C9FA0N59JG4KB2UpoPQVb0jLuaYYa8eRepLoz-Q640tc1_W7prjjfG7brNE
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Nov 2020 19:36:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
prebid.a-mo.net
URL
https://prebid.a-mo.net/a/c
Domain
tlx.3lift.com
URL
https://tlx.3lift.com/header/auction?lib=prebid&v=4.10.0&referrer=https%3A%2F%2Fthreatpost.com%2Fjoe-biden-campaign-website-hacktivist-defacement%2F161471%2F&tmax=1200&gdpr=false
Domain
ap.lijit.com
URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.10.0
Domain
ads.adaptv.advertising.com
URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC

Verdicts & Comments Add Verdict or Comment

299 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| gAMP_urlhost string| gAMP_urlpath string| gAMP_urlquery string| gAMP_contentid string| gAMP_category string| gAMP_contenttags object| cfGjPa function| cfGjPb object| xop number| kPrebidTimeout number| kRefreshPollTime number| gRefreshCount number| gOXRefreshCount boolean| gRefreshDebug boolean| gPrebidDebug number| k30SecondRefreshInterval number| k60SecondRefreshInterval number| k90SecondRefreshInterval number| k120SecondRefreshInterval number| k180SecondRefreshInterval number| kDoNotRefresh number| kDefaultRefreshInterval object| gSChainNodes undefined| gGDPR_forceLocale boolean| gGDPR_silentNoConsent boolean| gGDPR_forceNoConsent object| gGDPR_NonTCFVendors string| gGDPR_publisherCountryCode string| gGDPR_logoURL string| gGDPR_privacyPolicyURL string| kAmazonPublisherID object| ad728x90ATF object| ad300x250ATF object| ad300x250ATF2 object| ad728x90ATFTAB object| ad728x90STICKY object| ad300x250ATFTAB object| ad300x250ATF2TAB object| ad320x50ATF object| ad300x250ATFM object| ad300x250ATF2M object| ad2x2skin number| gBrowserWidth object| desktopAdUnits object| tabletAdUnits object| mobileAdUnits object| gAllSlotData number| gAllSlotCount object| OX_dfp_ads number| minWidth boolean| disableBids object| googletag object| ggeac object| google_js_reporting_queue function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing object| FontAwesomeConfig object| ___FONT_AWESOME___ function| __tcfapi object| __cmpAPI object| __GVL object| __cmpTCModel function| __cmpOpenUI function| __uspapi function| __uspOpenUI function| pbjsChunk object| pbjs object| _pbjsGlobals string| nobidVersion object| nobid object| _0x5518 function| _0x361a function| _0x16f8fc object| gRefreshSlots object| gRefreshIDs object| gRefreshTimes object| gRefreshIntervals object| gThisRefreshIDs object| gThisRefreshSlots boolean| gInitialLoad object| gPBJSTimeoutTimer object| gAmazonSlots object| gAmazonBids boolean| gAmazonBidsBack boolean| gOpenXBidsBack boolean| gPrebidBidsBack boolean| gHasGDPRCMP object| gGDPRTCData function| amp_getBidsForAllChannels function| amp_dumpBids function| amp_dumpWins function| amp_dumpTable function| amp_getBestBids function| customOxTargeting function| openXRefreshCallback function| sendAdserverRequest function| checkIfAllBidsBack function| amazonBidsBack function| pbjsBidsBack function| bidsTimeout function| scheduleConsentUpdates function| sendBidRequests function| doSendBidRequests function| amp_refreshAllSlots function| amp_refreshSlots function| refreshAdSlots function| configureAdSlot function| getCookie object| apstag function| cnx undefined| $ function| jQuery object| gdprDynamicStrings object| kss object| gdprStrings object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| sNew object| s0 object| dataLayer object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| gf_global object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| _qevents function| twq object| recaptcha object| gaplugins object| gaGlobal object| gaData function| quantserve function| __qc object| ezt object| _qoptions function| qtrack object| twttr object| cnx_usr_storage boolean| apstagLOADED object| EVsc1a function| EVsc1b function| xblacklist object| player_instance_10241606160180046 object| cnxEnfStorage function| cnxsetTimeout function| cnxsetInterval object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| GP2pza function| GP2pzb function| xblocker object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb boolean| DFPSFMessageEnabled object| ampInaboxIframes object| ampInaboxPendingMessages object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager function| gformBindFormatPricingFields function| Currency function| gformCleanNumber function| gformGetDecimalSeparator function| gformIsNumber function| gformIsNumeric function| gformDeleteUploadedFile object| _gformPriceFields undefined| _anyProductSelected function| gformIsHidden function| gformCalculateTotalPrice function| gformGetShippingPrice function| gformGetFieldId function| gformCalculateProductPrice function| gformGetProductQuantity function| gformIsProductSelected function| gformGetBasePrice function| gformFormatMoney function| gformFormatPricingField function| gformToNumber function| gformGetPriceDifference function| gformGetOptionLabel function| gformGetProductIds function| gformGetPrice function| gformRoundPrice function| gformRegisterPriceField function| gformInitPriceFields function| gformShowPasswordStrength function| gformPasswordStrength function| gformToggleShowPassword function| gformToggleCheckboxes function| gformAddListItem function| gformDeleteListItem function| gformAdjustClasses function| gformToggleIcons function| gformAddRepeaterItem function| gformDeleteRepeaterItem function| gformResetRepeaterAttributes function| gformToggleRepeaterButtons function| gformMatchCard function| gformFindCardType function| gformToggleCreditCard function| gformInitChosenFields function| gformInitCurrencyFormatFields function| GFMergeTag function| GFCalc function| gformFormatNumber function| getMatchGroups function| gf_get_field_number_format object| gform undefined| __gf_keyup_timeout function| renderRecaptcha function| gformValidateFileSize function| gformInitSpinner function| gformAddSpinner function| gf_raw_input_change function| gf_get_input_id_by_html_id function| gf_get_form_id_by_html_id function| gf_get_ids_by_html_id function| gf_input_change function| gformExtractFieldId function| gformExtractInputIndex function| rgars function| rgar object| gfMultiFileUploader undefined| __gf_timeout_handle function| gf_apply_rules function| gf_check_field_rule function| gf_get_field_logic function| gf_apply_field_rule function| gf_get_field_action function| gf_is_match function| gf_is_match_checkable function| gf_is_match_default function| gf_format_number function| gf_try_convert_float function| gf_matches_operation function| gf_get_value function| gf_do_field_action function| gf_do_next_button_action function| gf_do_action function| gf_reset_to_default function| gf_is_hidden_pricing_input object| Placeholders object| ak_js object| commentForm undefined| replyRowContainer undefined| children object| wp object| jQuery112409269004874098818 object| gf_form_conditional_logic string| gf_number_format function| do_callback object| closure_lm_936715 function| jQuery112409269004874098818_1606160178588 function| cnxAddEventListener

6 Cookies

Domain/Path Name / Value
.google.com/ Name: NID
Value: 204=h-Kdqy_24YqaZ7kryz_mJPqD2pP65MlfSdeZUiisspxnF4FhTxnAJDQsjrf5NNA0DD32EgptNHWGZgM2q0Ffe542_rWrChnd8yww1zwLUyQfrUWFvV96XLnv_0S0F_NT0m3_8mv4Zak5SmkEWdS60OTfGmpetTB2MKPuCexdi-U
.pubmatic.com/ Name: PugT
Value: 1606160196
.pubmatic.com/ Name: PUBMDCID
Value: 3
.pubmatic.com/ Name: KRTBCOOKIE_107
Value: 1471-uid:3FVpXigf1KHhDA5
.pubmatic.com/ Name: KRTBCOOKIE_466
Value: 16530-fabdf214-ba7e-474a-b0c8-36ff294e722a
.pubmatic.com/ Name: SPugT
Value: 1606160194

63 Console Messages

Source Level URL
Text
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 372)
Message:
gBrowserWidth =1600
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397)
Message:
OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397)
Message:
OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397)
Message:
OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397)
Message:
OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
%cCMP: Startup v270 color: #555599
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: uspapi_init() - v0.105
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
USP: Locale=en-us gdpr= false
console-api warning URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3)
Message:
fun-hooks: referenced 'registerAdserver' but it was never created
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
ENGINE: gAMPidentityLinkID not present, prebid configured without identyLink
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
ENGINE: final pbjs config
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
Initial Ad Load
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
%cCMP: GVL version is 45 color: #555599
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
__uspLaunch begin
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: checking non TCF vendor cookie
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: No existing non-TCF consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: Locale=en-us gdpr= false
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: GDPR does not apply
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP response tcData.eventStatus=useractioncomplete tcData.cmpStatus=loaded
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=useractioncomplete
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
pbjs bids returned
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
gPBJSTimeoutTimer cleared
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
Amazon bids returned, count=4
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object],[object Object],[object Object],[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendAdserverRequest(): amazonBidsBack
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendAdserverRequest()
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
pbjs.getBidResponses:
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
gThisRefreshSlots=
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object],[object Object],[object Object],[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
console.groupEnd
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api warning URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js(Line 3)
Message:
fun-hooks: referenced 'registerAdserver' but it was never created
console-api info URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs(Line 9)
Message:
Powered by AMP ⚡ HTML – Version 2010270040000 https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
console-api info URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs(Line 9)
Message:
Powered by AMP ⚡ HTML – Version 2010270040000 https://threatpost.com/joe-biden-campaign-website-hacktivist-defacement/161471/
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: geo IP found region Berlin
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: USP does not apply to Berlin
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: Setting not applicable signal

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1x1.a-mo.net
a62a15d7931cfb5f7d4beaf22f1c2f91.safeframe.googlesyndication.com
acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
capi.connatix.com
cd.connatix.com
cdn.ampproject.org
cds.connatix.com
cm.g.doubleclick.net
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
geo.ipify.org
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
ib.adnxs.com
img.connatix.com
js-sec.indexww.com
kasperskycontenthub.com
match.adsrvr.org
math-aids-threatpost-tagan.adlightning.com
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
vid.connatix.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
ads.adaptv.advertising.com
ap.lijit.com
prebid.a-mo.net
tlx.3lift.com
104.111.215.135
104.111.215.51
104.111.215.68
104.244.42.3
104.244.42.69
134.209.129.254
151.101.114.49
151.101.130.137
18.192.150.244
18.197.37.94
18.203.78.129
184.30.212.16
184.31.84.150
185.33.220.242
185.64.189.112
199.232.53.140
199.232.56.157
205.185.216.10
206.189.254.17
213.19.162.21
216.58.206.2
216.58.207.34
2600:9000:2104:c000:6:44e3:f8c0:93a1
2600:9000:2127:b800:0:5c46:4f40:93a1
2600:9000:2127:f600:2:9275:3d40:93a1
2600:9000:2156:7c00:12:238e:df80:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:e4::ac40:a912
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:21::14
2620:1ec:bdf::10
2a00:1288:110:c305::8000
2a00:1450:4001:802::2004
2a00:1450:4001:803::2001
2a00:1450:4001:806::2008
2a00:1450:4001:80b::2001
2a00:1450:4001:80b::200e
2a00:1450:4001:814::2002
2a00:1450:4001:816::2001
2a00:1450:4001:816::2003
2a00:1450:4001:81a::2004
2a00:1450:4001:81c::2002
2a00:1450:4001:820::2003
2a00:1450:4001:824::200e
2a00:1450:400c:c0c::9a
2a03:2880:f01c:800e:face:b00c:0:2
3.126.56.137
3.23.106.246
34.226.158.15
34.98.64.218
35.156.106.231
35.173.160.135
44.241.206.146
64.140.160.2
65.9.83.127
65.9.86.127
65.9.86.58
002539c8b67a8dcba1567e0a369c186e84bd6f779dc53c012be418bd513a9d53
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
02245587b3802de49ddfc90e555a1c921b10282ab0f7918cc1e5e5d87af6d072
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
058bfaf2afb5cfb81f91c13e2c7178f1f896328698bd83994e00ec8c0b339592
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
0d36e9f65303fb5fca63264528bec52308d095d45643e31b4b4010492471cde7
108a5b54d35314e05ef92a087286618e06d9dc1cdec3ad9e7c5055731b3619a7
14a2806a256579773a3680e21459dea7827d002104c6336856e0bef9a39be0c9
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1ba0ffbeb734055aa2cac5e125373291b24e334e4dc371d0b53b19a4d6dfd6de
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788
1f0d1edadb60b2ea4e49965d25c246c5b94f525d1c5bfbe04eaa808caa0eb863
20e0a2f0989b9e191d329c856ac973fce762959f59ad4f170c3ec87d3ebf89c9
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
23f267f8e1e0f0f70fc22b27c94516289d946b212e5805e4574c76e3e1ce791e
243623aaae4672a307a0e7e0f5135ada1e92b9559ad365ae9be4aeb179ad2326
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2bab31de4ae3bc2852ac72af9f3b6f7391783e64baba437711b8cf70859ccdbe
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2dee7e97dcfbe2728fae1dece91c1760cbb16fc1d8c9d744a8af916c3c7fbada
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
32ac93f088da95e3c235c4b0af314bc0bab70eb1a3a7bc115266a60286a4bb5d
3335310f84fb019df38445d5b7a2297f0e6380b1c0bbca72c511cd8f6d8490ea
33b62a958618646e3ba06a9c0ea0469c5351879639c9c03503c2dcff08c5122e
357a71305805e9266be45fba40ec65eb5690161ccd3714d30e5e30a878a187d9
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3b95433ba02ae071b5810de00f8e1a9b500c5758f25a4bc952e1e482d837fdfb
3edf0837f49625ad64af84f2a4d223b69ea99fb468ebbb2ece40286dbe64b6a1
40d3e8714942501e06dc10af93c93fd58799995bbd21c5553e7a92de8c7daac5
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
500ea20f87ce27337a9d5c8171fb14b2bac878489809c0ce19358cb5eb051863
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
5368b02976babb5684a9eeeef96d9b4d12b86e70428ab3fd7c674997730d8b98
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8
5d0e7d0bd8b4693b10239e9be46c2c8d5cfc6053c41dd8775abee4a305b2ce53
5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
66e069239bcb31dfe981b4c7ff9181f626513d638bf79cec2e43df62bafd4d12
680c268c211b81fee63bd2133ddeca118e1bb9ba9f5ad107e98b3c4d230bf28c
68963209b16bd2a387c310495d51021d2fc57e5df9cb87ac98a0505c0daeca43
6b01cd562a9b13766e40baba0fda8a202be256c80a8f8f0e996f5c711ae477eb
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6e56945bdbc9e3daae1694d4b49cee8f3788266449596997acc112517a9826ff
719b70c90e6abca2b15a9a4b71da0f48f2caebfa2504e53ed0439fda8f0d4eae
73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab
7553727056b7ac07d419035cabee0c33d28003f2e60c11d752bb82078eb97c8f
78db27debbefed4220f3886a04dd63b306a95c2aa092c2b512e7b70f965a802e
793d64ca1fe1d76f1e3d56f5b7e35dc85390385f6523a7dc1aeb91a2065070bf
79407c87fa3b28ddbe2a5a8da4288b56ffae650c65a0f412d9c6135dba6610fb
7b74cfb5202288f56ae2eebc0bde0ddf144951f96cf49447d1cb0682fe20e1b7
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21
7e2b6ba6b43baa77a399ba464c6f0dba1b6d3ebd1c47c63f896db4990d5aaec1
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
80412b3870c5b5349ad52d6393130fe405055e16560a3398a03c9b85302ef320
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
851913072ba36e6383ee40856fa3dea9ed4c5f03b4e3effb6a3841aab3840d26
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
87a9bccee0c87e5a827bfacc2206a5550e149a3408c16a427cbe01dbb03d51d6
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119
8c8787487e400b332256d22d5e580b57eb4232f86729f2f91b97f97c6f9a2464
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d
94490f31f9ea17c5facd54d39e950b0d01e8d3000357e809687492f22d68a2fe
9c8c5ae8437903bcd9d8737d4c119c14492373d06e719215ba9ef065bc5e1186
9dfe387f4408128179039e002abd0ed21586a541626fbacc78f39a628d0c0da2
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a8636ffe87230ef44e19dffa6b894c7120181af3f87666fc235c88d3dbd102c2
a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
afd9d52a8fba416f31782a28e1d926a02da0f16dc29c2bd9758dc8fb11065059
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b130407e9b5a4d4118bb2102f7471f64d4ccdc3e82ca41cf977bd5b650ea13ce
b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094
b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef
b4522dc470bf48aed1e044f32d3e0a85bffb47fc51d16ba761fa82e9e110974a
b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42
be58c2f88a746f969c68cf496fb6bbf7ed1966174b99df14804479ba5a2308ea
c5f426d657f5ac25b6cf1862496b4f0d0503f04d3487b12748a45d75c872cbb4
c6453a5d60448b555f3cd9dd5a63c380e99ee5a979dcaa30b678a394ded64853
c7714be5150899442faf570cab4e7846a794e81d6b420300148d1f5a9a405c7a
c78896aa2332cad7be8eb1777485215b07f69cef8a4394c16ad1ce16c8cdcd43
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d1b90240f50bd6d157378be3763493df8c380781a600924b20a68974b8abd020
d375305f3ed36872d856c127f8c6e9526f06d2cd46293aea783cf184cdcf0bd7
d4740fa72d8b73cd21cc9eff4e5bb9b639a4f197a406c5a6fe6ebf879deed1bf
d56ee6a2ba915ad87e2dc9b49d9199563f3b35f9e048938e84d1a033e5c2b1c5
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d78f26bfd508c24c7fb9acab5ffbdc16b6bac1c8a1a88c1b7bc0a33169341dae
db2df5e70bea6b4585b510f0ea07d9498f0c6f3dc6fd0078038e51ae542cfdf6
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e0258b52cde21505c28c3fb5e5a0f57d885ebdb51238f6eb4674b0f134087152
e3153b6ece02ba398d4b04f11afc78dea20a6a25edd5bdb9498eec237669a382
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e95b6de39019550cc26b2798a00c8de57acc203b4bb7fcf6ac8caad5dd3b04
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e8347b75be6fd8c8526f52623bf351ff37e10b34e1f93f243d5e80adeffb36c8
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3
e9508ba7940744f67cae3678cec9deeb32fa61111365ff6366fd7e28dbb4c00b
ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d
ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f74e99191bec2d3d7cd58804f92b54564a34766e3a13dc37c556d31dce1aee4d
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6